{"report_id":"5873e565-6b93-4ee3-b455-a096e803ffd9","version":0,"status":"done","tags":[],"date":"2026-09-23T09:45:03Z","url":{"schema":"http","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"title":"The Spa Retreat - Professional Beauty Therapy Services","dom":{"size":125397,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1623)","md5":"f5d4265e74223ccedf1309c443df0fd5","sha1":"c16b77249339f24174b801af832e5269c22a87c6","sha256":"e9cd3eb096c98a50c94a888cc61d88d6fd50e4f2725e910d1633155172a0820b","sha512":"8cdb52b2597999def8199216cca1fc3485b55a866cc8bdc822cddb13395e1b35d08eb9fbc982b94c76d999aa4d0153d713cc796248763e757d92525fa83909f4","ssdeep":"768:FkD8VNgiHZuqZtreMZ64G3ec+wzZYX9WlGQsubd1WHut:uD8jHZuqZlep4G3eXwaNWlGQsqd7","tlshash":"9dc3213284031f7a86bbe2d2e5540f1a31b1ca47f782ac4406fbb662ebddca534179d5","dom_hash":"domhasha09dc36aad52f8dfcf791230b55ab992","first_seen":"2026-09-23T09:31:05.987711Z","last_seen":"2026-09-23T09:45:19.147172Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-28T09:45:03Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"the-spa-retreat.live","ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-18T06:45:27.986383Z","last_seen":"2026-07-18T06:45:30.100719Z","alert_count":545,"request_count":109,"received_data":4270356,"sent_data":57708,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}]},{"fqdn":"content.r9cdn.net","ip":{"addr":"151.101.193.29","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2014-09-12","domain_rank":211096,"first_seen":"2019-05-15T08:49:51Z","last_seen":"2026-09-23T09:31:03.630837Z","alert_count":0,"request_count":1,"received_data":17098,"sent_data":661,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"ae11e18058b2e9b836aed7b55e1f6791","sha1":"5841c1c47305d10a087746b1cd3d56da1fb3203e","sha256":"1524d6045f0299c9649f032f18ddb77754e5c391bc168969d8cc4d42fa82c717","sha512":"eef5994c1f63e73e9a90b7f069c5b0ff378c3c17909eb8958cea661d5e1feffeb8f7405a2ee5d404876372bc3c0adb751a428187a33411d48ba8348d99fc901e","ssdeep":"","tlshash":"0650000033000c0000c000cc0300c00c03c000030000000000cc00f000000000330cc0","size":11,"data":"","first_seen":"2025-10-30T20:48:30.055553Z","last_seen":"2026-09-23T09:45:19.174796Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"93a80e4c963e1ca7a6e9f4915ffddee8","sha1":"52b6195f7824f4365c7fb197c895cc0ba7470ebe","sha256":"d87401be06db2888c268d1340975a865bc7264b18350a30b634d4b50aee72138","sha512":"d0aad5c0ad0a2cfd934663b52f9f48f898726df3f3c0a950689df4f46b3b0d7e749716d680c69b95455302721d5e0a043d7852ed419b1824ba2786dcfe113eb6","ssdeep":"","tlshash":"b5600000c000f0000003000030300000c30c30c03c000c030300000000cc000003003c","size":13,"data":"","first_seen":"2026-06-03T19:25:23.241894Z","last_seen":"2026-09-23T09:45:19.175381Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"39bbc1c3634245e61dab5951dc999184","sha1":"9c0cbd62ea607aea11ab0b3424c83c9746849588","sha256":"3af1b9cb2b56cf4d7c8bc0e626fb269aca6d9d34e0220343f9199ac1274332de","sha512":"e0611a8dafb7f49b0d04789647890884ce08c24e371099cdffd48652202fd84225780f1efe7d05008405ea02d93cec158795b3219c5a7df9a036c267632aa77d","ssdeep":"","tlshash":"43600000c03000000003000000300000c00c30003c000c030000000000fc0000000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.927138Z","last_seen":"2026-09-23T09:45:19.176207Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"8c30862768d9b102886e89162713351d","sha1":"e219f298fe69440f8096c759ecb1bed6123081f2","sha256":"c4a9a04969a5856637bab61a96d51527e9942a9125365b28c72b5529f7fbb963","sha512":"5f74c275cc178151e86d44c50328260d1ca44e6578c5263b45676a18786547c4613da8c4b494e90441d09fda5409abcb1a05ed1fba862fa57fde103687bd5f21","ssdeep":"","tlshash":"5f600000c0000000000303000033000000cc3000fc000c0300c0c00000cc0030003030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.897186Z","last_seen":"2026-09-23T09:45:19.17716Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"ae55e135f327cd8d28f5331d3bb23271","sha1":"c13b79a76f6a4d453f9775e5ecee298658ea6ff0","sha256":"17086101a78ddd564b2ef27f79af1b357ac5b2a01fac5c929fd83eb8073e8b11","sha512":"d7045afe94d5d337c037c5b19f117043aa6c89ce1fd7e3a059ce1c3a32724251db52e370443cbcde4efafb0121bbe0bb516984b7b507c40a8e510101df2a5bf4","ssdeep":"","tlshash":"59600000c000000000030000003c0003000c3c003c000c03c000300000cc0000000c33","size":13,"data":"","first_seen":"2026-05-02T16:01:20.934179Z","last_seen":"2026-09-23T09:45:19.177899Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"29d1e4172d136d238e383f6724b980da","sha1":"ee1a18fecd6f79e76ffb41ee615fd69222459d5c","sha256":"812d55b6e036def5d1b0463999d724e818f65942ea91d162e37354f8646a1454","sha512":"9928cf5a8480f91e29a5a77f37032025e65867c7b063c3755758250725bcf80088b789577d2fb990b18b7e8e39fbcf938945f18e716207119a17463eec2ae94a","ssdeep":"","tlshash":"2f600030c00000000003003000000000000c3f003c000c030000000000cc3000000030","size":12,"data":"","first_seen":"2026-05-02T16:01:20.905134Z","last_seen":"2026-09-23T09:45:19.178527Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"f09725a7c032c36f1dcb6785efac8e98","sha1":"036b17c6af70de5a143c8aa77c95fff748717832","sha256":"189c56c0646ee65bb81471c825dc35a21e35586dd9f9e2d242eedeef73c55ee4","sha512":"147d6c300a6792ddca6df4811e4fb6156d83cc272b751d641f2e5946a705a7a465ba79f843838aa030f3f42c0de4af88d6bf7c7dafd6d14628df07020c9571b4","ssdeep":"","tlshash":"36600030ff0000000003033000000000000c3300fc000c030000000000cc3030000030","size":12,"data":"","first_seen":"2026-05-02T16:01:20.929724Z","last_seen":"2026-09-23T09:45:19.179273Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"3ae271f1876b01739297422397fcf21a","sha1":"d0efc11de55a9fa92b58ad8c6cdaec6b1aef3a1a","sha256":"83ddfcebb9b400511dd2119a9dd515ac117509cb81e409ebc7faa309e156a033","sha512":"cf01391ff07b740ced8d7e8157df8f48ae9cf09353ac1fdbd259c5945ba4abdbe7b3b9344291d239445f9b049781e06a0cc453afab18bb64e2881bcc07bbf250","ssdeep":"","tlshash":"15600030c000c00000c3003000000000000c33003c000c03000000000ccc3000030030","size":12,"data":"","first_seen":"2026-05-02T16:01:20.915808Z","last_seen":"2026-09-23T09:45:19.180499Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"ae242f903942b78cd2b935fe43c36b42","sha1":"ca1caefcd969fb76477865bec3c997aad037884b","sha256":"cb0c5d101c7463f9ead1d760801cc659525147b6a2194408e295970c0753513f","sha512":"594d52d47a6cc19b9f7a39ff3a7eb8b39a2481205ef4e8e27c474f350c401855631686fc49167b6403e6125f1b081aa6ed2914d3773d8aabe33d7bbacf3ce1ca","ssdeep":"","tlshash":"fa600000c00000c00c03000000300000c0cf30033c300c030000000000cc0000000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.960804Z","last_seen":"2026-09-23T09:45:19.183084Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"3fb8605ee62af3b41b171d634a799d64","sha1":"0d8de79cc27a893e23b59097786448dcf948de6d","sha256":"c0febfbf1b07fbdadfbaf51321d948b1755483837ae7d35afa85a95bd8ff4f4c","sha512":"8d969b3faf2e4ef3ca0771ca83bc4444c4fc38e06cf29e2a92f9eff852a1f6072d9f9b1e905a51bd926beb34ef23e7bdde8364d0bf854d5069a64631cdc11c09","ssdeep":"","tlshash":"e2600000c000000000030000003c0000000c3c003c000cc30000c00003cc0000000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.959155Z","last_seen":"2026-09-23T09:45:19.185974Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"dedd1f599f1d5ab0141da7f9a56e8580","sha1":"a6b3af831f3b6a5d07190e6b23cdf482e670ae30","sha256":"776e696a553d8192b67d68a2796e95328bc3eeaaf051eab39d2ac856380e5b85","sha512":"e02ef6e8b7f5fdfbf2534d17aea033796e2cc61d701ae99fdcb592f6b283f54a0fd0e7baa80d7f34162599672c7644dca73d60fb3605c1e84158e4a6218868c0","ssdeep":"","tlshash":"99600030c00000000003003000000000300c33003c0c0c030000000000cc3c00000030","size":12,"data":"","first_seen":"2026-05-02T16:01:20.925028Z","last_seen":"2026-09-23T09:45:19.186747Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"a943020225dadf7f8d57b9af09c8cef9","sha1":"16b540d143d7403368d385346be0f72551ca0d23","sha256":"60d848a07784b86a60fb0d9081cf42a6f3620323055bf6ef9a5d059afb05fb80","sha512":"058a8fbb8c5ccd01dbef41bfd7eeb073a809d8b353256d4e48ffcc6e178ccecb17e8d7331d623c1549da143e0808a36ed2fa13f97cb4e752cb3f26a8d39886f4","ssdeep":"","tlshash":"a8600000c000000000030300f033000000cc30c0fc000c030300000000cf0030330030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.898276Z","last_seen":"2026-09-23T09:45:19.188429Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"47dd1c5547e2d64353ac5079652fd7c3","sha1":"5977b07bd3a8bccbb6840b65a6b6d8a577f2988b","sha256":"27c3dd083f0566f4c660eea2e12571374329e9356528603be2edb198c2768b55","sha512":"d521d408c308e7177efa5cca22b7ad51ee9da3f7ff3cd019f7e5574b08aaadfc91e4b9c7799722a4ecb3e44ad5071d0d63e6efc3643d18e467e2b59c5ab93727","ssdeep":"","tlshash":"08600000c00300000003000000300000c00c3c003fc00cc30000cf00c3cc000000033c","size":13,"data":"","first_seen":"2026-09-23T09:31:06.16141Z","last_seen":"2026-09-23T09:45:19.189567Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"02ef5f4b462d2ba806cd5a4508180251","sha1":"6e0d6aa45dcc10f697012908d545207187b03536","sha256":"d28a33aa781bbd4ec2e39bdea843be06df1e2c1a326a45927cf9b1f5a6c50fec","sha512":"96b56ae9ad14a0c15a158ecf515972584b80fff2f7f9972e9f9cd6b8f87ca373f382baaf3e767f90dd9f681a37423a1c485d80067aff694fdf8260c5f4fe5ab2","ssdeep":"","tlshash":"ae600030c00300c30003000000300000c0cc30003f300c0300000c00c3cc000000003c","size":13,"data":"","first_seen":"2026-09-23T09:31:06.17449Z","last_seen":"2026-09-23T09:45:19.190794Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"8e34af03b248c0fac95c7aa7ccb21f3e","sha1":"0ea572c8da4d4e0f51fe2a315e3e3488124ab3ac","sha256":"28e690a5886c6767a200779b5fd029e5fc66394c2ee851c9e363a39448850700","sha512":"7c75aaba7a272cb5711bf42ebe958d7c1945931fc01cec5c2186e98d7855ce76069b07b3e706d3c366cc02fcd6fff084a5a2cab8b84db7bea6f652adb4ed2fa2","ssdeep":"","tlshash":"23600000c0000000000f03000033030000cc3c00fc000cc30000c00003cf0030300030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.953434Z","last_seen":"2026-09-23T09:45:19.191746Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"ac20b98c974b6a81aab737cd72d91e89","sha1":"ae26508aa15fb9d711cfb7531299719eb77931d5","sha256":"450a969b38adb93b8aedfed494ccb88d3e97eef4f85305f7982d541b2cf97658","sha512":"31ea04b7abcc8e5fbcaa00d646d0c4d75e5030d8e6a21a5606b4ca951f6bed39c9c5e585548dbaac2c4b8f2cfd5639d1f7f7d5be68660ad94c6f5b0201bd9a71","ssdeep":"","tlshash":"07600000c00030000003000000300000c30c3c003c000cc30300c00003cc0000000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.906394Z","last_seen":"2026-09-23T09:45:19.193599Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"ccac52f735a2d57b8ce1efe53af2d233","sha1":"15340d60072326b16d10551231366635717f87d5","sha256":"5b3e710389ec3189907f5448d5f4c1ffad92fac7572e57cdc3e88c87276d1012","sha512":"da0695507ebd46a9f931893470d9b01f2cc33895768ea7ebb05c848912792dffaa70b91b8ebebc650c673053d2bb8069c84660f86de7ea33a944752d9b1bd76d","ssdeep":"","tlshash":"25600000c30300000003000c003c0000c00f33003fc30c0f00000c00c0cc300000003c","size":13,"data":"","first_seen":"2026-09-23T09:31:06.10004Z","last_seen":"2026-09-23T09:45:19.194724Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"839e59b12afb756a6520b2d9ecc90a28","sha1":"5040444d0956d09f9096160fec29a520170d34d9","sha256":"ebd53bbdc3632b2c57017fc3a5b05a90be1cf5669cec7a9b895f21b85ab6ece5","sha512":"46fdd44ea9e44ee8bb00552fe10b78b4bede59007086ce7e578588c3391ef090af6c5f5496ffdfe4d2de9aa2521d5c0a03a18f366f7886ab5dc85965cc183873","ssdeep":"","tlshash":"6e600000c3c00c000003000c00330000c00c30003cc03c3f0000000000cc30c000c030","size":13,"data":"","first_seen":"2026-09-23T09:31:06.187467Z","last_seen":"2026-09-23T09:45:19.196605Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"faed1e623568932c764032b88fa2829a","sha1":"9837fd2e1716ce0adeb3fc4ed4ec8a5564b50a14","sha256":"045763b6c051f256b46a1f14033c964556471ea1fe876bdab540910c49c659e3","sha512":"d58bff06993cf498bd62a6bd018d4921f76d1560c2a9ac8a217efeb729abe9ca1c937aaa465379279cd2bb1eeb5044a15a008df82516d1eba970a3c5937e277e","ssdeep":"","tlshash":"ff600000c0000c000003000000330000000c30003c000c3300c3c00000cc00c000f030","size":13,"data":"","first_seen":"2026-09-23T09:31:06.217121Z","last_seen":"2026-09-23T09:45:19.198338Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eventHandler","is_inline":false,"md5":"df68b6e36eed0deeb59933e449eb0da2","sha1":"a2e21d82c741d3e80ff5a02dc60c3846a2abcc0a","sha256":"f05739e31e6128b97ab42d98097694b9e654e13b5e3bfba71a0ffca67fcd4d46","sha512":"cac7216d5507a6ae5b110f7c1bffffb5f08fb9cc1097b4b64bae68539a564cae6ef7890cdc2ac4f484afe6a4048d9ce9ce0d76e9db949ed12d54ef968b7b3ac8","ssdeep":"","tlshash":"6790040c073c50401d113d00cd0143c0404144170350345df0177cf1407c44c00cfc51","size":43,"data":"","first_seen":"2023-04-21T08:33:12Z","last_seen":"2026-09-23T09:45:19.199411Z","times_seen":233,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"2c5794ceab1f74ffa5740c54aef8d205","sha1":"ac4498c5933e4f27aa5bf66fcf6e338283802c4b","sha256":"dbf2f1090907dadabbca01f5412fa297b695249d3ebd2c213e97d27cc126fb7d","sha512":"d643c96e4792b0fb3b26557f812418358538854dee6c4f9912a90e6d0549154c76c0bc53be1dc6a61464f591224c33e5f77cc2537d23b4fe7cc829679528ca02","ssdeep":"","tlshash":"4760000300000c0c00cc00300300000cc000c00003330030000c00fc30000cc0330000","size":12,"data":"","first_seen":"2023-04-11T16:21:50Z","last_seen":"2026-09-23T09:45:19.200299Z","times_seen":253,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e0666bf573860ec8717c00778438147b","sha1":"7ed91619da9535ff694d8410402ead060dd2d4cb","sha256":"6d7b30fcae530fbbe80e8902d187554535465d683f50b181c9b5f42299a1be0e","sha512":"a2e924d2d78d828b79fa4a0a44d998faef3a94ec769f7518561c165fd24fdd69a3faf100287184edd4ef4b08a4111e3c6d5335903c82c21ddbb7b8b109c430e7","ssdeep":"","tlshash":"56c02b1c0115543216902ae1b00a890c51f6424cf0012c42c01f082441f0b74158fc1a","size":136,"data":"","first_seen":"2026-09-23T09:31:06.060605Z","last_seen":"2026-09-23T09:45:19.20096Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4c6e6d5a5ede96dbc946ee00f9b8a721","sha1":"5f83b3ea4c217d2a2680bfa86d5f0e084fb080c4","sha256":"6d1716d1983a2a2d576bda4f88d4780d7e456710c9ad01af42f24faeb7110719","sha512":"6e814ed185ba7c96f2a56b0036d32ef4972609f87e7dd2e15a60d1d6b78e102d8bff620ab37883ffb06fb8eae262004b21146aade79b3fb907f93b850bb90b7c","ssdeep":"","tlshash":"1b90047030004d74054d040c743dc3cd3d31c450f5073400c0ff30450030dc10500d55","size":45,"data":"","first_seen":"2023-03-07T21:51:05Z","last_seen":"2026-09-23T09:45:19.201907Z","times_seen":224,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"29ea13038c4988c8e01a25efae0bae0e","sha1":"f9c79a2a5e9402339e68b304e999c2aadb325031","sha256":"7993e5f0f6387019eb1d232837535e0421211b8361dc08f3dcee57b544c669c7","sha512":"bdf75e1a7c050e94fe7957cef7f2c719fdbcb729dff69597e5f2f825df3f5cb2647d0d22e1fd2560d632f4760b942368b2f7baa19c70fa125a9914ce311b5833","ssdeep":"","tlshash":"118000000e32b00f2a80bc2c0f2802cb80082a08ca0ce8a0c2b002a80ba0002baa820b","size":32,"data":"","first_seen":"2026-06-09T08:40:52.203788Z","last_seen":"2026-09-23T09:45:19.20258Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"9e0b455df6cc64722e3ec7ce383aa7f5","sha1":"8de5d9d08c68743b7da7131e3470b06dd81f96df","sha256":"5e3e23649727f2aa66586c45076ec3d999a9c83db586300a57eb64325e17e4a3","sha512":"aedb79a9c7fb489570d5f86c9631f61fc06939c6f0513366a43efbcabd95b3d6a528513b317a98c7984b7017d04881b8584947c791fcd969ac685be0147b9f0a","ssdeep":"","tlshash":"0290025721514b78089d757f15346288ea519428d81ad400450a197175309414016540","size":52,"data":"","first_seen":"2023-03-07T12:09:47Z","last_seen":"2026-09-23T09:45:19.204187Z","times_seen":188,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"718ab6da0eda0e3b0222c610de3a78c2","sha1":"0f78990887c233f32526c903e685f49d7bee735a","sha256":"a404e0b9a12320907563d22a458a53c17f272a1437387c731876f82f22ab0b11","sha512":"203483eb0643774909140ccebe054b5e38f9a3e968752d79aa2256424ff2fa04c5dfb3f112c83877344e403cf94fd6dd67ada4f4be6229288ba3f9b4c0290a89","ssdeep":"","tlshash":"22a011f02e800a28b3ec0fc2c8f0003a88e0c200202c0ec802e800080c2c2ca80b28b0","size":86,"data":"","first_seen":"2026-09-23T09:31:06.070543Z","last_seen":"2026-09-23T09:45:19.20643Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4b837c3ac2dca61bf86662b1566c6af6","sha1":"9bb8d51e4696f84e645603c1015ff678f3377526","sha256":"ea2f6936a49ec7e859210d38542eb9993c30c6d0611d127823092500a62dbd7a","sha512":"292a061ff4255ae1bb0d493ae6c225e0ec00c329fcc5d247ca8298c7ab74ac93e20750b822a4a60f072c80aecbde59e7f0f7b745bef083801b552c541ef0ff85","ssdeep":"","tlshash":"a921cdbd73d44ba4af1c89c6c82b039b4764f327e5e14f8496a627205d65ac34474bb1","size":1141,"data":"","first_seen":"2026-09-23T09:31:06.07267Z","last_seen":"2026-09-23T09:45:19.208028Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"cda4839049342c33e9dcf4758234db90","sha1":"7184e973d4227074aa592d93b1d63ecaf4d89b6f","sha256":"1303d0e6241a1f3a884d9a4acb364f4d42fdc159eaea43462c80e0f6cf9f26a1","sha512":"63a7b5bd6b410138ea9e771f54b691f1268085e49e5f404c97bf2691062758dd01e10e6ba071e7afca02707dd991df3212248cfedb3c49c04d854245c065b740","ssdeep":"","tlshash":"e42108bc37d65394af0d46d4e46f212b8b68f363d9a4af484ad2b7b11c418c760707b2","size":1197,"data":"","first_seen":"2026-09-23T09:31:06.074606Z","last_seen":"2026-09-23T09:45:19.209206Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c5e53b6a23b6207af5b8d7279c56f418","sha1":"a4959eb29d4b6e8b2a7a07aff9ced7f18a41896e","sha256":"0bd317402fc8626b83cdf1c735a07f335fee6f196b7d7a07e7a0bedb9192f4ae","sha512":"d685e0bd09537f04001be82c30356764b9fd6b1efdf3cd189bff020d1a69ddc02ecdaad1843ca099b6fa56466883a30f22558bd00c72989e71c1680e63e3d711","ssdeep":"","tlshash":"57b001f92e800628f3e95be0d9a0582e9c90d611201d2cd846e5081dad3e6dbc17a5b1","size":93,"data":"","first_seen":"2026-09-23T09:31:06.076038Z","last_seen":"2026-09-23T09:45:19.210471Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"9974c87dc06dca2a5668d62f478ff010","sha1":"36f1eedfbc245a72d15514706b77ea35e97dd99e","sha256":"0505f13910b1279c55d5e6b1bdf32dd4913b2f58590761147e0e192c8bfce73c","sha512":"21d282d5db09a59eebc53ef1df260f285b1281e432ee5f2a0597d733a4b041c535d0f615c27fde394f44053fbbf3ee2e606d6793b04aa11280290e0643fe7385","ssdeep":"","tlshash":"34a0223203820f388200803ca30e3b00ab3f8e8be3a0a2308a220880bc80032e830cc0","size":70,"data":"","first_seen":"2023-03-07T12:09:47Z","last_seen":"2026-09-23T09:45:19.211392Z","times_seen":274,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/roe.js?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1a4cbaba874a6c6741f0a354ee607187","sha1":"b332c77da132b2201fe51ee8e82a800722004807","sha256":"29591fa5d1f6c94bec0e9660d424a412d9f7b66074254a76d7446a612759502c","sha512":"b22f5f9602ea8d6fcba7ac9c280b73fbf823ce2b383ef7d82787f624663a86a43bc94baa07c5c77ace722b0a9ca46644bd6e15d7339bdce2c15a6f3cb7f56452","ssdeep":"1536:qF1/W16+23z6PaWI1ybC4oMy9SNE+qgoth6HKKsjnAiUX6sYhn6Vz9MyRYb8BpOY:TfxEEHXsjnAiUX6snhzDBUQmO2g","tlshash":"cd6382323544153a82fab56e126fb78d34724494ea02e490ed7ad8706a70f6354ffef8","size":72815,"data":"","first_seen":"2026-06-13T20:04:13.726082Z","last_seen":"2026-09-23T09:45:19.174033Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"ae4d6ebc2590e6e5a4029f72b3eafa63","sha1":"6d5096f88d4a14b277ab0ce21869f66d8313907f","sha256":"3669b076bb822c756e9b4e6a540101f6a90281a854bc18a9d9aa67fcb855176f","sha512":"75c29dd9aa206490e2f4f99ae8d83b0b9930fcbb264379888e6fb7d11636b54bbcd4365682cecae894daeba414bb72df28200bec54999c2e2bc59f00f2a62401","ssdeep":"","tlshash":"5b600000c0303000000303000033000000cc3000fc000c030000000000fc0030000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.901253Z","last_seen":"2026-09-23T09:45:19.213046Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"2ab9ed61ea1882d4c1797286bb3ca4d7","sha1":"2ea601affd7039305181a52e8c9d2ba8a4c63917","sha256":"048b217c06fe1c1996677f31a7a4457bb241861dc6175c794fcd7244427ff8ce","sha512":"8987a42e75d27c26286591be47008e67b52efb019c7286b8d2d1a439005143dedb912c2fae19106bf28e0a952c80c6a8cdea909715b7b7786baf8fb61167829b","ssdeep":"","tlshash":"0d600000c00000c0000303000033300030cc3000fc303c030000000000cc00300c0030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.885817Z","last_seen":"2026-09-23T09:45:19.214206Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"e65f2057cb20d2b8e9cd27fe769a3419","sha1":"966bc01187a70378a6ae65b29badc5c443ad6e32","sha256":"c9618f4e67ce9728613ec850aa78f6f4af2a03e446c9213e016eb2d648bd4674","sha512":"6a7559cada1ad63d2e5ce57d6a6fba1f09fa2e43ce1952eb5dfcbe88b05da9a53b12123c904a8a1dbaed7a4d9d5ccc0c7ed7d8181a36f3a9aaf2ffdef802a4a5","ssdeep":"","tlshash":"30600000c30000000003c00c30300000c00c30003cc00c0f0000000000cc30000000f0","size":13,"data":"","first_seen":"2026-05-02T16:01:20.896017Z","last_seen":"2026-09-23T09:45:19.215484Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"54aef8f98bc1c5b2ab0114a85751bd02","sha1":"30de3def74b322519f9340121008f033b475ace5","sha256":"9b8963f35d97dbd76464f6937bc01bdd8c4c372c5295dac70695527235107716","sha512":"d99713c99c140d71a779cdfe12a469c3955f07e1b796dd0c872d097df74fe4665f138a5119486c3d42c670879ecf4c0f4a2b89ceffaafb8f2c6077347ba6ab75","ssdeep":"","tlshash":"d5600000c0000c0c0003000000330003000c30003c000c330000000000cc00c000cc33","size":13,"data":"","first_seen":"2026-09-23T09:31:06.133316Z","last_seen":"2026-09-23T09:45:19.216858Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"a1daac64846550b164e039a7b3dbfb73","sha1":"80db1ee435fbd2e4a8e36beb7b02f6b933b57ed8","sha256":"d337643d4e47f608fa772440c91cee0b2845e7c5e889b84dd2e0cc2804df3792","sha512":"111b2bb071338181a4dc14d9895acfc1b4181795792388df1674af2fbf7141e82b20f676674d8b9390355c4e63cb9963f048072ff4fc8ec06339324ca18399b7","ssdeep":"","tlshash":"99600000cc030c000003300300300000c00c30c03f000c0303000c00c0cc000000003c","size":13,"data":"","first_seen":"2026-09-23T09:31:06.157405Z","last_seen":"2026-09-23T09:45:19.219477Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"1b00b63828b0b27c716a49f23b3e746c","sha1":"d31dbf5e3bd43c26023b9188580b81e8fbb5b7a1","sha256":"8fd70e6c5705eac0a15f2ccb196336c964d71ae273812e9167d6aa8177718ad1","sha512":"31059af4d65c7ff15a5178ee717450ce8a3ff7f26509a004e03067ff02728ab1b792003722814df360801cb8f3628ad5098829fa997bd59d36202d8a5475ba84","ssdeep":"","tlshash":"2b6000fcc00000000003c03000000000000c330c3c000f030003000000cc3300c00030","size":12,"data":"","first_seen":"2026-05-02T16:01:20.911179Z","last_seen":"2026-09-23T09:45:19.22215Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"c4757055601e0b329febc978076bfad8","sha1":"667c3c61abc208cb04ae7c157fe42682b0c22607","sha256":"f7f49dd909e16419277aec66b9a39c5007630350622cbeeb7ea91b62d78d3455","sha512":"4bf7dacb424b56f7f55e35e4db4ba19f5e996ea599a66c44518c96a9902c3b9875408a7e8efcd926c7a89f4443860b18694ef7c3cf2a79fe02a9ea615483bd50","ssdeep":"","tlshash":"a9600030c0c30000030300300000c000c00c33003c000c0300000c0000cc300000003c","size":12,"data":"","first_seen":"2026-05-02T16:01:20.903873Z","last_seen":"2026-09-23T09:45:19.224898Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"e19c150cb401d6cc91a3610d10009d3c","sha1":"d9b243dd68bc7d5825e975afed5f0e4cbf6611c7","sha256":"31c1bc34ff3f157925762577ea99699c7dc049a5f2bbd8d6afd453863fd7a3c6","sha512":"dd455b34b436d5777940335a19f6a9ccd1ed8f5b42656f628dea89cf8b9d8071d9a54ef898c91ef734dedcc3071085b307996aaf2335cd84902b48184336c552","ssdeep":"","tlshash":"03600000c000000000030303003f000000cc30c0fc000c030300000000cf0030000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.891331Z","last_seen":"2026-09-23T09:45:19.226042Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"2d1cefce4983c2bd4ddf206ae5d25a1e","sha1":"53725a239558f8b600166267055931ddd50f66e7","sha256":"b2b07d5c1e636569e61c0bf82dac1a8b72087343c5f0fd411f59c4b30dcaa249","sha512":"107c70784441875da9aa40c8b399ae186d8cb3b170b32785dc30c0518244540b954c6967ce7066593f5f764d91557eb7ea72a6cc6c5f1acd2ef1b35ac4068065","ssdeep":"","tlshash":"5b600000c0000c000003000300330000000c30c03c000c330300000000cc00c000c030","size":13,"data":"","first_seen":"2026-09-23T09:31:06.178747Z","last_seen":"2026-09-23T09:45:19.227548Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"119d0ce6b7aaad9846a0c7a39fb6f2cd","sha1":"bdd9141f5acaf4befe0c7ffbb64906c0e570f3b3","sha256":"3263e3050bcfaa2c57359a955f2a9d3c314518d8a868c5f6af17858c9d91e2f0","sha512":"94ddf896f2af52f9609c233f414418ecacec6e18ec80f59fa650464e149803e577f7f97f3fa32b2880611c956173909fcf3c4d74b829da1f66730fdc50ad7dc6","ssdeep":"","tlshash":"88600000c0000c000003030330330000000c30c03c000c330300000000cc00c003c030","size":13,"data":"","first_seen":"2026-09-23T09:31:06.173148Z","last_seen":"2026-09-23T09:45:19.229182Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/prs4.js","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"85e324abaedd39578ca6c3b7f4d50d77","sha1":"f0f5b668b40d575cf787b00ca3f4f8c5ad9f60dd","sha256":"2c11311993844e68146f28d73f4761bcbae7c80bb465956292eee630e534b8c2","sha512":"5bf40223604775f44d4ebbbd34446a583a01603b46b631a0658bc30e4f0dc8a3e4e15ae1541de798d2e6aacdfd88fdb0d0cc5a7b0efa1c6e855216ea571c7aff","ssdeep":"1536:2Hs27aLkLi9uRi7J+i/rj6nuQ88YA4c60geNQgh:Ws27aLkLil/X6jfxL","tlshash":"fb33c77b3004053641ff26af22ae9b8c3031d498ee02e845d97a9f729574f5651beebc","size":52624,"data":"","first_seen":"2025-10-23T13:05:54.852563Z","last_seen":"2026-09-23T09:45:19.157474Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"08f45809dc36033a0f2fe4649d4d71cd","sha1":"2ae2d5fa8c077426ae4912b0bd4f34b27252d89c","sha256":"a6da58db608b36f175fb3b369b385533ab757aad8c047912e5b2eec28cd6794f","sha512":"42078270497e4d0da7b14717f8b34af4b1f9163c0d16e88fdfb21b6edeff0e5105df7bf88c31a33424bc433afd7ca3d9245abd541881d20639eabf696a79618c","ssdeep":"","tlshash":"e4600000c0000c30000303c00033000000cc3003fc033c030000000003cc0030300030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.88727Z","last_seen":"2026-09-23T09:45:19.230314Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"39020465c4ca6796c1c128624e66b3f6","sha1":"9f9908889de50c18532f89bbc5a3bbc09e3da563","sha256":"a0459fff6301a5a39347820458df81d82d64f9d1d4c95c0e300957ced4744708","sha512":"fed0d96237d5c87191646ee1ce344b573f5beb6b080b8997f6183bd1c592482a458caa63ab316df7c2df16e787d60fb1ee68342e5f6d4dec0bd389fd3b115a1c","ssdeep":"","tlshash":"54600000c0000003000f300c00300000c00c3c003c000c030000000000cf000c000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.907519Z","last_seen":"2026-09-23T09:45:19.232549Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/replaceMobileFonts.js","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9aee92f9287fc5569d0905bf7e206649","sha1":"b249bb4a3cef79f1bcdc10c356674128af69a770","sha256":"36ed540680040ba2ec42cbc8af14bd652aafb326de2b63172e7b8f26ca8df477","sha512":"02be8adcda1fdb9b677d491789971050c83da81f37b0c9bc85f15de093b341777474f7ba1a3e9c2b26a8df6abc57d8ae19a8bcd0737e4d39d2834e3be834463f","ssdeep":"","tlshash":"7ef0e242330c202b69b6562235db400530a5836f55f5f092beeee95911f0c2a17a2ebf","size":521,"data":"","first_seen":"2023-03-07T12:09:47Z","last_seen":"2026-09-23T09:45:19.151384Z","times_seen":163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"b2952186ec3ab543e96377fec46cf16f","sha1":"b3315ef6753f442690fea5dc2ca9904c37dc522c","sha256":"60dd66c43c35335dd3a30459b01b7aeda94950d9ed0aada405c36c72d7cf752f","sha512":"f021b390845d816bc2c5bf361302a2af897fca6ccec9d231c32bfaa03088e6feaf59d34583a7bddb4d93b50eb3d12b9675ec396a4f4baa5afeb04349a30a04a2","ssdeep":"","tlshash":"50600030c0000c000303003000030000000c33003c000c330000030000cc3000000030","size":12,"data":"","first_seen":"2026-05-02T16:01:20.90996Z","last_seen":"2026-09-23T09:45:19.233302Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"b31ac0eef6805594507792d2f77bdea1","sha1":"cb86bfba7acfeb56920ac5c505c120ada8ac46e2","sha256":"d5768372d965dd8314cf00cb20440bf6810a10e449cde181f72c0071fbc9f7e7","sha512":"83d7a3dea8031bbf33b0a7e73500807826e3b9d5b8c5899703597a04ab893b472bad28f49f44b3d06e36c0d49a5dc9952b8ad02b91df7afbd34657c3e85165ab","ssdeep":"","tlshash":"4c600000c00000000003000000300000c00c30003c00cc0300c0c00000cc0000003c30","size":13,"data":"","first_seen":"2026-05-02T16:01:20.89243Z","last_seen":"2026-09-23T09:45:19.233991Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"ab97e35dbe181e98d4e81155adba43e3","sha1":"566b75f9d99ad70c36dcf03b3f3846bc7a90b16b","sha256":"fff8e197625d053e8d29da99f0d6801ceea7544e9cff3fd169951d0f16d46f36","sha512":"e6f5e3d69b84ed52deef35e188f5f20e58c8dc04c7f30c2665cd95c67d8876a97dbf5aacb6e725aae33ad6907ebb15eb32bfa729bad22327277dc1568898868a","ssdeep":"","tlshash":"6b600000c0000c00000f300c00330000000c3c003c000c330000000000cc00c000c030","size":13,"data":"","first_seen":"2026-09-23T09:31:06.128305Z","last_seen":"2026-09-23T09:45:19.234646Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"6f48cb497109885e230efafa36acd251","sha1":"e3ebb7137dbace2924b59ca7bbaae4cc34676630","sha256":"e40b10315f3684c44dfbd458809bf9f1a9cfd790c0867fc5ef4b3b670e302507","sha512":"2d7c67b8d1d5bbe72c55590dc4f4f337aa8557567c02e7e1e5b11ccf187913610ed7fe521bc9b37567ad8ba67eb383f91bdc18c7331462f27d84ec4cd30957a8","ssdeep":"","tlshash":"fe600030c0000000000f330c0033000000cc3c00fc000c030000000000cc0030000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.890209Z","last_seen":"2026-09-23T09:45:19.235695Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"60ef1cd7c34882496aa63bb598de33ba","sha1":"80c9394c6b642d48d88829c2177d66b8d9407947","sha256":"0595eab2134b02ca7f3d3f10bb15f78d75a49cbae68ad3f506119d8607041ec2","sha512":"3573710c2ac1ded5b6202a8aafa537046093b817d68cb6d52d86f8b6f421f5e8587863793b09a0b25e1d522c38be27f5009d1dc2f60f87ba498df81913adc779","ssdeep":"","tlshash":"ac600000c0000c30003f00c0003c0000000c3c033f003c030000000000cc00c0300030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.967113Z","last_seen":"2026-09-23T09:45:19.236679Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"009e4cd42abea3b8b71102e10510fd91","sha1":"5bec9c084a23fe60159f925ee6a20c94360b09a0","sha256":"6c46caaa314f14a95040a7486941ff013ed9b8e6069a6e5f2972ab3df484d66f","sha512":"99779c09e971d97c01facc8284592181e606076d7c2481656cc84bc66218b660db1b00ec975a5466f83b1bd738e7f8b2749781785e89210dd9e07fab9e74d403","ssdeep":"","tlshash":"2a600000c0000000000f300cc03c0000030c3f003c000c030000000000cc0000000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.923258Z","last_seen":"2026-09-23T09:45:19.237395Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"6cc2fe9b49a1d837a696b9d5740c11ff","sha1":"eff16df4cac033b915354846165be9b35698108d","sha256":"75db8951cc88d22d0873e3f7b4d821d3cd33ae2d14c2b6f20ec1ae50186e5427","sha512":"2352203990f1788f3a3648cba9b1e5426b70abf9f5507bc0be9715546acb677cb2f5e4b6f5f6f512bcde28f74a5308c5c48db8953cd0a64f66f0d0a891cc3861","ssdeep":"","tlshash":"9a600000c0000c30000300c000300000c00c30033c003c030000000000cc0000300030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.931472Z","last_seen":"2026-09-23T09:45:19.238287Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"fb28c85b64ea1ae6c0b4b7cc05b20987","sha1":"b7048f45526dea2283e0e47d9f5d382d68ef4bfc","sha256":"c0d1f9f87c5179d0b21a971a867f7c638a0b6ec2959495286ab29cac4e9ac952","sha512":"5ea3b1e618e1e7c98acf355560b7b9d41175d9db8699fc9dd50db1439947353140ae4c5587cef434426f56156af90f5984b4bf8ab5182931fd33e0c1b9d141b8","ssdeep":"","tlshash":"9d600000c30000000003000c003c0000c00c3c003cc00c0f0000000000cc3000000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.957457Z","last_seen":"2026-09-23T09:45:19.238985Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"dc432f6eab4854ac5edaadc9b51a1a36","sha1":"23ef2df1dc1bee6575737098dd3bc6ece74e3ebe","sha256":"a9a9ff6fad935a97f850a0025d0c0c5a7987842d258eeca2691b58df35d62fd0","sha512":"afc8997abf37b7ece5f88bc9e4803566374a499d2f2ad83ec12121cad556abdf9fa963c1de8f7ef16c60bd474606f154d654020ae6400ef85f133650850cb007","ssdeep":"","tlshash":"77600000c0000000c00303000033000300cc3000fc000c030000000000cc0030000c33","size":13,"data":"","first_seen":"2026-05-02T16:01:20.921507Z","last_seen":"2026-09-23T09:45:19.239666Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"5f16e3fc8e2c5ba6e5ef4965c414c2a6","sha1":"2b421463c992717a02bffba180508fd0e0476e1c","sha256":"78dd8e5113fdf534520040b9005d0e165c8e9dd3a2de48de889d99cc4bdfdefe","sha512":"392e3a247c191164877ee35dbd84a5edc87fd5f783a85651f1f1497d40654ccf71e059372757165dcec076115605258c9d3e754ceaedfe20c03d65312d6d5c68","ssdeep":"","tlshash":"73600000c030000000030c00c03c0000000c3c003c000c030000000000cc0000000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.919968Z","last_seen":"2026-09-23T09:45:19.240988Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"e1b1da8699f17f1911ed5171afc3e321","sha1":"c26e556a74a1652d047da95ef61ce47c1da7d5b9","sha256":"5d91613ed9f8c1d3596617d1814ae905c3fb96d9d50781f7ae1386d86a7ee490","sha512":"1f3d10230b0afaf16827f819bebfab537ad4ba4686bc8750ac20ef2288b039f4b00f0f67bff6954d620264bab838070d7d484524b0cb685c35d167bb2bb07190","ssdeep":"","tlshash":"3b600000c300000000030000303c0000000c3cc03c000c033300000000cc0000030030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.962366Z","last_seen":"2026-09-23T09:45:19.242554Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"875adfb2e220dd959b020815dca25daf","sha1":"e442834ed2cb86c0ca7b65d63384072177c9b25e","sha256":"0e18e55e7961dc5c9c58d11adc7c0b548bb34fdd9a1c5e73946e352a1fb8f212","sha512":"25f0402ccf29c8f130d8d7846e91db7f983a90f684244538ec318c6122d5eb017e28e7c4175969332a2c0fdf09cbdd594cc97ba5da1c13e55699df9d8f6058a9","ssdeep":"","tlshash":"9e600000c0000cc000030c0000330000c0cc30003c300c330000000000fc00c000c030","size":13,"data":"","first_seen":"2026-09-23T09:31:06.106381Z","last_seen":"2026-09-23T09:45:19.243672Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"6c352f17dd9a469323511cacfce58651","sha1":"3deb0ec056135ce4df9ef24784dea4908ea0be82","sha256":"45fde14cd09da573b6422bb4fefa34755bd88a7ca6769de9f2ab341a787178fd","sha512":"cd4173d72305171943987a9d766ab576a741c637991be3fe7ba7d3d9ad4bc63a515b924047af65d996b65452ff712c6d15a9ee3b3f20807f6e8a3bb86b34ff92","ssdeep":"","tlshash":"8f600000c00000c000030000003c000000cc3c003c300c030000000000cc0000000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.894869Z","last_seen":"2026-09-23T09:45:19.24494Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"5046e2ed7996e20f2a625d0b99684779","sha1":"1c030d2f7c19f6a579354094fc69ed21f46b1d20","sha256":"38a9810551b4f1021bb2dd69c1c018daf9b460e3aacdbf25d7dd48da08581cdd","sha512":"0eb9beff1f47014205bc66d4d0277b5a6a184e01955dcec9cd6421f28fdead5a1eb069ef036624ec8491f6db2bba42c2b5e9e21457998ee6ebe77ab173e47b1d","ssdeep":"","tlshash":"ec600000c0000c000003000300330000000c3c003c000cf30000c000c3cc00c000c030","size":13,"data":"","first_seen":"2026-09-23T09:31:06.192287Z","last_seen":"2026-09-23T09:45:19.245579Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"4fe2fce84f015761e862f829147445d2","sha1":"7506960d526222c14b308fc926d09f0180990f1b","sha256":"f98f4aca2ab9add535433f88b5403766eee24ec3e8230ec38ae0264b7f6548bb","sha512":"8c8d01ab545d223d38c36da55397653f39d3350882a2b6c73dc8e1894406f547aa75aca9da4632a847363200daac4e9cd41aa8ff0fd68a5ef8d82584442b4a3b","ssdeep":"","tlshash":"de600000c0030c30000300c000f00000c00c30033f003c0300000c00c0cc000030003c","size":13,"data":"","first_seen":"2026-09-23T09:31:06.200042Z","last_seen":"2026-09-23T09:45:19.246769Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"719624f13fa2acb9c638a9e3dc2454e1","sha1":"02a75f7fb3e999d484aa7634496be3bbdb241e3b","sha256":"694e7d7798406e6974a3907c2fd9b1e5862f5397801a66d0cabe26017ce6e35e","sha512":"6e948c718f750a49302a7c8847120c02146d6bdce2d83752226cd05f09202e97e30fec5dea9dd14a7ea85db9adcbc98be1a11fc6285fd131949dd53bd24c88d2","ssdeep":"","tlshash":"f7600030c000000000c3003000000000c00c33003c000cc30000000000cc3000000030","size":12,"data":"","first_seen":"2026-05-02T16:01:20.918604Z","last_seen":"2026-09-23T09:45:19.247958Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"2b51ba0110863f6edb045c902e093be5","sha1":"2d96064b349bf14db97384306d5c370ee96e4294","sha256":"d05a649fe64465f398f4f546e91ea000eaa2c21ace7a7f6f3e21b205d72f523d","sha512":"5a4986a73768c87aa3380f36a580d80de2c5acec0adb38c09035684e6b4926e6f0cf25a52b193be4b7f07ed2413047b616b8f27027383702044aa19e591d2f20","ssdeep":"","tlshash":"ea600000c00003000003000000300003c00c30003c030c030000000000cc0000000c33","size":13,"data":"","first_seen":"2026-05-02T16:01:20.889085Z","last_seen":"2026-09-23T09:45:19.249376Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"96c6abbf6503394f00a4da6e2e5695c8","sha1":"93a9fc2e6885b4a455749d76b8bad7c3d00242d2","sha256":"acef09c5bae1eabf0f1a9f43d2f42d864198a60eb04c2cbec402ba37fe9aae41","sha512":"1b6b1b8d122f8dece98b4992f1607a49307d98b37a62261e0eb764e5e1bc3337dc408d0c380d615dcdfddfc28c09b93d60651e67bd7bd9a1ac3f2906e09ffa9b","ssdeep":"","tlshash":"57600000c0000c3c000300c0003f0000000c33033c003c330000000000cc00c030c03c","size":13,"data":"","first_seen":"2026-09-23T09:31:06.153293Z","last_seen":"2026-09-23T09:45:19.250227Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"683fed692f340fab7e791a5c08ab741f","sha1":"027846061d76d309d6fc1b96ddf678a7df9d7e7f","sha256":"1f414cdf3668f9ced9d5cd7056c62e1c3c20fbf30c8e36cbd6511c8ff7d325c7","sha512":"44b5537989221a3dae7b488ab5bfaefeb29cbd534075be941515eea9f541c5f4fa1ac88263f73e176d31d870bc342500b991ecde9017bf6d6467a3d5c6004e2b","ssdeep":"","tlshash":"96600030c00000000003003000000000000c33033c000c030000000300cc3c00000030","size":12,"data":"","first_seen":"2026-05-02T16:01:20.942582Z","last_seen":"2026-09-23T09:45:19.25151Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"6b0ab35345334192f81f164bfbfbb36d","sha1":"02cd0ec7b9909a59773740c9627ab57b4c020c42","sha256":"9056a0fe72dd39a76511873f552189f9194051dadeaa3414a7acd7a2c7147646","sha512":"625ecc7c7c966e0d7570ce4af00ee5f47457216dd161cebbecc7ec81974df09f9cee3a342876b6a41a69da0f3c27d7d89bcbab0cc2301e36a71b119fee56a185","ssdeep":"","tlshash":"6c600000c3000000c0030f0c03330000c0cc3000fcc00c0f0000000000cc3030000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.955435Z","last_seen":"2026-09-23T09:45:19.252425Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"592643671c45a6e3d617485e624d6446","sha1":"944077d662f4e03e5bf9a4f29aa169b696c10750","sha256":"299a169aa9d40fb10ff9886a6d9747a5792dc99e6f1b937984edae55b2a36d59","sha512":"b42ac4c38a10aac7e898aeaa39abf5772ae3c70199850463be84bfbb8a35fa965fe2035a71700c6a36e4f4aef70ae6251792d91cc72271abcfd87c13c5588303","ssdeep":"","tlshash":"b2600000c0300c000003000000333000000c30003c000c33c000000000cc03c000c030","size":13,"data":"","first_seen":"2026-09-23T09:31:06.215354Z","last_seen":"2026-09-23T09:45:19.253131Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"a251d172897a39c82a849d506cfa448b","sha1":"abac18075ad5c0a0af4f9fab54ec5fe365932b65","sha256":"b70e78998bcdec45ca2e94a4052caf2db63891f1625316f33fdd6149291f66cf","sha512":"26bdc2ecd4a7f02c711fede3cfc63abe88f1b438e188e66543ee4cdf99f9f11834014d3de4471a4ec693d8f62a04a8559a13dd67345764601d6d9fe91580bdc7","ssdeep":"","tlshash":"45600003c00000000003000300300000c00c30c03c000c0f03c0000000cc0000000c30","size":13,"data":"","first_seen":"2026-05-02T16:01:20.912396Z","last_seen":"2026-09-23T09:45:19.253986Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"791b787f8ff4357f0995c24a0c7c60fd","sha1":"8c8f9235dc60ca0d66e560eb479a0bcda53d6473","sha256":"2e682337b533f237ea22de3e0a54a90edb809ef0de3628d3726e253ce23d8d8a","sha512":"022a4757a02a4acebf74e7b8c18041efc8179c1f438456e15505305bd70d1f8041011e32df93afa85a57982ed5b0c799ed9eb202b8072b6cd690448f5171537a","ssdeep":"","tlshash":"bb600000c000000000030000003c0000000c3cc03c000cc300c0c00000cc0000003030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.947021Z","last_seen":"2026-09-23T09:45:19.254659Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"d12df0fa0c7f22ff73b8466dd44e93be","sha1":"fcb73d5d0bc241a6bb335e15377fc0f230221180","sha256":"e0f937a3b7a377b01a1ad1b4243e8b6a7a3e0b111aab1fa3db64b55e04a3fb29","sha512":"95c2259c8df8411f00293bfc440726e514c7e2dcf0afcc3ef67cf4e93d71400df6399c772dbe908d0cc2c63a524fbce68afe070ae629f81183b4909fd2a37417","ssdeep":"","tlshash":"49600000c0030000000f300c00330000c00f3c003f000c0300000c00c0cc000000003c","size":13,"data":"","first_seen":"2026-09-23T09:45:19.255403Z","last_seen":"2026-09-23T09:45:19.255403Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"a6374bc25845d8197eda8e2e95fa3a28","sha1":"32ab1fff81772e7a12d1fc4a4ee361d4dc82d962","sha256":"b8882d2077d4a4f6b6349fc997cc0722b9c3a01c3727fbfdc0fa992136a473a8","sha512":"9317ce69da426de37e850ac13118a7c2857f1ce3f2dee47adb8723c15c59862482889e36d3d1c5701d8a6d2a38323f2205770a38982593cb14031b1a041e3eec","ssdeep":"","tlshash":"45600003c00300000003000000300003c0cc30003f000c0300000c00c0cc0000000c3f","size":13,"data":"","first_seen":"2026-09-23T09:45:19.257029Z","last_seen":"2026-09-23T09:45:19.257029Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"3c02518073eb3217a02f5ed70bedf8d2","sha1":"5ccd103f3dfdab03a81fe2660128ec5d9b1c41d1","sha256":"7149ee2d276b1a742fb9b82540c9e78561f5e0d7f0f31c1289761e620e94f5dc","sha512":"5aa4ad7d6bcf8dbeb22bcfa28a3f58ae5fc62a44df71d2c6c71769a832fbe32b517228c7bdf8d8c01dccf746aebcb8961c6d8b7b5fe0db1cc2aefd45db5b4632","ssdeep":"","tlshash":"9c600000c03300003003000000300000c00c30003f000c0300000c00c0cc0c0000003c","size":13,"data":"","first_seen":"2026-09-23T09:45:19.258939Z","last_seen":"2026-09-23T09:45:19.258939Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"domTimer","is_inline":false,"md5":"12602b3cd8ce76738a530f94c6c68739","sha1":"d2a88f21958135e77eb8aa07e87551c81cc03ecf","sha256":"2b03f4de21de69d65cbb7dd560f1cba26945f8ad325e3c941ea2edb471f5b132","sha512":"cc9f5e4a3aa6cb78a7e2fff759cc183c217a2639a0c28a34e6e8e09bde265d0dc1e64af5ad584e955c366705fafee28b72d4993b0670d0d22ad86c1dfd7c0a01","ssdeep":"","tlshash":"1d600000c000000000030003003c0000000c3cc03c000cc30300000000cc0000000030","size":13,"data":"","first_seen":"2026-05-02T16:01:20.899466Z","last_seen":"2026-09-23T09:45:19.260229Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19633.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.401Z","timestamp":1790156671401,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19633.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6cd85a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d33-aae\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:39 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Sx6tQd9v27AuCoFYwdpjeM5Q%2FKpSyKjbV3sTdAnoekQpFN%2FvJGDBUaHwo70Fobn6Pq3YhEbp4p0Zhq3wrgrSYwNoEwjl66wwds3P4H1ahATp3WSWJdRKPHg86OqVIEWCJtqKeTfmUA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4527\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":4527,"size_decoded":5256,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21115.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.451Z","timestamp":1790156671451,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21115.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cbd135a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d40-61c\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:52 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ydTWxQQT%2FqhnESRMXeo68M5O%2BSwgDJQsDdcongf5wuccjjsUj4GW8kWearveLBuBBaTeBVVhgV%2BMbUgvKmCu9JwAvAS4vtxoOPTHhDR%2FoZIZX%2FvxiOEXP5H09T8YvNg3Jl6of7tfQQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2510\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2510,"size_decoded":3245,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xr_text.css?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.142Z","timestamp":1790156671142,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xr_text.css?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tst3Mg0iQ00Ps8KUC6KQRNfDwL16SFWSJIsgtiLQ3iXuncJnPoEBQxbnNI8zq%2BjCNDcakofxJHNrbrDwypzyafquSAhWkSpB%2BmLkhB4IYEib0u2AI0tkdtTWfVwVgDDEqiIWI2zWqA%3D%3D\"}]}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: text/css\r\npriority: u=0,i=?0\r\ncf-ray: a3f89c7acc6c5a0f-OSL\r\ncf-cache-status: HIT\r\nage: 857\r\ncache-control: max-age=14400\r\ncontent-encoding: br\r\netag: W/\"6a757d47-2363\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:59 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":9059,"size_decoded":1270,"mime_type":"text/css","magic":"ASCII text, with very long lines (320), with CRLF line terminators","md5":"04f1f13b55bec7e40ab657c76dc2dae9","sha1":"b0a4b144ae4926cffd1b4735dd7e149851b35452","sha256":"c3649b6d95a817572e4cf34049122d70cb97ff55912a4e0d96e4f122f28cf018","sha512":"f59173900fb9ee7a0c4947a687177e02210206ec73ac76abb6f63cdae3112be75f199d3c4b35c23d8a62cfd07a8b8264daca70c4b063e090b4e85b2c0867a1c5","ssdeep":"96:54uMetIXCSZYjKyt2N4fznkrIapJaqrO6:54uMeWXCSZYjKyt2N4fznkrIapJaqrO6","tlshash":"ac126c44905bb49b7053cc6a3ea927693b1a05878df7bd75a1264c0dc3cf17a2326b39","first_seen":"2026-09-23T09:31:06.039864Z","last_seen":"2026-09-23T09:45:19.15035Z","times_seen":2,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19898.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.414Z","timestamp":1790156671414,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19898.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7ce65a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d35-9a1\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:41 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VQ%2F6ea1u5Z5MN02uAi1BcMWxGWrUY4GRjwS5LwBMBr%2Fzf2s6t6e%2FNjo9vG0WhbxYOpFuX1XVqk50gAWZl2WMOnbazAyvLTGfz%2BEuIKiVe1x7zgy8Dga7zLZCN4SO1k4GZXORWPOz8Q%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4174\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4174,"size_decoded":4907,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19916.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.423Z","timestamp":1790156671423,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19916.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c8cf05a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d36-86d\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:42 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XGaUTBafLd29QjmBMGHyRBqcpLZKYLPBV8lk%2Fa%2FvNPDIC7RrIUMPeF3RrmSHIaeqADXUYlOjbdPrW0weo1JUo1bhZyqo2I1vpRHBRL2CuWO9nF2KPEgcKuUdXpUq4Lzd4myvvTBS%2BQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3537\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3537,"size_decoded":4268,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":68,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19946.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.433Z","timestamp":1790156671433,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19946.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9cfd5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d37-113b\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:43 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z9Vc7xbzW7rv3lt9NWL0a1nyHJ3OqyUoCq0dMlVU%2BAn7ufPQ9xWRPv7InAoHxyKxJH4hKJbfXFtmPRspvmf1WXESmb%2FvU4VWnrS3mh35X%2FDHEebhoNO7Fy%2Ff3936dzPGyEIBRkhehw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7778\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7778,"size_decoded":8512,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/20207.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.450Z","timestamp":1790156671450,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/20207.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cad115a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d39-2b8b\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:45 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j6jndCsc7Xk5p%2FOsZp%2FbwyXVN6fM7e8Pu2yHvdZT3LUcA%2B0ehClV71nsEiy%2F1XbVGXA%2Bwy7951KMEZtieF23A6qNPeN96zvULtQFKq4gZ7bFBOgKzmdV9N8C7%2FSMpXehfibiL6j2Aw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19982,"size_decoded":20721,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":187,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":132,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21184@2x.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.614Z","timestamp":1790156671614,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21184@2x.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=4,i\r\ncf-ray: a3f89c7dbd5d5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-604\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pAMg%2Fs1uD2bXMP78CZvQCoywHV%2FgKSVPa7wjHk4N1j%2BRVX8KUYPy5YZgA41Yp7LzoaBpGS%2BtEhpSlrDmnRngqqD80DDQHCKfByvHu8d%2FKcQ5FwxdfSEgdKED9iTMB8CIueqhnkCIjA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2464\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2464,"size_decoded":3199,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":94,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19885.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.409Z","timestamp":1790156671409,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19885.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6ce15a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d35-17e6\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:41 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BlzzEybnZowA1ZW2viFd7mcVCSIznWN4XZYZATtI3lktgA5xGhsckmvAqTxK9AB5QxRlOaokq1PeyxNBodqUOKcV3znvpWwzDlyolkkaaMEfQ4MtcDrybVVjjb2P%2FV7e0k9zfkbaDg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10590\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":10590,"size_decoded":11321,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":90,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19979.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.458Z","timestamp":1790156671458,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19979.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cbd1a5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d39-8a3\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:45 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jih4AT9cMDvxiT38fARzttISV1zvFjTCXZRUmj6lR5PHxi2U%2BgTwrHkA%2BKPc0%2F6oRnMMdGdkw9LBJJ0O%2FYcglQ5QYlWiUusOkVxpnY9Z0gEEVJaHq37%2BoOfgq4U0VSa20M5GLEZdGQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3643\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3643,"size_decoded":4378,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21196.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.466Z","timestamp":1790156671466,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21196.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd215a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-afa\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z5yjydT%2BUOWuUm5vPjTI%2B%2FWBlPaTycN%2BRZ92mykJL9OHe70vp77QTB8RhuIg4t1uD8Wejj1cewfeViK7xpP%2Fy8K4uUKwxUEyKp9uxSvWdzCv1E2M%2FPANI%2BMilgkDuJujKYJ5QzwZhA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4762\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":4762,"size_decoded":5501,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21187@2x.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.615Z","timestamp":1790156671615,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21187@2x.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=4,i\r\ncf-ray: a3f89c7dbd5e5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-570\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nYbA5RtBeaDI1fybctibi52jLWa21McCMfzNivHyBj1oMYSlRJOzjJp4FMUEJ0Lu9aVtw%2BBzS82QB1tUPW1Wd0PqWXBpMOivB6a75O0QyBFg1k9erSqZypbdFrW3wWqOvmTJu3jukQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2215\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2215,"size_decoded":2942,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19371.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.373Z","timestamp":1790156671373,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19371.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c3cc55a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d33-6653\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:39 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T8wQPTqlBT2jlpAuk2Pq6p2mj9yo6f4wsTXgUlfyi08ww0BNCfmrX%2FohGEYbFsA0deqeTlbMi46BW2C1x0hMS1g9ra3ww3p%2BC%2FalwPvwLDMJ4UY6KD6zrluKDP8we52tOjo7HCA9tg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 47189\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47189,"size_decoded":47922,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":288,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":232,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19897.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.413Z","timestamp":1790156671413,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19897.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7ce55a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d35-752\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:41 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jJOkHlkNlKIfwPPK6BWSDDfOAKGkuHgdBYT0D6x1QkJM%2BseJIaKLmtyFyF5V2E49CAcOQslDY5l8dzjfUE1v9hczroYpt8K5DmL69uGCqwVIy4T9t1s5YnD%2BbnU8CLPSrpPMmJBoRA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3003\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3003,"size_decoded":3732,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19939.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.427Z","timestamp":1790156671427,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19939.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c8cf65a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d36-3b009\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:42 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d%2BCqy%2FHP%2FSy%2B9OrCMw9YszZozcsgunGtd4Df3yUUlbWqdA%2BrZgmvy%2FSyrpyPGocGvgpisbezF7ZKNZuREmsCgmR504KdFPXdXrXnhpu67qJ3TBz%2FAZVzrDwy61RglS6X3p7BetsBug%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 437558\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":437558,"size_decoded":438301,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":1110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":1050,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19943.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.431Z","timestamp":1790156671431,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19943.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9cfb5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"377-6586f3de4f43a\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:43 GMT\r\nserver: cloudflare\r\nx-accel-version: 0.01\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1iBPGKLAt73TdMEin27yg%2BifCHnvb3dx02I1IhZG0daNRCbEssgHJr2NGjTjdqvtRBbeImoLPSvHd3ELs%2BFKe4Y2J8JKRIzSyZxn6wqozX7gvhRFjAPtAGiC4VKP3Bl7B7igJJ7KjQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1262\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":1262,"size_decoded":2019,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19966.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.445Z","timestamp":1790156671445,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19966.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cad0c5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d38-2603\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:44 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xeKy%2Fqd66GoEvTYLmC8r9bRn%2Bt5fK1Nse4ctzvqVZGDPz0yI%2FxW3BNR0S4wGyY%2FHC%2B%2BJBwx0TwJLxWgoRKmn0LqlXdEfG5GW%2Bf%2FagG9ZXmlk1pCXVmd1Hg2kMdXZCixnBbSMXeNnMw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17081\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17081,"size_decoded":17824,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19013.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.411Z","timestamp":1790156671411,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19013.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7ce35a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d32-93af\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:38 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Hp44z3Cqde8hEAhhLTq46gGSMx02bXxGWDIZuJ1XdpRAojPcT7bDVJVny2R4k8NvdJIUhDCvWTlNs854XBou1eOjtNxgnXwTHJD2eITX11P6FjwLDJIz%2BldPx%2BwlmEPxrpDNBtN5VQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 68215\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68215,"size_decoded":68946,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":403,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21118.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.454Z","timestamp":1790156671454,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21118.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cbd165a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d41-58a\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:53 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u%2BUDSqFObtAfpg3OWp9tBtyGfS3NAzVdYmn7TPLfvQSgZrpJUzDOgPoeaklxEQpJu%2Ft%2BBnmOyPmUqdnDueASasYB753dpNbJkXPffSfHeikzzqpAFktlSp%2FTbeAiPTAxePXYNdLj9w%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2259\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2259,"size_decoded":2992,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21201.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.469Z","timestamp":1790156671469,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21201.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd245a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d43-888\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:55 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BKtkeD%2B7WVikNe92Nmsfe2wEn7DTgrD4f48PcH2nC5EMLUpfu4xkiXc%2FVMWLsspajOFdE2Qg6tfdar1JKz7G8WkyrUJ1xihu3Qh5004Sm7ZADIyXmcQlz0ek3fpgt6X%2FnmhGtCUYcg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3696\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3696,"size_decoded":4429,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21202.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.472Z","timestamp":1790156671472,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21202.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cdd285a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d43-8b3\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:55 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mcQxrCMYu0h0jx2JOF8BMhO58TSGAR7IERjKFQJqRTPqVGAuWnSzDBx6dBJtVmReDPYwKPjH08VFhBDBImVbHmmao7iGLkJEorvW67VXflAS40CkZ86ZP3KPtl4MoN0%2F5Q8uIcA1lw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3712\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3712,"size_decoded":4439,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":49,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/replaceMobileFonts.js","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.147Z","timestamp":1790156671147,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/replaceMobileFonts.js HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3f89c7acc705a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\ncontent-encoding: gzip\r\netag: \"209-6586f3ebbc4db-gzip\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:57 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-accel-version: 0.01\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5nRgDWw3L9%2BpZBCqLbQtFBde%2BoFSs8h%2FqsRntlZr4i9zKORyrocsTBsSFeiGxJN37q3rti6MQHT6cDueZ9bpTN1bIPI3Z3cPB8BAoBp3eCUbd4OWRlN65mndWqaaFeQ7y6BVfJ6SmQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 294\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":521,"size_decoded":1112,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (521), with no line terminators","md5":"9aee92f9287fc5569d0905bf7e206649","sha1":"b249bb4a3cef79f1bcdc10c356674128af69a770","sha256":"36ed540680040ba2ec42cbc8af14bd652aafb326de2b63172e7b8f26ca8df477","sha512":"02be8adcda1fdb9b677d491789971050c83da81f37b0c9bc85f15de093b341777474f7ba1a3e9c2b26a8df6abc57d8ae19a8bcd0737e4d39d2834e3be834463f","ssdeep":"","tlshash":"7ef0e242330c202b69b6562235db400530a5836f55f5f092beeee95911f0c2a17a2ebf","first_seen":"2023-03-07T12:09:47Z","last_seen":"2026-09-23T09:45:19.151384Z","times_seen":163,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/ani.css","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.153Z","timestamp":1790156671153,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/ani.css HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QZV2JwC1LrC9J5sroLU4s3iiqRWyj%2FHLlBcv0XMPovMQumF4Cm4nlvcHF7RlmHUCCKySbAGMqhrz%2BD2HSIEHGN8mNEeu3qaWCGzdo0qe%2Frf0y%2BNeEKZHM62e4cNiwse9lQ2N1rHulQ%3D%3D\"}]}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: text/css\r\npriority: u=0,i=?0\r\ncf-ray: a3f89c7adc735a0f-OSL\r\ncf-cache-status: HIT\r\nage: 857\r\ncache-control: max-age=14400\r\ncontent-encoding: br\r\netag: W/\"6a757d44-e1d5\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:56 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":57813,"size_decoded":6647,"mime_type":"text/css","magic":"ASCII text","md5":"df65c117b0c75198f3c574352aa39522","sha1":"041b223676b278c30e094c3900020f7314434f84","sha256":"675977aa75ce163b1fbb0ebdb1422f692693bcca500310e7be658586ad4a7917","sha512":"f9d5ad90226ee11c19a3107c62257704efcf4b9647aeee543e64cc23eddc2209b1d38c3eeba4e5da9f774ab7ea9bc21acb31970e36f5aa0d2695822fcd50c50e","ssdeep":"384:xFxEf1sOzaOYiQ8Wyxl7d1vokZQZRZAZXYG4xZIZjZlZ2BN3DteQQvznIvdADc6V:I1siQ8Rxlvvo1Wwi","tlshash":"a243ef1daae004444767822a96ef8e68113ce5e36c2a4cff73d1194f8f857ac27ce617","first_seen":"2025-09-24T02:56:32.34059Z","last_seen":"2026-09-23T09:45:19.153898Z","times_seen":28,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19287.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.381Z","timestamp":1790156671381,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19287.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c4ccd5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d32-2f05\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:38 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jTj3kINcvAfzdoOuwIeFRwAFDNpHHbWoVTSN7F4tpAo0F1gb98IoJo0W61Ys6v6K1yQFai7lEdLdkQSVeagHBFRUUdXYRRbN3k2ffBcir6S7iQS%2FJC2m5W1Lx4%2FX37wSXFJGNnbU5Q%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21491\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":21491,"size_decoded":22222,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":151,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19942.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.430Z","timestamp":1790156671430,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19942.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9cfa5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d37-427\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:43 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w3Njv11C6vUapjyi7EN6eryWIJaUR%2F3uOtKVRrI0IHrc5jggMfzr5ZCuT8O7DE1cqKgQXd7iXm56easj6R4%2FD24b75MMfb40lXK0%2FW1FEFwnkNo8wZczFEMTXdfDQk%2BEk6b26XS%2BRA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1599\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":1599,"size_decoded":2334,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19980.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.459Z","timestamp":1790156671459,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19980.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cbd1b5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d39-93b\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:45 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=igBz3%2BR4DWnpst%2BtT76SnTG3RSh3i4exsyiO3UESkpZpXR%2F79loLqa8eje6u9%2B5N7I%2FlbeJAS%2F7N8dP0TgdVzROf2F6%2BU8j%2BgnQIsvHR4SjZXAdD5JnZ2SUwKS9%2FfZQLZCOUnjAGsw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4002\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4002,"size_decoded":4745,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/20953.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.460Z","timestamp":1790156671460,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/20953.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd1c5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3c-50da\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:48 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7dNSRor9jRHAMLeFbpQAtEPrLw2Th901fwN0LX0Z0XkGOQFLIIXeB0P69M2kSxspD04N1Twi7i7Ua8EwrheecZzNOtc6xGUPu7iN6WWwoFpgUHV71ZweSkGsgWLvSpIGSsmv%2BzPywQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 36983\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":36983,"size_decoded":37712,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":416,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":313,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21103.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.442Z","timestamp":1790156671442,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21103.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cad095a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d40-faf\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:52 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AtvuWVRzf8q6K5MWN1tpXVnOOSU48GsVLr7k%2B7hIlahdf5w6LBKXuA7GoSpDW5avHAqnSDz1DjuhWqzo0W%2BTKU3TVGtNW7VQB4Yn825gzv7OWUK%2B0%2FLHV3h96TBjUukK9yzkRM%2Bdqg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6967\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6967,"size_decoded":7702,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":125,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21112.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.448Z","timestamp":1790156671448,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21112.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cad0f5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d40-f290\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:52 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yTfzT4Tu%2FiZvebzm8144%2F9VBUuVwtqRI4TfklYuY01nykiNUDoT5gVKdcYNUE5SDTeWASZfok%2FhpxRCW24qZ24PGRmQHmIiAqw7uH1K4X%2BmJaWpr5Rh3OYIw5dhNV0sQXqljhb5k4g%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 112181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":112181,"size_decoded":112917,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":608,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":242,"receive":366,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19938.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.475Z","timestamp":1790156671475,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19938.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cdd2a5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"232-6586f3dd4eea1\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:42 GMT\r\nserver: cloudflare\r\nx-accel-version: 0.01\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qdIwm9mCLGXMMmsy6%2FZHr2lD3W3qTNVZEZxB3iwognArlasEM8hqUmFgWu%2FJNLXcQVgl4J%2B3kRY2QI9f3pxFdeIDxc2grl5A22WFL5j%2BDQARB10Dsw6e2LZY90qIb08Lkrvju8sckQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 651\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":651,"size_decoded":1411,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21058.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.417Z","timestamp":1790156671417,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21058.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7ce95a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3e-e29\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:50 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XQbhZQCiECDDEz8J%2FcJwdyutsCaEGwnogAx5%2BFhl4l%2BOZIoxuGXgvcDxIA%2BGUoybnB%2B1YYbdN4EnEmvsBufpS3y6n0Yh7vrVp7WinjAN%2ByMy6UcdX8Mw8aYexVxdWyZDCVIF8wpaKQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6287\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6287,"size_decoded":7024,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19941.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.429Z","timestamp":1790156671429,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19941.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c8cf95a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d36-f52\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:42 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wi1I8pdCCUM%2FIm0bedUYBSwXsnXiEKLTLbksyRgPc8hvYn4sPCV4wPzx%2BoKZsW%2FZiH20qRJEaHHw2mGelzQ06k7RFjDYRcFSMIiK6DME9sOxMB4UTevKSWLqeAwT9iDqCw%2FsEE1jzA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6866\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6866,"size_decoded":7599,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/20049.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.461Z","timestamp":1790156671461,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/20049.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd1d5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d39-6cf\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:45 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FvYLSLGkanQ1pEYiiwiUxRjUaCV5hQz5WsE3acSLQqkfBSKUqy0%2FxtoibYiDl3gSdplnLaWhZpGkDxIpaSiSdESw%2FchCykdwr3CefbzQShwGaDzmXb24tjLKiUDFVVoc9nxkJczbOQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2784\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2784,"size_decoded":3513,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21197.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.468Z","timestamp":1790156671468,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21197.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd235a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-89f\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FKc%2FV0kwTuC2mNsyrKhKimXhFsbUNp8I72uYtBxiS6PhOCddTzlfH8QoTdZ203r3B15dM%2BE3%2Bcn5AIHyHpjO1pl9l7tN1jBCrUfnoXQ9uS3yyA4x%2FcnOWArBQBi5ApUxFCKG25X33A%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3704\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3704,"size_decoded":4439,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/20970.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.476Z","timestamp":1790156671476,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/20970.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cdd2b5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3c-50ed\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:48 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ojNL4a5UPgz0WIOZGRLK1f1BANhano%2FnYw1pKWlnga8L754z7Z5N6DmJuidJXVagfr1yDO%2FQvdVtEQxM0SY06Tcekxd%2FCQFWjHaZe9jJPLmLjVRWm4X7eWSzuz2ST9XZKIolKeMiKA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 37248\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":37248,"size_decoded":37981,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":261,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":190,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xr_all.css?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.149Z","timestamp":1790156671149,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xr_all.css?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=82rPACumRRs6j9zpxspzoqgNRjT7I1CAH9q0k10%2Fgw3Lfq%2F2aRrPrwPTTFqlu%2FJVrL8ydxsWdff0oouSxayQKcZ9F1bqt58Z%2FKk%2B3zK9UB0MqJRsOlYv83RAX98CaLoA1bS%2BgjapyQ%3D%3D\"}]}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3f89c7acc725a0f-OSL\r\ncf-cache-status: HIT\r\nage: 857\r\ncache-control: max-age=14400\r\ncontent-encoding: br\r\netag: W/\"6a757d46-405\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:58 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1029,"size_decoded":915,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"72f9a2465a59c607eec0e1dc9114d99b","sha1":"6ec3036c9e3abb512a1cffd2306a82894aed1043","sha256":"d5c4c90bbf2606492ff69268db9bb22b79e9ae307089c791319fea669be092eb","sha512":"4d5056f91c02e1e08c1c62ae127f54a9c8b452fd5dc0f005527dad963b16625767faf6aedd787844c354d5444456e2a1cf9be53533c3a5cc99e491da2a126b6f","ssdeep":"","tlshash":"8d11ec970e512719993bed5e0aa6870f4e7f5340f70112e366f1742ddb0e78b0635851","first_seen":"2026-09-23T09:31:06.003152Z","last_seen":"2026-09-23T09:45:19.155581Z","times_seen":2,"resource_available":true,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21043.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.405Z","timestamp":1790156671405,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21043.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6cdd5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3d-b2f\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:49 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9kHRuA4KXJOFcSnUcC%2Fuo5gnBrwsH%2FYNAXfCICkc1GFlc8aDkvjwuws1v%2BilT9HeXAbt9zg2LHc09XglKdbZukJ8CfcOEXIzD7xIaHMpG4XhYaYLBNi%2Fsy2P1w4nvXSoxXhEUQD%2F2A%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4797\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4797,"size_decoded":5532,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21050.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.412Z","timestamp":1790156671412,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21050.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7ce45a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3e-422\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:50 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZHBL4Q%2BVcwuJJYUG4WgBmSfc0KWaC9Y1FqVukjTByM9spTAQHMFemERNOo51YyJThCosIkVvyOFEvawMBmwHMj7NtOxVflof4O0eClDkzMbHx7sebF6W0sF6dV5%2FnNjGYMlckM6oYg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1580\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":1580,"size_decoded":2309,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19961.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.441Z","timestamp":1790156671441,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19961.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cad075a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d38-3bd8\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:44 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9MZnbZJ6HYFJ%2BRh%2FnWOu4Oc7A6XKeEdrmUr0KhjV9TAuBNiwaAn9Z2gyrPnpUwODZSlxTg83CcCs%2BZ1IVfgUYbM0HxP7IJIAUFZTh%2Bsmm1UMuYFbQ8sqTplqKUyqQit6S2vx9a7sdg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 27573\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":27573,"size_decoded":28308,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":154,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19965.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.444Z","timestamp":1790156671444,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19965.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cad0b5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d38-2fe9\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:44 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5vgk8A4JGzdJ7VUNH0k07gYJpODgXKi9fyKDHTsRPmkRCPF70u5%2FdhsR7H0v89WsMYXRFIkJBYmgAyV9bRLWNmBr9RLgkDjTF4vL%2BD64PRvGTsTvcvGUImlgl6h8lFbyCcc0Y0mZNQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21937\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":21937,"size_decoded":22668,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":178,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21104.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.443Z","timestamp":1790156671443,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21104.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cad0a5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d40-1091\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:52 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lhczBE3gJLzC8qEamqyrm9tELNjhul5wjJ3EK8BckNKhuLKvYBwS1NCdNA9V8v7rgXPHXXZEN9iYAS4V6Bd9MLSq6N2lmWseg4HN05druATRLk0naKkTTv1Uxj3eep%2B0GFQVenvzcQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7293\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7293,"size_decoded":8021,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":89,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/prs4.js","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.148Z","timestamp":1790156671148,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/prs4.js HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7TUAvfuBRpFwFMGY4o%2FKfFmCXQ0ERoo56vt%2F4n7dnOIyIBBtbg%2Bk9DPku%2FFuFLu5WexYmDhCo6pD33s%2Bc2BmzEPZdkA5zy0gpolCImGTaIGvbrYp6Vc3UsU6j0mZhEosQS29zx8B%2FQ%3D%3D\"}]}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: text/javascript\r\npriority: u=2,i=?0\r\ncf-ray: a3f89c7acc715a0f-OSL\r\ncf-cache-status: HIT\r\nage: 857\r\ncache-control: max-age=14400\r\ncontent-encoding: br\r\netag: W/\"6a757d45-cd90\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:57 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52624,"size_decoded":12757,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (52624), with no line terminators","md5":"85e324abaedd39578ca6c3b7f4d50d77","sha1":"f0f5b668b40d575cf787b00ca3f4f8c5ad9f60dd","sha256":"2c11311993844e68146f28d73f4761bcbae7c80bb465956292eee630e534b8c2","sha512":"5bf40223604775f44d4ebbbd34446a583a01603b46b631a0658bc30e4f0dc8a3e4e15ae1541de798d2e6aacdfd88fdb0d0cc5a7b0efa1c6e855216ea571c7aff","ssdeep":"1536:2Hs27aLkLi9uRi7J+i/rj6nuQ88YA4c60geNQgh:Ws27aLkLil/X6jfxL","tlshash":"fb33c77b3004053641ff26af22ae9b8c3031d498ee02e845d97a9f729574f5651beebc","first_seen":"2025-10-23T13:05:54.852563Z","last_seen":"2026-09-23T09:45:19.157474Z","times_seen":14,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":76,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21031.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.383Z","timestamp":1790156671383,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21031.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c4ccf5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3d-a615\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:49 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1dsMvk0xscl5nzEu04Wx3WeueK4pwfq0xeBQYxepk%2BKFjjWSnVdIXGh4evdb0u5gf2tVYPQHtha0hqQnrxg4LvH8AwJDc1zcnrA7xoK%2BA7B2dCD9vbjcb%2BpRc3AWG0Wy31OIv%2F4AEQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 76956\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76956,"size_decoded":77691,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":494,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":435,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21046.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.408Z","timestamp":1790156671408,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21046.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6ce05a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3e-9b8\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:50 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tw1LAOCRHjZhH1U78mft%2BHZfuk%2FFPyOQrxVnXfPFTTRicEHW9hKNgn0kMqEb96zFZICaGPb8ADdLWGZxEYlJc6ot3NoZ0e2ZIYo56n4%2Fw7jbjtV2trmsOgrOHkweLEjQsZ%2BTlIqEhA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4149\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4149,"size_decoded":4882,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":145,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/20204.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.447Z","timestamp":1790156671447,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/20204.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cad0e5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d39-3ef6\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:45 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g1Q6PsQGZOIx54cKEGpPlm4HgFflZQzKSd%2F%2BEXnqxgLD%2BchCY0EMSYhwWjf0yOsRQgba6COtfEnoILQ%2F0tK4igRrE9VYZYnLHj09KwE0gmiI521b9eyubAd2X3FXJiH%2F%2FVhbv6%2FxwA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 28877\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28877,"size_decoded":29618,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":169,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xara_font_5.woff?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.601Z","timestamp":1790156671601,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xara_font_5.woff?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/index_htm_files/xr_fonts.css?21145\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3f89c7dad545a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d46-6f50\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:58 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q3zACZn7qIRzpmH9LhJSiUv1M7WNyWZywB18WKZVTebv02NZvfx%2BcWH6Xpt5Xzbf6Pus0FMy4IUOP%2FmiO3YuRXcd6IJbFrSc6gjHMQDCm%2B4dSjKTPW9rYa54qlNytmrpuf7pIhN%2Bng%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 28496\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28496,"size_decoded":29233,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 28496, version 1.1","md5":"8aeff5cb710650635ea7fcee6d1db261","sha1":"3775dd3d2575e7d85fcb15f6240884bd570f57c7","sha256":"06b5902b730a9753e5cceaa32ce9e181b5b8fcb8f4f8bdc96764449dfd808f4f","sha512":"270bc03fccc0c02e5e96cbd50665d61925cc980b6deb4e6ace5634e2c8e553ca37ddaee2e183901d9180e4b1ae97b85f0c5d652a4ba2e82574e179b3651337cf","ssdeep":"768:XpBZlkaHlY+K9NTmDGdQT5849c+13uMU1/P:XXZllHUNmiQpK+1+MUX","tlshash":"1fd2e106e785e768d702be35f39b9b451df5c0d941cb857b60c08676ac2270ba33b348","first_seen":"2025-11-08T10:27:58.725515Z","last_seen":"2026-09-23T09:45:19.158256Z","times_seen":3,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":200,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xr_fonts.css?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.139Z","timestamp":1790156671139,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xr_fonts.css?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FSK9GyV3pjsMf3MXHH7xSTbTiNLf2QoJ4wyzqfcmXLrjCb0Iz3YS5Vna3KRGxbM%2F7S2nKSU2GRa%2BcjEL7myrtU5bQwkLtGWlQLt8xD3j9WXiwVuClPs%2FW%2FrvYuoRjzGuLJEPbxKPHw%3D%3D\"}]}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: text/css\r\npriority: u=0,i=?0\r\ncf-ray: a3f89c7abc675a0f-OSL\r\ncf-cache-status: HIT\r\nage: 857\r\ncache-control: max-age=14400\r\ncontent-encoding: br\r\netag: W/\"6a757d46-4b9\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:58 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1209,"size_decoded":952,"mime_type":"text/css","magic":"CSV ASCII text","md5":"95a99c3d234d82c044127a1c59cefdc4","sha1":"d7cf13fcaad60f0a9bdb103313129f5bf5894e33","sha256":"9af2f9e3e3f680e3b76560d8859ab3cd350b26b69526e9fd4f9385e0591d68c6","sha512":"7054d0e2355b92b0d659ab0d5ede5d2cdd055cc309da82f97fbdd14ec9ff9de7368731750c51215c4dace01564471c276c5e421107a02765dc193107a1368421","ssdeep":"","tlshash":"0121c7587a2e602790922de776cb7b381d8ea02d11a44a3395388c657dd273f8393f7c","first_seen":"2026-09-23T09:31:06.030371Z","last_seen":"2026-09-23T09:45:19.159313Z","times_seen":2,"resource_available":true,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19913.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.421Z","timestamp":1790156671421,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19913.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c8cee5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"35c-6586f3dcd2a55\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:41 GMT\r\nserver: cloudflare\r\nx-accel-version: 0.01\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LBOyw1eqh36l03iZg%2B8mgtaRReczrhTCjSn8D0WgCY2q%2FigLAatXiLBa8CHkAljvDtZeguXrcg3wy1rUxeGlzPuO44Y86c0Wo94xQQpI6FXGUdWOVeHw7JVTqAwkkqOI1Hd2SzdlKQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1182\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1182,"size_decoded":1939,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":88,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19949.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.435Z","timestamp":1790156671435,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19949.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9d005a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d37-939\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:43 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tB0NVuUBxUr8d9c4Jwh%2B2JlLcUZKunmSnreYBSe%2Bc1JgtelySXa%2BoBOUq3caFpffaSkjLBoB24KHYX1OKyocqiCMEudmNigKbnqAMwR7i5FcAhIVzLcan%2BpYNa052drhwCUXRadE1Q%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3955\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3955,"size_decoded":4688,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xara_font_8.woff?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.604Z","timestamp":1790156671604,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xara_font_8.woff?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/index_htm_files/xr_fonts.css?21145\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3f89c7dad585a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d46-4414\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:58 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=krZxCJVp0VnEr1eRorwIZt3msF5xslqias8xQ1feOx5LydqLfuhAaYzldCWIzxu%2B%2BLynFxGgJQG4pdFi4oNjldCfvpMnz0K90uXAvq%2F6%2B7DfQdf6lzICvb7c7V0ig%2BgmfwAw6nVX5A%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17428\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17428,"size_decoded":18167,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 17428, version 1.1","md5":"93aa8e69deb1db2c77cd63252e4ae55f","sha1":"59ed4c36f5a8e1a59380ef619932f65a1f23fb6d","sha256":"79bd5a95e393cad4c5096c2fc72ab8f3b8f8b0550fc0d9d3fb254aab42b91eca","sha512":"0904993cb1ef548525822212d5370e477680e35bb5e3b8ee8f1323e14e4b19ea21ba364c8f4c73a877f49b1c2e0ed63225537e4726df431d32ecf62b292fc2fd","ssdeep":"384:5B3Eacr/BpiRYSbGbL2pYvJ3whtEigjqq3KHm3ZOnMM/FrvB:HrcF8WUGGpM3wh5gCmJObr5","tlshash":"f272cfcf21334ed8c8aab53cd3650fbf0de6ad41041261eef802f6998ca7f6c9286154","first_seen":"2026-09-23T09:31:05.997947Z","last_seen":"2026-09-23T09:45:19.160489Z","times_seen":2,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":189,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-23T09:44:30.500Z","timestamp":1790156670500,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sNgEg7VJTTdVMWuKJOYIZOmZ16eZmzxP4O5Umz17s5wYOMZhIex22KqYlS30oAwoohgRCbe%2FQjGqOgMiTb48M1k8R8%2FyZ3Em%2FqDzhHb%2B6MUlK2P%2BFFfLpX6ZhY2HO5lOlDy5FtgAsA%3D%3D\"}]}\r\nx-powered-by: PleskLin\r\ndate: Wed, 23 Sep 2026 09:44:30 GMT\r\ncontent-type: text/html\r\ncontent-encoding: zstd\r\ncf-ray: a3f89c775b015a0f-OSL\r\ncf-cache-status: DYNAMIC\r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 07 Aug 2026 06:37:59 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":121287,"size_decoded":16728,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1603), with CRLF, LF line terminators","md5":"b2db8fc9d41999c5f44f4ab85d18b667","sha1":"21c9a28f51bf35f35ac9d05695877e56df831233","sha256":"f066bfceb95f353ed99dc975a70f96edaa226c3f1b30415271c37bdb6e448c1e","sha512":"d564fc359fef14b53eb9a1a1afe88cacb9081b9ea14eeeef226e40798c2604ce458375331d94d23f84271af1f366440569d80a7a5ae93f7aae7db80201b572b9","ssdeep":"1536:bN+KJzq0YlsjYozb+Eak/EDaDkjB+GhwOAzyyY:bN+kjXUBJD","tlshash":"d2c3303280431f3e96bbd1d2e5550b5ab1b0ca47e3929c042afb7763e7deda424239c5","first_seen":"2026-09-23T09:31:06.032493Z","last_seen":"2026-09-23T09:45:19.161934Z","times_seen":2,"resource_available":true,"data":null}},"time_used":497,"timings":{"blocked":0,"dns":40,"connect":51,"send":0,"wait":372,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19877.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.403Z","timestamp":1790156671403,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19877.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6cda5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d34-af5\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:40 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=apH%2BDvOBZhHnj88%2B2r61T2QGQdBCiuCCozUySA6TKM7ByM2CXtttB1hnjs1RZ%2Bk8UOpfkt%2FFw81OrLIWMPqADQx2acDTbTFtok8FhYFb67S7Ni8zu69HwfNrtfAy2YBWcP7W2hd1BA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4693\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4693,"size_decoded":5426,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19878.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.404Z","timestamp":1790156671404,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19878.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6cdc5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d34-baf\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:40 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V%2Bh2j2eZ6zzX97Wxnz%2BQBN%2FuoYIqkudFDRSOBZKz9XSuRmRTv1BFTsCj7zapZWT%2FKNMrrhRE5xDFwySX464L1IyIwn%2BE76bksWMi30Xlflk33B2CncZbG8VJ%2BxKI8J6DOkvTVZxFgA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5033\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":5033,"size_decoded":5770,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xara_font_9.woff?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.602Z","timestamp":1790156671602,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xara_font_9.woff?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/index_htm_files/xr_fonts.css?21145\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3f89c7dad565a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d46-690c\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:58 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZXt73FAn4m%2F3SqYWRWA%2BkPdmtpK3Qz%2FheLxUTMEsGDeX7IU%2F44R3cEPUMZJpQZiDqpF2GTD0SRO9MGZpVkRRGTUWI%2B1F4zOVpO332oynTOoUiJfRUZow4Iywahf2i9k7H56OK7TnUw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 26892\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26892,"size_decoded":27631,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 26892, version 1.1","md5":"97a7b0d98076fad71d25ab56e464f4d9","sha1":"14b3c12aeb6d5d934a5f6f4e80e47edd7fa99ada","sha256":"2d968eb2eadbed83e64413adf19cb012e234e40ebf7ddd9f696f4546662206fb","sha512":"89a919efc416b44c79547df39209c0ec03bb662cfe2447d872c17c6839009407b62d11261a7e795d98c18032d403db92091f22bc416134b1aee6b17431db1ec6","ssdeep":"768:TBzFASACl9yAebtbcthyoDl6UDH7SuTOiLYN8T:VqShl9yl5sHv7JTOAd","tlshash":"d3c2e0c9dee93ad0c690a83a259787d2e6722cda01557245c7d8b0cf6ec59424bc21f6","first_seen":"2025-08-03T21:45:32.923023Z","last_seen":"2026-09-23T09:45:19.163029Z","times_seen":19,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19372.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.374Z","timestamp":1790156671374,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19372.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c3cc65a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d33-4a9a\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:39 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SicOjnAfYx5N3MaJbEkv0ub5WWRH%2BiV%2BkF0p53QrBr3ElBpzAesn%2FsIfGH8itslAbGcZw%2BtG8vmpmZZCxcYD%2Bh1hDW9HihOEx%2FxRl1Qc00TPRVC1IP%2FVWdh0igouUO496CivsqkGvg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 34393\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":34393,"size_decoded":35134,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21081.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.425Z","timestamp":1790156671425,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21081.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c8cf25a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3f-770\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:51 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vw6oHuQz5wH4MLATpXqsdk32wvqXg4P3hUe7EKILUEhaDk6TxrixiCO2QHTOnLgw1Dx0ltKRaYv2MF9Splz7TqkujBSZrX5QQ2boM2TxBNSbz45D3yREh4lN8eT6UK7hogxFBsVxmw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3088\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3088,"size_decoded":3813,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21082.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.426Z","timestamp":1790156671426,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21082.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c8cf55a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3f-77c\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:51 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GSxXzSn77ZY8181oSJs4P1MoV%2BmDw9outcwO7HXAPaMaM4KiekuvfYEXCyt%2FznS0gViro6tEPl9ahL2tvDgallAav7qheED6nczYS0rDWiA6BhckIQwmtRLfJEXTyaOhpWJdg803Kg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3138\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3138,"size_decoded":3867,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/20210.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.453Z","timestamp":1790156671453,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/20210.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cbd155a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3a-1f15\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:46 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hcOXwJEtWZC%2BEo1HD3FrbQshH%2BgbI99SX7DLzc9DHM3dqgi12dtuqBOxf280gsNxVVH4QC%2FY%2FJ8NiZYpqBrTtt%2F9RJe5kXDZlluqzkc6vBcxWksEyOrWe0Vr3lELoc%2FEljD4eoJFdg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13943\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":13943,"size_decoded":14682,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":118,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21198.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.470Z","timestamp":1790156671470,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21198.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd265a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d43-8b7\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:55 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=creXx7LqnEZrJapy5p7itfL0eWGMpTZTnSzXsSXkG%2FSwGrlFc%2F1GWhwAgDWEsDHuEKdC%2B2TMxScFNuHfjLTl5fBMKoQ9ZmJsp4FAqHHSUj6%2FjdXRRxHo6SHYAk9fWRt1tuVtsAyOJQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3805\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3805,"size_decoded":4538,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19978.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.457Z","timestamp":1790156671457,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19978.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cbd195a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d38-839\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:44 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9vqO2f%2BtVKR3mksteSHE%2BU9I8UzhDpehQCDsB0fEfjV9NUGTVBgJ%2FhjdlPjwADLcmYGS5WiPQ%2BuGK5suZ61PWDRP0G8sshGw3GS8h28lFWMrmkHS0eMSASiy841PgURwON%2FLR9z3zw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3533\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3533,"size_decoded":4268,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21192@2x.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.621Z","timestamp":1790156671621,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21192@2x.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=4,i\r\ncf-ray: a3f89c7dcd625a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-5b6\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uclyZPzd40cQ9mP52vAV2VvZbxXBuxiBBPRjBHP1NOgCvK7Ne9uvR%2F6HRrRI01LrZ20Aop8up3TjElGjysyeXyFg6zHxJKlu%2FDkmJZR%2Fk2nD33Jqmq7%2FR09%2FqEzDl8Z6VxWv8jwJjQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2297\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2297,"size_decoded":3032,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19000.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.402Z","timestamp":1790156671402,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19000.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6cd95a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d32-e66\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:38 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tnjRaH2%2B2xu2imy9YJyh1d%2Fij8AkBaFhpPDpcPOFo%2FjTY%2BNLULaTbR9EdEs4aa0ToLm2Xu%2BcYwBS2UMWLR1jd8gBs9FX57%2BQwQNSpNGquH9Dzr2N6kqg%2Bx%2B3cirdB3YokKRvR4HRDQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6308\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6308,"size_decoded":7049,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21060.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.419Z","timestamp":1790156671419,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21060.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7ceb5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3e-d98\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:50 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GloV7gUarWwzBkk6Gyg5UmXBPv9SFFks9JUQkKodmnmDjIel9dr994s4QWd3FWnB%2BlkCHtuQVxCxpYsW%2BHiMUzbiTH%2FscncJSDlvpsdWGc9PPqqavbKK%2BERuVcOPjI20n6f%2Fqr9KbA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5969\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":5969,"size_decoded":6704,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":68,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xara_font_3.woff?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.597Z","timestamp":1790156671597,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xara_font_3.woff?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/index_htm_files/xr_fonts.css?21145\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3f89c7d9d535a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d45-7954\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:57 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rx%2FhZYJgrUuUjPKWFitGh9aBkdTys9daL9GgvgN4E5aYAJrjfSSGogxk%2B%2FNbT%2FSojr%2FlxK7V%2B4twxKFjFQu6cLrZDobHGSlO8iJIQJHbeuJobwPjOLTa7XLaTFyFU%2Boufej6Hu%2BNqg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31060\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31060,"size_decoded":31805,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 31060, version 1.1","md5":"7b0573f4ab0b6656a6f6d393f12a3316","sha1":"c6b7ea6be4d9ee0e575da46179f4bc689fa959be","sha256":"eb01083c0f5d6c3de0d8120c3602cc5301be6e53fb8822dadc5e12a5e3ee7b1c","sha512":"b9dea2374ca126dd7452abfe99bd118dfc77a1651daa349fd684fcd43afc76e359711a8fc5342f3aba3eca886b04d28d7ee242f5ea0843ebe06023acfdd710d3","ssdeep":"768:OAxwDw5aRPjDD4bS+HW60n6ewZllatjZHFQf24G+BNvKfYY:OAxawwv42+HV0nzAlaxFQ+X+TvKwY","tlshash":"07d2e1cc09968354c873827eb50fb99e3263b97b0a55c2a717a1f06e18f3e464e64d4b","first_seen":"2026-09-23T09:31:06.008045Z","last_seen":"2026-09-23T09:45:19.164644Z","times_seen":2,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":185,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21193@2x.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.622Z","timestamp":1790156671622,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21193@2x.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=4,i\r\ncf-ray: a3f89c7dcd635a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-5c1\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Nv%2FBlMVmGEg3U1OkXpej8wZMMm7LuQJT%2FOzk6vlBvhuu7EFkekEAu%2BSyIVRt4g%2BcrWREo3ICgTP0XKMZ3LfoHSAojbTASTLmaMDpHv%2By34ku%2FDSXQjFru%2FCZL62sVGeFlCDO9rgylw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2298\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2298,"size_decoded":3037,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21045.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.407Z","timestamp":1790156671407,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21045.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6cdf5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3d-789\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:49 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IBinJEEFJhLECuDV%2BpD3cCTAA0VXEaccQZrJbPHXHK5HwXjsfo2cokxDPrgmvDBMiHYiBMTG9IQlEyXyah340o%2BnVSsfjaNHYx2HMelIgTH5ysFvSmbWKrRdAe7Xw5xne69pZzfU1Q%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3142\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3142,"size_decoded":3871,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21048.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.410Z","timestamp":1790156671410,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21048.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6ce25a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3e-4eb\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:50 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jaGup5Z6Mlf4Lpd0INO%2FObUai%2FupGul4172JJEgZ3KJ3Vz3yqF8SFQcy4oKovcQdducZT9Ki%2FpX5eQyK6r51VUCSqqVja69Qf4kEgwFdzQc9ta9N2Cf%2BH%2BZVAqh8d0aZjzladsYo%2Bw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1955\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1955,"size_decoded":2692,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/favicon.ico","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:32.276Z","timestamp":1790156672276,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dXKGt5bJN4HW355xtKR05pXXAjrvotqKgUYHNOVL07k5qZDEPo5tcU8wTFCFEW7A4c0%2Bjnf%2F2Lkz0WkrM7g%2BBOU2Rm4QvBV3%2Bk7U9%2BTrFSGVvw%2BQpQXAeltN6L9zuhV9WUgv%2By8%2FBQ%3D%3D\"}]}\r\nvary: accept-encoding\r\ndate: Wed, 23 Sep 2026 09:44:32 GMT\r\ncontent-type: text/html\r\ncontent-encoding: zstd\r\ncf-ray: a3f89c81de9d5a0f-OSL\r\ncf-cache-status: EXPIRED\r\ncache-control: max-age=14400\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sat, 04 Jul 2026 14:17:08 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":808,"size_decoded":1160,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-09-23T11:59:47.120263Z","times_seen":39259,"resource_available":true,"data":null}},"time_used":211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19804.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.375Z","timestamp":1790156671375,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19804.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c3cc75a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d33-79e\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:39 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=waguHhoUdltW68z6xGFNyew1M9KrbUh9wg60q7Jh43C%2BXQ4MSjfaaqfA%2FCHvNKo8E%2FUYhEEh0xi5LutGA%2BTM1ksFCwRDpSkGWqX%2FtprsT16CpIBFEVlHLyoi8u5Pb9RyeZtTtsf5og%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3204\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3204,"size_decoded":3939,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/custom_styles.css?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.142Z","timestamp":1790156671142,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/custom_styles.css?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MHlZYxDDvu9KtFJw0IPzdViy5j5m%2BBik0Le4LPBYSlrUqrelFva9SREb68s79lP7xnT3sAK8MwJ9RYLTlvvL8o9plHE0xj7tCZs5A0a5h6533CTl6oG9kAOCmmvIh8wqk0NXRwXIpA%3D%3D\"}]}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: text/css\r\npriority: u=0,i=?0\r\ncf-ray: a3f89c7acc6a5a0f-OSL\r\ncf-cache-status: HIT\r\nage: 857\r\ncache-control: max-age=14400\r\ncontent-encoding: br\r\netag: W/\"6a757d45-e89\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:57 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3721,"size_decoded":1183,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"415519643c9b6ceb5c7ece0dff2ffe0f","sha1":"ea7d72546eac8f94b1b07f5f98b7c65f38925193","sha256":"aaf361afaa262e79572ca9a72bb5815fbc44bc8c4fb6dfc1d14e45ed2c84da5c","sha512":"0db44a6dec912f98b85b6e65176e2699ab2e4ed6b1763517629d4c9ee80c76441a017577e4bdb0d26a0bd453211f8eceb428e0c3f204790e05899eb70ab4a140","ssdeep":"","tlshash":"8a718991621e68c4a0b3cca6394e3279bd2c45578d7fd922b6068c28dbcb67f331235d","first_seen":"2026-09-23T09:31:06.035051Z","last_seen":"2026-09-23T09:45:19.166275Z","times_seen":2,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21100.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.439Z","timestamp":1790156671439,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21100.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9d055a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3f-b82\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:51 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B86tr3BMOhC6%2FKtvbePk1duJCLMMVZVQaIu5hGBlRZk5vXgynTDqE2EMANAumOftG2m1uoQwccTpVuau6f5rg5%2BNRa8v0B3J780PGEXyeuJje1EUWG06l2lFmlUmdmmfk5o%2BrRfq1g%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4939\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4939,"size_decoded":5672,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21200.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.467Z","timestamp":1790156671467,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21200.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd225a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d43-aee\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:55 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vbl%2BIl3fKnqBNHBsUv%2BoE8hzujLQGvO9zWOzm1Sct5O1629nHfAnAJkANJoisFnvHe8cnadfEVvd71zbJa64mZfPmPuqvQhzgYZI20S6h8L90NnC6%2BkPGjzt8%2FA2dgq87wcqNDjwRA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4718\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4718,"size_decoded":5451,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":103,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21191@2x.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.620Z","timestamp":1790156671620,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21191@2x.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=4,i\r\ncf-ray: a3f89c7dbd615a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-5cb\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bxYu9kVtTW9iUTI6fNaHFsR%2Bek3%2B%2FoTUronGN17nx2122bmjDrNpxZD57vrPVf6oNJRPHtfjl3766h1Pd3z9JlcVaFyxehCpcsHNpgdBWVFV4GFYYuiQ19SX4vjwvANZAKkxR6y%2Fpg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2379\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2379,"size_decoded":3112,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21033.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.384Z","timestamp":1790156671384,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21033.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c4cd45a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3d-58a\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:49 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c8%2F8UilUuvP05%2BEiL96Bs%2BtYFTbeAzN0525qBGulJFbbgpxsoP4guh21hHAlG6OYd1awxCxTh%2Bw9m%2Bw9XCE3zvRB4mYr8tt88ZH610gebDv8%2BPWVxhcV8qg9eSIkpix0vhi%2Fd8R4Qg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2197\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2197,"size_decoded":2936,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19940.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.428Z","timestamp":1790156671428,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19940.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c8cf85a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d36-b1c\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:42 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IdFVbfy93KzIFp1apQy8qZtJ8EIEiKR8zSn2IrdINS0eLjqS1HRPkKLJc4HoImO%2FgTfISjRGFPBgvTxwEYU1pvEJAL7ofH%2B%2B0O%2BdS57r2A4057GB8xdYw9T1BUGbgIcBoC9TxmLcdA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4790\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4790,"size_decoded":5523,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xr_main.css?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.140Z","timestamp":1790156671140,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xr_main.css?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iF1PC7XCfkcjRKTBayAn9AOd7D9fONpJSWq2IF%2F7XyhIfv2KV%2BVzIxXn4JEhGUWCCIr847cK%2BS7Vp19kF9HGM92ZoMFvW1%2FN%2F3EXYz2Byl3KjWF4vFpjdv1ES8%2FJXd9B%2FeCjub6f6Q%3D%3D\"}]}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3f89c7abc685a0f-OSL\r\ncf-cache-status: HIT\r\nage: 857\r\ncache-control: max-age=14400\r\ncontent-encoding: br\r\netag: W/\"6a757d47-2380\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:59 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9088,"size_decoded":2576,"mime_type":"text/css","magic":"ASCII text, with very long lines (304), with CRLF line terminators","md5":"f55dc82da40717fb32173bfc04217885","sha1":"441271e002bc5d8e44af82668107f1c0efa7b5d3","sha256":"6b416432f4c8dac364b4f36a174fed08942a3cec95a6de528a42dcf4ea0dbf74","sha512":"0af24e78e9d7ee493ecad92e75e069549be2f6d2b9392fddebf38c1397db6f272bcb4349e45b503b4643ebc0b38947f0616cad7907018fbddc27f7f7d9d4c019","ssdeep":"192:Sg2i/MqYs74g53AG6rlY6zLXUViT+zanDXWvXzHznu0JEIJj3VPVzp:SUX7T1uTzrSunD2bjpFN","tlshash":"1812cd2096651905706fe21fa9d2bb928e3f6381fd1123f97e2b7760caca1971373709","first_seen":"2026-09-23T09:31:06.046364Z","last_seen":"2026-09-23T09:45:19.167185Z","times_seen":2,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21030.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.382Z","timestamp":1790156671382,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21030.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c4cce5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3c-abed\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:48 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sKxeElzlH4PyT7KUBeAhhFCT%2F5ALqcQqcO5SqGlnFynhWT%2F17uDu53M20AUVSOADuPNb3LGbCLGsqVWpw0Km2vFkGoD72Kwfia6tUJntSMqexZFZ6A1IubusvPz62DYZeR2BJp82CA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 79491\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79491,"size_decoded":80222,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":515,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":394,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19948.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.434Z","timestamp":1790156671434,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19948.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9cfe5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d37-8f1\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:43 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V7hMRRr73HaeuIWzUaQXSf3SHu6xC9QeALM7L6OSudctE06nQ7agrgLkWwCkhqZlUzRnAGGMxJMBIJs6BVa4xjnm5T5ThKOYZU34LeU54bvsEQOwjAONL9XEhCtBKet2lAfrdrcWvQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3804\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3804,"size_decoded":4529,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19866.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.380Z","timestamp":1790156671380,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19866.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c3ccc5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"3d3-6586f3dbc4de4\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:40 GMT\r\nserver: cloudflare\r\nx-accel-version: 0.01\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hTmBMfWdCf1uadAjzDMX0QtovSaRwE640dR08aCtttzbw9lnm70ykfDa5OBA1KKjNiZsDe5ONYdR2n%2BKOrZRci8R2uejMbyti20sJqef9O1HyX5biWY4uetujGKDR2M2kqus4aVHow%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1411\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1411,"size_decoded":2166,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19291.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.384Z","timestamp":1790156671384,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19291.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c4cd15a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d32-1e6f\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:38 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JZEHiJxLcdS%2FUvxZ%2FmeXq44Z5DByG0uDR6CtAYS%2B%2Bcd5l4nfptltD54vqilU3VJQpbgrxIhJlJOwBY%2FZhsPaDPfgPCsYoa%2BtfxswN4%2Fnu8jiRkyZSWDCj53XE%2FS0x4H3nedrIB8bZg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13775\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":13775,"size_decoded":14518,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19899.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.415Z","timestamp":1790156671415,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19899.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7ce75a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d35-e09\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:41 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EEIwq8w7GywNvOtWWXOXu%2F9%2B9wGxCH7X5%2Fdw2%2FCmq9GK7oEJ0OaFVLFX0sdJr6pzP2pejtZyykuUZkG%2Ffw3Jm%2FMeREMNaHSoPzwFNxrCl1sGFrKf%2BH0EFiApYn0WdL8mNaO0%2F9FW0g%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6154\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6154,"size_decoded":6895,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19915.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.422Z","timestamp":1790156671422,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19915.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c8cef5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d35-83f\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:41 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TxDlaimXcScYkBWMeZ3oUjTGbmUF%2F0Eu8AX%2FWxBQ%2F7YpBeHBi4JhnCX30UaPB8oJOvvzUClcasYTFAzdhXn%2B0Jh4io5591CrDOoHjm2xQMeWzwzWcbD%2BCnCjY4zx2nxqB4OiEVEGAQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3464\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3464,"size_decoded":4199,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19977.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.456Z","timestamp":1790156671456,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19977.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cbd185a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d38-7a6\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:44 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8fP7I7pi2ufhwRlT4oVukM9Khibp47EN4eotuAFlJVH4Tdnp0l3b1F48M5mKEjqC2jL77kTDFrOYjq3dFfl%2BI2vufBbyFP6wrU8UDHJIap3det6pRIISGipT5alPtq93n%2Fu4SbH%2Fmw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3216\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3216,"size_decoded":3947,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xara_font_1.woff?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.595Z","timestamp":1790156671595,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xara_font_1.woff?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/index_htm_files/xr_fonts.css?21145\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3f89c7d9d515a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d45-7148\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:57 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gyvhgNvjsfaInT7JaGepCu1kKX56MUxbJL2BREz1cI8EqCbqHbJU6LWS87yjfbb5yR5MpROyCmHRTmru%2BVBXGvz9%2BjqnQY7A0F0lAde76qYqzGED1IPI6YO2VVLfhPmayLMVKRjAJQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 29000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29000,"size_decoded":29733,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 29000, version 1.1","md5":"1a2aa482cf4e481a0ff8387108d128ef","sha1":"3802e188020964b5f46b3e4bf0510aaf5496d1b1","sha256":"eba97dbd65fb118e8cea3239e579621e311f315274b1499f9e5799c39e3ce3c3","sha512":"68c6b607cd069aa81023b234a91dbee88f17df23e42020f5a1c4df1ad5b80e763a2b697550c931349c043fac5463051196e8ef97a533ef69c7bda29fb0e227ec","ssdeep":"768:TjWtTTkt6gSiivIrXWxm45f24G+BNvKfYY:Ee6DiivIqxm45+X+TvKwY","tlshash":"2cd2e0aaa09370ddda2b2173354771c94a33f6be4330d510c1ef76a81c0f3a49ea4582","first_seen":"2026-09-23T09:31:06.044556Z","last_seen":"2026-09-23T09:45:19.167919Z","times_seen":2,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":179,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19805.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.376Z","timestamp":1790156671376,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19805.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c3cc85a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d33-7e2\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:39 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HnKjuQCNAkXekr9Ub4xjPwrS1%2BS2k8SIBw2QIzfe7CfZyxsAJOXyeOjTl%2BGvK%2FymlK7Mihkti6ISDAZYRuQIgJtY9JL0x%2FAcYLy38495XOdR6XN%2Felx9FmWjdPTVq8HEV8M2hhvyrQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3352\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3352,"size_decoded":4087,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"content.r9cdn.net/res/images/horizon/ui/seo/marketing/poibadges/POI_BADGES_GUIDES_DARK.png?v=3141cb0739e493843a37b32eccb35318b9d646ff\u0026cluster=5","fqdn":"content.r9cdn.net","domain":"r9cdn.net","tld":"net"},"ip":{"addr":"151.101.193.29","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.400Z","timestamp":1790156671400,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"content.r9cdn.net","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 29 Aug 2026 00:43:08 GMT","end":"Fri, 27 Nov 2026 00:43:07 GMT"},"fingerprint":{"sha1":"F4:FC:7C:2F:1E:50:3E:6A:EA:A6:61:AF:77:DB:60:7F:74:4F:9C:DB","sha256":"A2:DA:7D:C5:4B:7F:10:6F:3A:03:BA:55:80:E1:B2:D4:70:3E:01:0A:7E:E5:54:2F:8B:FF:B4:3D:3C:8D:9B:91"}}},"request":{"raw":"GET /res/images/horizon/ui/seo/marketing/poibadges/POI_BADGES_GUIDES_DARK.png?v=3141cb0739e493843a37b32eccb35318b9d646ff\u0026cluster=5 HTTP/1.1\r\nHost: content.r9cdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/png\r\npragma: \r\ncache-control: public, max-age=31536000, s-maxage=31536000\r\nx-r9-mst-req: 006000045215789\r\nx-render-time: 0.003\r\nx-r9-mst-target: sparkle\r\nexpires: Mon, 26 Apr 2027 04:57:07 GMT\r\netag: 3141cb0739e493843a37b32eccb35318b9d646ff\r\nserver: KAYAK/1.0\r\nx-sn-waf-code: \r\nlast-modified: Thu, 24 Jul 2025 08:45:52 GMT\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\nage: 532919\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\nx-served-by: cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA, cache-bma-essb1270057-BMA\r\nx-cache: MISS, HIT, HIT\r\nx-cache-hits: 0, 2942, 0\r\nx-timer: S1790156672.883271,VS0,VE1\r\ncontent-length: 16411\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":16411,"size_decoded":17098,"mime_type":"image/png","magic":"PNG image data, 916 x 728, 8-bit/color RGBA, non-interlaced","md5":"40f94a19f0867c8c35497cd8a6586a43","sha1":"6b2f5de1fe0bf59b6b159fcb46cea2cf47c2f01c","sha256":"4267f51fef91f4af6b3203ac6edeb1a6bd2284be092a6a1332e9c9227f12c360","sha512":"a9c43b3dd6380929c1ae1633d588647dd63cb4120a4bcf7204e1e7ca264bec6b3949a77b8dc2989434d81b9b1014a715043450201f664c531393e1d3a31015f8","ssdeep":"192:lWqOkw/9MVBG1xf0H1SR+c6uJ7AyBDdCvCYHltPOITiGacXPo6a0g/ey0q01IdL6:lLw/co1x8jg7pCK+9zA6a7dLCfCTyyS","tlshash":"bd72c0f3e59918cd82a30e7c05be0d5e05e92d224d3608dd3e5e0fa635667c463eb6ca","first_seen":"2026-09-23T09:31:06.024455Z","last_seen":"2026-09-23T09:45:19.168909Z","times_seen":2,"resource_available":false,"data":null}},"time_used":678,"timings":{"blocked":-1,"dns":35,"connect":41,"send":0,"wait":43,"receive":175,"ssl":383},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21101.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.440Z","timestamp":1790156671440,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21101.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9d065a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3f-c57\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:51 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KSpq8qcFREEwO3IqjqN4mCKFsSPtVcTRfS9bEEHn5ss31SP%2Bkg81fXnlAigwlWpXku6anQAn3FmiXm9cT%2B3tN%2FOG7ExfN%2BsuZzI0NpEsma6DSraJE27AjcZC9nC%2FgsBkgyoJWDykmg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5398\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5398,"size_decoded":6133,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21183@2x.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.613Z","timestamp":1790156671613,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21183@2x.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=4,i\r\ncf-ray: a3f89c7dbd5c5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-5aa\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1I4kzWApG%2Flo43OzlDYQ2KOh4xqa3oCQxIqmKiZ56AJbFUqcDnGWGAi1lyyZAG%2F%2BcTXAB3YtJPSJLCq6EgPIq6iWonvkwg2oZJHbx8oDUQTDBPmKyit17SmrHERx%2B3ifTWLVngLbxw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2272\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2272,"size_decoded":3005,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21034.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.385Z","timestamp":1790156671385,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21034.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c4cd55a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3d-9343\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:49 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ll5tNIwaXT7vS%2BJAvJwJIeY81gvIk4Y73Kw8qMQtvZX6vsDlPDvL4DX9FRjzOpdLevl3zn4uoTkIEME4SzYtoQ5HAfIHXKZ6lp1NqvPN9J3l4fSP2UCVCn5didKWiPaMXqwqhBXaag%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 68007\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":68007,"size_decoded":68736,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":517,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":422,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19835.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.416Z","timestamp":1790156671416,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19835.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7ce85a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d34-ed6\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:40 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v0ssWQdsiNV2jwmQirvIBPBXnUSNrZJQpWMs14NkqHgDWZ5tTbvLJCoClIuCAVikQTNL6wxLiIQ7IXSzt1pjc3f6erhAplujmL6HoP4L7J0CDiTpE62aLDNKkaCdY9dJjH9xSabhRg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6536\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":6536,"size_decoded":7261,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19950.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.436Z","timestamp":1790156671436,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19950.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9d015a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d38-956\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:44 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=klFo%2BstTYsnp4Ie4QnfJCiAipASYs5y5xPbH6PO2ktE%2BaNGO0BVfT8Yx%2BwfS%2Fvpw8BriFcBR7Jkx4ftVTU7AHsvjUL0pWe5wCWkHEM%2FIpGv9YtN74j2CSdvcBuUfhyeS3lGaU1uHSg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4007\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4007,"size_decoded":4742,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/xara_font_6.woff?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.596Z","timestamp":1790156671596,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/xara_font_6.woff?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/index_htm_files/xr_fonts.css?21145\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3f89c7d9d525a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d46-be0c\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:58 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qoGO2Mx2qyp9n0g6ANXmR4gu0znISq72LIY1vJGSOY9mpYoZKu8aoaZYXCEddfU1oNWPgRfrzUuqbF2afTDF%2FHHLDv1NJd1VpFXs%2FvEyzyfuanVF%2FesuIPoGl8Z0vfVvFrs6JinrBA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 48652\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48652,"size_decoded":49387,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 48652, version 1.1","md5":"74cfacec37422836afa8846510ef1977","sha1":"ec1409fd7cbfedf050265fc7b8e69e41c93a8a93","sha256":"c1f6b4a4cf8e79fb58bd893a3080392cbf0ee39cc46b9468dcf3ca222def9c0c","sha512":"bb33ff0c1e7aa3307f25873e2946a359ffc0eb643d8f9ef0a69551a43fd1d92361ae6ab8e5d0299843db9fd8645b331ab1d2be757bc760c3cea87a2f5e4b1654","ssdeep":"768:lzxkM1mdgRbfsHYE6J6xIe15/v4qnCwX9qP7xBehHMtVHPx2GyJiN3AaIYDa+GMX:Bxk/yRbfYo6xIM5/vlnCpx4srvx2GOi9","tlshash":"ca230108ce92a91b150d7276329d97174f0be099d54b90d0c29b7e7e0ff2f29d6e211b","first_seen":"2026-09-23T09:31:05.995851Z","last_seen":"2026-09-23T09:45:19.171492Z","times_seen":2,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":276,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19806.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.378Z","timestamp":1790156671378,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19806.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c3cc95a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d34-852\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:40 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ct%2FcZ1XPSiVOnto6iaeoDGLD7W%2FnfMriji2lVTnSGEEp8fc%2FLNMS0PLBtLT8CYqE%2B7hpmMbr6QDmKjQlm8GxCbJ7ghkQfXJOeWvrrYdKO2sfM%2BCeyuBc6ODe3Fyj0rtMndfNa9GK4w%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3485\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3485,"size_decoded":4220,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19807.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.379Z","timestamp":1790156671379,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19807.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c3cca5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d34-8dc\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:40 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CTjLY4xgzqVhwI5bgWD0gqGPFMHXZZvfUCAIkySbvd2LNg7D9xrA%2FSEZNmi%2B7Qzta%2BK4HLDqb88o8HmQOkwTGkLIFYaB95jvVH4nMu0dFb0emxDzyntysdBgHp4Hn1sV6Uuk3BoFUQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3762\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3762,"size_decoded":4493,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19951.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.437Z","timestamp":1790156671437,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19951.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9d035a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"3b4-6586f3df27d19\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:44 GMT\r\nserver: cloudflare\r\nx-accel-version: 0.01\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xy%2FQRgtOamr8lYYw0ade04dJ%2F%2BhxjmFCCVQ%2BDXdTmBSW2xijxmPXJiHB0UrPFGohfNPzsCH95D11NauwpZ9CXaLOweqsa%2B1gTp7pgGEzB2i45UnyyfCGSRnTwnjTQambxD29AeUyFg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1386\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1386,"size_decoded":2149,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21190@2x.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.616Z","timestamp":1790156671616,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21190@2x.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=4,i\r\ncf-ray: a3f89c7dbd5f5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-5dd\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tdN1agmAOIckbedaFJ134uKPofY9qkY1W7LyHuZzmZAEUBnvKugg%2F3rSI2Hs6KVcYqW4jzbSp5PF1LfnVrzR1Qhx4sDJgYSlvdvET98kVVj7px0i1kaL0x7OvbY0xWxtnn5vK0qdGQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2355\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2355,"size_decoded":3082,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/roe.js?21145","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.146Z","timestamp":1790156671146,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/roe.js?21145 HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FSmF67CTlb7ytvO6q6pm957%2F%2BD3nehrOl3gp8LRymC2kRtNnt1kXzILwEejInYVC8W1RKsE9tNBGhMjbAYyP7n1ZWByczXcBxIh4IJPI4KtWlgtt0BcYoIou1HtBVowItCR7m1M%2BDQ%3D%3D\"}]}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: text/javascript\r\npriority: u=2,i=?0\r\ncf-ray: a3f89c7acc6e5a0f-OSL\r\ncf-cache-status: HIT\r\nage: 857\r\ncache-control: max-age=14400\r\ncontent-encoding: br\r\netag: W/\"6a757d45-11c6f\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:57 GMT\r\nserver: cloudflare\r\nvary: accept-encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":72815,"size_decoded":18446,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"1a4cbaba874a6c6741f0a354ee607187","sha1":"b332c77da132b2201fe51ee8e82a800722004807","sha256":"29591fa5d1f6c94bec0e9660d424a412d9f7b66074254a76d7446a612759502c","sha512":"b22f5f9602ea8d6fcba7ac9c280b73fbf823ce2b383ef7d82787f624663a86a43bc94baa07c5c77ace722b0a9ca46644bd6e15d7339bdce2c15a6f3cb7f56452","ssdeep":"1536:qF1/W16+23z6PaWI1ybC4oMy9SNE+qgoth6HKKsjnAiUX6sYhn6Vz9MyRYb8BpOY:TfxEEHXsjnAiUX6snhzDBUQmO2g","tlshash":"cd6382323544153a82fab56e126fb78d34724494ea02e490ed7ad8706a70f6354ffef8","first_seen":"2026-06-13T20:04:13.726082Z","last_seen":"2026-09-23T09:45:19.174033Z","times_seen":3,"resource_available":true,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21116.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.452Z","timestamp":1790156671452,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21116.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cbd145a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d41-cf1b\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:53 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GY%2BCLQK3pwyiJkmSk7VRpTA%2BejH3uqbYeJ%2B9vY4E5Br9dYH0lO%2BO2pNPwoMXM11%2B0yIS6Fp%2BoFO9kqCkDWdl%2F%2BIQnccI1xC7xPRmz70KRAEiyTPJxurDaFbnzKeRZ%2BuIbrIGQqxn%2Bw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 95758\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":95758,"size_decoded":96505,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":563,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":506,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21044.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.406Z","timestamp":1790156671406,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21044.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c6cde5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3d-77f\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:49 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RiIc8o1o9HySY9hPzwxKgMO8evSle0yPiZfaUpVk3vkoNtci8lv44iIEIL6dpfTLLdmK5jD8a54jIut0YXbdfHHctReddxx9CzcZNulXPPIaN6XQmlARP%2BkKEm55Q7IlD5MqMQzt8g%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3086\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3086,"size_decoded":3813,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21059.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.418Z","timestamp":1790156671418,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21059.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7cea5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3e-ae3\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:50 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SqbK0nM6R6LnnInq8XaP%2FvN1zVs531FWp6kdcEPMJmp63BUtBGgrZu2vRlryKsZtdiJji7Kdm77xFSUoYkl%2B%2B3W%2BS2Ci4lk%2FmechfvzvE%2BF2A%2Fz1IjHO1vnQuMsSw8z%2FpabhxWiC7g%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4742\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4742,"size_decoded":5483,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":126,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21061.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.420Z","timestamp":1790156671420,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21061.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c7ced5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3f-e38\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:51 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hzrIuyWpxWICRLzRTV9iIhzdwyxtT9Csi%2F%2F9zIu27kX5TamB0S2sqzZ05Hwrc9nEvwc1%2FwH7y1xvlZ7ZxSu8YjRa0wdH8%2Fk%2FFcV%2F2ebZ%2BwsVOB8He63vJBeRsFldW08wZNL%2FgPpSRQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6297\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6297,"size_decoded":7038,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":66,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21080.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.424Z","timestamp":1790156671424,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21080.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c8cf15a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d3f-9f0\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:51 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MvljhtNJvz27KAP6t2vz8F6%2BM%2FpDuPXGtePcGEAWYUSTMambXgmATeeoF1uXJxanNP5RM6O8yN5gSvHsUlbwCDrHM4Mqc12%2FsSG4OWihZQJeNOrgr0wFXpGayf%2BG2%2BZqU5bn5IZffw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4229\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":4229,"size_decoded":4964,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":58,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21195.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.463Z","timestamp":1790156671463,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21195.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd1f5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d42-a64\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:54 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NrZb3TNLiZztQe3ce4QJwKnSKut2ecOnaia%2F%2BT1RfPUoAQ%2FCqFIHk5xczcTSowkOtH482JdMA9x4MuT5bYn%2FJ2a1m3jU4zOF6GBzvDKyPt%2BSwiVUuinW656lSJp18T2vONzBi9PfEQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4487\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4487,"size_decoded":5222,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21113.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.449Z","timestamp":1790156671449,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21113.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cad105a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d40-eb8d\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:52 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z0gH5NzRrQ4hjBHqBYn4jYi5yt8DFWNrrOejwQo862f6NYPbJ1Y1fePwAykXqO6wZdClpk%2Fn81Cz8TJsxwcCctij%2FVBx%2Bvd7vVubsfweFOQyam%2BvDpsCE0bFXMy5bzGmOQ7dy1UXFw%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 108731\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":108731,"size_decoded":109467,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":552,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":438,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/20052.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.462Z","timestamp":1790156671462,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/20052.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd1e5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d39-6c6\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:45 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dXVQeNSLzS0%2B04qMdkECcNtCk8G%2BXAYTECRdNoXBiJ8QjYOOS%2Fd0sqU4jOiZXG3SkkAFg4rdI415Y9CSgjvhQH9%2BRtNJ2Z0JiK3i2MKGVDVpNP6HY2SVnQhNLPAkJzK9nnfWHVSW3A%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2793\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2793,"size_decoded":3526,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21180@2x.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.612Z","timestamp":1790156671612,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21180@2x.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=4,i\r\ncf-ray: a3f89c7dbd5a5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d41-11295f\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:53 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5i4saihX4KDQDYFkRxnC4fCykUwI9ncldusOMaJeHs63BhPP87NoV98Ab8OFgbXKsF8oFCW53fRBGwMnbuJv16IILbuIgK9zvvVyfmrtaP2Zyhx0FU9bxN%2BOTSOYV63N9s%2FzFp1mWQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2036841\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2036841,"size_decoded":2037576,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":2270,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":2175,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19855.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.371Z","timestamp":1790156671371,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19855.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c3cc45a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d34-465\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:40 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7WtqPPgSfIQOsw22I4crMXwz6I3NMFbToHhH2xWy3o4LPu2mRLaUfy0rGC0wSiSVr69LpqRu%2FmKn0MshjuM8mySbRHYe0E5bXCLg1J3L6qRtOFWIOfjPLgYEScAkS3dth3x%2B6uVI%2Fg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1658\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1658,"size_decoded":2389,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21119.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.455Z","timestamp":1790156671455,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21119.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7cbd175a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d41-42f\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:53 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JuWyiJDDRdtlMFjedsi3p3YAtSfX3KUlozbmd3XeBYiyruaLD5eHpKsHDa3FQc%2FC8xgYeugfZGeCwq05dWzbf5ipmzcmne5h6O61HC8Z0oGJ6jt34IcPOSgmLzsJvsrz9ixPg%2BjhKg%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1551\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1551,"size_decoded":2280,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/19945.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.432Z","timestamp":1790156671432,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/19945.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7c9cfc5a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d37-1020\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:43 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZA1v02RLTmLYqrNNZe4XeB84Uzi96q6A8aZl9fPrgAl1c9zMJnl9t39iX4ybjkSlki174FtX7xzuedPRv1q86xcKDp3lDyCdnuOq9Mdm4AJnKvOgQ5rd2CJqsrojLgOsPSN1cQ0DGA%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7168\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7168,"size_decoded":7894,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"the-spa-retreat.live/index_htm_files/21199.avif","fqdn":"the-spa-retreat.live","domain":"the-spa-retreat.live","tld":"live"},"ip":{"addr":"104.21.52.17","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://the-spa-retreat.live/","date":"2026-09-23T09:44:31.465Z","timestamp":1790156671465,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"the-spa-retreat.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 13 Sep 2026 14:25:28 GMT","end":"Sat, 12 Dec 2026 15:24:02 GMT"},"fingerprint":{"sha1":"40:22:A2:84:15:B0:98:73:96:6A:83:56:43:82:8E:7B:2F:4E:49:F1","sha256":"67:47:2B:BE:7D:6E:33:3B:28:60:D8:6E:C6:15:F9:A9:44:41:F2:8C:3B:72:53:14:7E:87:ED:3A:0E:26:7A:0E"}}},"request":{"raw":"GET /index_htm_files/21199.avif HTTP/1.1\r\nHost: the-spa-retreat.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://the-spa-retreat.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Wed, 23 Sep 2026 09:44:31 GMT\r\ncontent-type: image/avif\r\npriority: u=5,i\r\ncf-ray: a3f89c7ccd205a0f-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 857\r\ncache-control: max-age=14400\r\netag: \"6a757d43-a49\"\r\nlast-modified: Fri, 07 Aug 2026 06:37:55 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eS8qwygQgwAvizj9sQSMIcL06zi7hgZitfMlRGmP%2Bww1hTikLsJ9KVXqHFBdsqpSdDyRnr4wM45wE1ZKms6jnD8YE6L0OmiQQN6QbvIsMJ%2BEW1wbpZ4fuhEhdSWP7RRIoH629Dq3%2FQ%3D%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4416\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":4416,"size_decoded":5147,"mime_type":"image/avif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T12:48:34.315886Z","times_seen":18618763,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"the-spa-retreat.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"the-spa-retreat.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}