{"report_id":"5ee941e6-512b-4294-bf5f-b1c13b021de4","version":0,"status":"done","tags":[],"date":"2026-08-19T11:53:13Z","url":{"schema":"http","addr":"kra54.gl/","fqdn":"kra54.gl","domain":"kra54.gl","tld":"gl"},"ip":{"addr":"172.67.173.190","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/","fqdn":"captcha.zlon12.at","domain":"zlon12.at","tld":"at"},"title":"Captcha","dom":{"size":20278,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15075)","md5":"79ac7cb7992fb33a168c2e635430266a","sha1":"4979b68fe43a522d00126962f837258beb8c7221","sha256":"4afb6dea5cbeb3c8fc4d74679ffd79d9740e2560754b3617bd89889943c2770e","sha512":"f2c404461dcd379fd1e40aace33b6ee8b31f5f42a288b3012a734978278d8878cc8b1a6de67da47b4e40f99cd8e65463193093ebb8bdaf45ae4abeaf28f75ad0","ssdeep":"384:2gn1FQ/mfMKsalJKuJP5s422PgyNS2b3v1qumqFtX+:52/mUKR/P5jj4yNSg/EubFx+","tlshash":"a492bf674aeb24407906a4b57b9e5aa52adc8163c207c9b83e4c1fd57fcb9d801b3f4c","dom_hash":"domhash3a10f3d1b1526d7842e68898d0b79495","first_seen":"2026-08-08T10:13:58.371384Z","last_seen":"2026-08-19T11:53:13.963605Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"kra54.gl/","fqdn":"kra54.gl","domain":"kra54.gl","tld":"gl"},"ip":{"addr":"172.67.173.190","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-23T11:53:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"captcha.zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"kra54.gl","ip":{"addr":"104.21.72.15","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-10-28","domain_rank":0,"first_seen":"2026-08-19T11:38:45.911494Z","last_seen":"2026-08-19T11:38:45.911494Z","alert_count":0,"request_count":1,"received_data":818,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"zlon12.at","ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-10T14:34:50.531419Z","last_seen":"2026-08-19T00:00:29.443396Z","alert_count":5,"request_count":5,"received_data":3459,"sent_data":3253,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"captcha.zlon12.at","ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-10T14:34:50.536597Z","last_seen":"2026-08-19T00:00:29.147468Z","alert_count":6,"request_count":6,"received_data":107870,"sent_data":4496,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"zlon12.at/","fqdn":"zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"a1edc37c8e3ac768dd33e2d4cb42cafe","sha1":"18a8b4436ac3a7c43c4e0a4b0447fa0a0c4326f1","sha256":"5e65b7779aa16aca85d3187a963ac1ecad9ce623c7df36c7fb315b00fcb2c6a9","sha512":"02b5bc7079232b511de90c8d5ac447721b96a1472138cf0e9de274ba3d895b52e4e781a05812ce8f32a30a3822c9240cc7fde176731d9a04a76cf7a3ac352e36","ssdeep":"","tlshash":"899002a359b1509b87265a14524671122b260971870e5717155a0a718574744e941b55","size":57,"data":"","first_seen":"2025-03-07T11:01:59.145819Z","last_seen":"2026-08-20T13:05:56.639564Z","times_seen":907,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon12.at/","fqdn":"zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"c2e5146c86321e5cb32a1bbbf6d94948","sha1":"8c4c52a59a82f72c8e75ee2e3ffa780eb08acc2e","sha256":"6d04d0502b0af51a0bd521653342661f3921165aaf99b889e8e1e91ea654d0f3","sha512":"78c7ddb0f2a4ebb46b7ea44f6e2bf5910e163022e4fbf0d87b35951e96ba53f762bc299b17d9882df5326e976a16b98b9590848592203f55c298f432c0d0e99d","ssdeep":"","tlshash":"8b90044541c77151c031157441dc5070413c50015c1dfc13310c4c310d4033f5d40311","size":46,"data":"","first_seen":"2026-06-07T12:22:38.17104Z","last_seen":"2026-08-20T13:05:56.640102Z","times_seen":166,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon12.at/js/connect.min.js?2","fqdn":"zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"ddc1c95b6ab9223711ed7f50a15bc930","sha1":"7d6cf05a1da4d78f98f5ceba3784a0bc210116a3","sha256":"9fa0fd5b129cc1062500cf31c6be66f6617d829c3e4ccf0dc7cdba46f992632e","sha512":"115c9699f4ef5c42484fe47b58b2e87dec9cf96515a2b6da929237e7d4f3b579f2f20b4c61b9795ca549d9b3f24f85ec5afcc18431e26c215108366f3491f4cc","ssdeep":"192:op2O/++sssVpvqUl87UlCUldUlQwV3drycp3FJQipv8DIk1FBHwKs/XsUCbl3Pii:o0O/++sss6UlyUlCUldUlBXp3PDN8Dhl","tlshash":"84329840eae4f855a613139da70bbbc4f10815aa30201f97a76c1d88f95e47be6b3d73","size":11274,"data":"","first_seen":"2023-05-03T10:33:12Z","last_seen":"2026-08-20T13:05:56.640722Z","times_seen":1118,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"kra54.gl/","fqdn":"kra54.gl","domain":"kra54.gl","tld":"gl"},"ip":{"addr":"104.21.72.15","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-19T11:52:46.686Z","timestamp":1787140366686,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kra54.gl","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 09 Jul 2026 00:48:14 GMT","end":"Wed, 07 Oct 2026 01:47:49 GMT"},"fingerprint":{"sha1":"8A:5F:2C:F7:5D:30:B9:C1:EC:4F:52:66:55:8E:E0:FA:23:FA:F2:E1","sha256":"27:AF:E1:B2:8F:A4:53:6D:81:C5:51:1E:80:2F:A3:AD:4C:58:60:25:51:60:06:67:37:E6:C9:C7:76:79:49:AA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: kra54.gl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 \r\ndate: Wed, 19 Aug 2026 11:52:46 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\nx-robots-tag: noindex\r\nset-cookie: go=1; expires=Wed, 19 Aug 2026 12:02:46 GMT; Max-Age=600; path=/\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nlocation: https://zlon12.at?from_host=kra54.gl\r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pSB3LKEqnr1C6L6ZPRJ4Xle0gvjI0BKfNVIIE%2Fn0M%2FKPsGh1sXyVtjiQL3ASHYkvmnKL7yUlSFJsWEicYIjl4hsJFvYmCXOnuWCf6FaxHzsOpplFjm52RWJqTQ%3D%3D\"}]}\r\ncontent-type: text/html; charset=UTF-8\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a2d8f43c3a1ba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"go","value":"1","quoted":false,"path":"/","expires":"2026-08-19T12:02:46Z","raw_expires":"Wed, 19 Aug 2026 12:02:46 GMT","max_age":600,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"go=1; expires=Wed, 19 Aug 2026 12:02:46 GMT; Max-Age=600; path=/"}],"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T17:30:42.653402Z","times_seen":17995340,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":50,"connect":18,"send":0,"wait":78,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon12.at/","fqdn":"zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-19T11:52:46.994Z","timestamp":1787140366994,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 19 Aug 2026 11:52:47 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 490\r\nset-cookie: tor_scheme_id=1787243651; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/\ntor_port=9352; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/\nsession_id=fbf616567b81b09a8366f192e72d712f; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/\nsession_id_e=4c847ae529d2eff83be4d19d34f84fe5; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/; domain=.zlon12.at\nconnecting_hash_lite_version=1787140366; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/; domain=.zlon12.at\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"tor_scheme_id","value":"1787243651","quoted":false,"path":"/","expires":"2027-08-19T11:52:46Z","raw_expires":"Thu, 19 Aug 2027 11:52:46 GMT","max_age":31535999,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"tor_scheme_id=1787243651; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/"},{"name":"tor_port","value":"9352","quoted":false,"path":"/","expires":"2027-08-19T11:52:46Z","raw_expires":"Thu, 19 Aug 2027 11:52:46 GMT","max_age":31535999,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"tor_port=9352; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/"},{"name":"session_id","value":"fbf616567b81b09a8366f192e72d712f","quoted":false,"path":"/","expires":"2027-08-19T11:52:46Z","raw_expires":"Thu, 19 Aug 2027 11:52:46 GMT","max_age":31535999,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"session_id=fbf616567b81b09a8366f192e72d712f; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/"},{"name":"session_id_e","value":"4c847ae529d2eff83be4d19d34f84fe5","quoted":false,"path":"/","domain":".zlon12.at","expires":"2027-08-19T11:52:46Z","raw_expires":"Thu, 19 Aug 2027 11:52:46 GMT","max_age":31535999,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"session_id_e=4c847ae529d2eff83be4d19d34f84fe5; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/; domain=.zlon12.at"},{"name":"connecting_hash_lite_version","value":"1787140366","quoted":false,"path":"/","domain":".zlon12.at","expires":"2027-08-19T11:52:46Z","raw_expires":"Thu, 19 Aug 2027 11:52:46 GMT","max_age":31535999,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"connecting_hash_lite_version=1787140366; expires=Thu, 19 Aug 2027 11:52:46 GMT; Max-Age=31535999; path=/; domain=.zlon12.at"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":910,"size_decoded":1463,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"adbcdc8ba71e5ee18e4077e96ba13ead","sha1":"37cb11d6e172944fc2eb3b5ac95d099e520f9334","sha256":"2877a7610dc7cd59db30b78f80cdba6920ead06e4f4594222a2d05728a539c7f","sha512":"54f0ad7e933ea807acd1424fc7dcc7e0d9ff36bc6eea4b1627070af9107609027624a1800ae508b70e3b0b3025a6aa30fa73fdeebfc52934c12d53f370657bff","ssdeep":"","tlshash":"c111c006dc82cc64c1528672e8f6f5198469d5968348cccca1c9a43fc9e0fc58ba63dc","first_seen":"2026-08-19T11:53:13.970672Z","last_seen":"2026-08-19T11:53:13.970672Z","times_seen":1,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zlon12.at/js/connect.min.js?2","fqdn":"zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zlon12.at/","date":"2026-08-19T11:52:47.244Z","timestamp":1787140367244,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /js/connect.min.js?2 HTTP/1.1\r\nHost: zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://zlon12.at/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl; tor_scheme_id=1787243651; tor_port=9352; session_id=fbf616567b81b09a8366f192e72d712f; session_id_e=4c847ae529d2eff83be4d19d34f84fe5; connecting_hash_lite_version=1787140366\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T17:30:42.653402Z","times_seen":17995340,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zlon12.at/","fqdn":"zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-19T11:52:47.362Z","timestamp":1787140367362,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl; tor_scheme_id=1787243651; tor_port=9352; session_id=fbf616567b81b09a8366f192e72d712f; session_id_e=4c847ae529d2eff83be4d19d34f84fe5; connecting_hash_lite_version=1787140366; connecting_hash=6ad708a8b2e88cb87b76b1445e3bd92c; onion_server_id=9; session_temp_active=1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Wed, 19 Aug 2026 11:52:47 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nlocation: https://captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T17:30:42.653402Z","times_seen":17995340,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.zlon12.at/fonts/inter/inter-UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"captcha.zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/","date":"2026-08-19T11:52:47.522Z","timestamp":1787140367522,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET /fonts/inter/inter-UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: captcha.zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://captcha.zlon12.at/fonts/inter.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl; session_id_e=4c847ae529d2eff83be4d19d34f84fe5; connecting_hash_lite_version=1787140366; session_temp_active=1; tor_scheme_id=1788056851; tor_port=9331; session_id=7d2bb0b60dc9c5b5ebb4f202a1f08f9a\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 19 Aug 2026 11:52:47 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48532\r\nlast-modified: Fri, 24 Jul 2026 02:33:38 GMT\r\netag: \"6a62cf02-bd94\"\r\nexpires: Fri, 18 Sep 2026 11:52:47 GMT\r\ncache-control: max-age=2592000, public, max-age=2592000\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48532,"size_decoded":49053,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-20T17:30:42.533407Z","times_seen":262322,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"captcha.zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zlon12.at/?from_host=kra54.gl","fqdn":"zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-19T11:52:46.845Z","timestamp":1787140366845,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET /?from_host=kra54.gl HTTP/1.1\r\nHost: zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Wed, 19 Aug 2026 11:52:46 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nset-cookie: http_refererq2=https%3A%2F%2Fkra54.gl; expires=Wed, 19 Aug 2026 12:52:46 GMT; Max-Age=3600; path=/; domain=.zlon12.at\r\nlocation: /\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"http_refererq2","value":"https%3A%2F%2Fkra54.gl","quoted":false,"path":"/","domain":".zlon12.at","expires":"2026-08-19T12:52:46Z","raw_expires":"Wed, 19 Aug 2026 12:52:46 GMT","max_age":3600,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"http_refererq2=https%3A%2F%2Fkra54.gl; expires=Wed, 19 Aug 2026 12:52:46 GMT; Max-Age=3600; path=/; domain=.zlon12.at"}],"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T17:30:42.653402Z","times_seen":17995340,"resource_available":true,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":68,"connect":14,"send":0,"wait":23,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zlon12.at/","fqdn":"zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-19T11:52:47.326Z","timestamp":1787140367326,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl; tor_scheme_id=1787243651; tor_port=9352; session_id=fbf616567b81b09a8366f192e72d712f; session_id_e=4c847ae529d2eff83be4d19d34f84fe5; connecting_hash_lite_version=1787140366; connecting_hash=6ad708a8b2e88cb87b76b1445e3bd92c; onion_server_id=9\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Wed, 19 Aug 2026 11:52:47 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nset-cookie: proxy_cf_session_id=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; domain=.zlon12.at\nsession_temp_active=1; expires=Wed, 19 Aug 2026 13:22:47 GMT; Max-Age=5400; path=/; domain=.zlon12.at\r\nlocation: /\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"proxy_cf_session_id","value":"deleted","quoted":false,"path":"/","domain":".zlon12.at","expires":"1970-01-01T00:00:01Z","raw_expires":"Thu, 01 Jan 1970 00:00:01 GMT","max_age":-1,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"proxy_cf_session_id=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; domain=.zlon12.at"},{"name":"session_temp_active","value":"1","quoted":false,"path":"/","domain":".zlon12.at","expires":"2026-08-19T13:22:47Z","raw_expires":"Wed, 19 Aug 2026 13:22:47 GMT","max_age":5400,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"session_temp_active=1; expires=Wed, 19 Aug 2026 13:22:47 GMT; Max-Age=5400; path=/; domain=.zlon12.at"}],"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T17:30:42.653402Z","times_seen":17995340,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.zlon12.at/fonts/inter/inter-UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"captcha.zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/","date":"2026-08-19T11:52:47.524Z","timestamp":1787140367524,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET /fonts/inter/inter-UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: captcha.zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://captcha.zlon12.at/fonts/inter.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl; session_id_e=4c847ae529d2eff83be4d19d34f84fe5; connecting_hash_lite_version=1787140366; session_temp_active=1; tor_scheme_id=1788056851; tor_port=9331; session_id=7d2bb0b60dc9c5b5ebb4f202a1f08f9a\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 19 Aug 2026 11:52:47 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 18720\r\nlast-modified: Fri, 24 Jul 2026 02:33:37 GMT\r\netag: \"6a62cf01-4920\"\r\nexpires: Fri, 18 Sep 2026 11:52:47 GMT\r\ncache-control: max-age=2592000, public, max-age=2592000\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18720,"size_decoded":19241,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-08-20T15:31:31.256927Z","times_seen":11705,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"captcha.zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/","fqdn":"captcha.zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-19T11:52:47.399Z","timestamp":1787140367399,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET /?ref=zlon12.at\u0026shop2go=/ HTTP/1.1\r\nHost: captcha.zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl; session_id_e=4c847ae529d2eff83be4d19d34f84fe5; connecting_hash_lite_version=1787140366; session_temp_active=1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 19 Aug 2026 11:52:47 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 13340\r\nset-cookie: tor_scheme_id=1788056851; expires=Thu, 19 Aug 2027 11:52:47 GMT; Max-Age=31536000; path=/\ntor_port=9331; expires=Thu, 19 Aug 2027 11:52:47 GMT; Max-Age=31536000; path=/\nsession_id=7d2bb0b60dc9c5b5ebb4f202a1f08f9a; expires=Thu, 19 Aug 2027 11:52:47 GMT; Max-Age=31536000; path=/\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"tor_scheme_id","value":"1788056851","quoted":false,"path":"/","expires":"2027-08-19T11:52:47Z","raw_expires":"Thu, 19 Aug 2027 11:52:47 GMT","max_age":31536000,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"tor_scheme_id=1788056851; expires=Thu, 19 Aug 2027 11:52:47 GMT; Max-Age=31536000; path=/"},{"name":"tor_port","value":"9331","quoted":false,"path":"/","expires":"2027-08-19T11:52:47Z","raw_expires":"Thu, 19 Aug 2027 11:52:47 GMT","max_age":31536000,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"tor_port=9331; expires=Thu, 19 Aug 2027 11:52:47 GMT; Max-Age=31536000; path=/"},{"name":"session_id","value":"7d2bb0b60dc9c5b5ebb4f202a1f08f9a","quoted":false,"path":"/","expires":"2027-08-19T11:52:47Z","raw_expires":"Thu, 19 Aug 2027 11:52:47 GMT","max_age":31536000,"secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"session_id=7d2bb0b60dc9c5b5ebb4f202a1f08f9a; expires=Thu, 19 Aug 2027 11:52:47 GMT; Max-Age=31536000; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20304,"size_decoded":14061,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15076)","md5":"9bc4637c2a80a55a0078389d80507558","sha1":"d1d05e0cd887e3fb5e9fa211b86f928a93247543","sha256":"378694402eda2d68cfe9b2d36b083c372a84600b99d528c16f39aecbbbfb48da","sha512":"a4ee45782aa9f78b2eaa627acb69e7624b53be5ce058b1bc01e92f011ba605e1b921253b87ca5e3c2624392e8e932041f9bb98f17335f088df7212023a1455fc","ssdeep":"384:M1n1FQ/mfMKsalJKuJP5s422PgyNS2b3v1qvcFtXt:y2/mUKR/P5jj4yNSg/EvcFxt","tlshash":"a492bf674aeb25402906a4b57b9d5ba52adc8163c207c9b83e4c1fd57fcb9d801b3f4c","first_seen":"2026-08-08T10:13:58.379403Z","last_seen":"2026-08-19T11:53:13.976779Z","times_seen":2,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":0,"dns":18,"connect":14,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"captcha.zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.zlon12.at/fonts/inter.css","fqdn":"captcha.zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/","date":"2026-08-19T11:52:47.494Z","timestamp":1787140367494,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET /fonts/inter.css HTTP/1.1\r\nHost: captcha.zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl; session_id_e=4c847ae529d2eff83be4d19d34f84fe5; connecting_hash_lite_version=1787140366; session_temp_active=1; tor_scheme_id=1788056851; tor_port=9331; session_id=7d2bb0b60dc9c5b5ebb4f202a1f08f9a\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 19 Aug 2026 11:52:47 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Jul 2026 02:33:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a62cf04-2ec2\"\r\nexpires: Fri, 18 Sep 2026 11:52:47 GMT\r\ncache-control: max-age=2592000, public, max-age=2592000\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11970,"size_decoded":1309,"mime_type":"text/css","magic":"ASCII text","md5":"ceef338996de46e3f2de6f60f0d00eb6","sha1":"a221c8ee78df374632543ccd96077e4fe87d5059","sha256":"51bd1e2968b9de62f83bc502415c7007754cdc4329ef2015f1da75a4efcac50c","sha512":"cd42b57d5271a83846682b4cc7c765f18f5d8fead34b2ec6c7205158b693f1486c0404cf484510b62da18f38fd7c413e4e3677e400e42966b5ec1033481937e0","ssdeep":"192:wTAva03lhfihTN27034MfDyTOVU03/Tf8PTrsd03iWflITEze03R1fGL:EgEp2SkbyEs","tlshash":"f0327a80082b660097a71cc377de3f3a7d9d6494a085d1792ff90c859cefda642b875e","first_seen":"2026-07-25T03:02:44.971457Z","last_seen":"2026-08-20T13:05:56.636204Z","times_seen":84,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"captcha.zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.zlon12.at/css/normalize.css","fqdn":"captcha.zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/","date":"2026-08-19T11:52:47.495Z","timestamp":1787140367495,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET /css/normalize.css HTTP/1.1\r\nHost: captcha.zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl; session_id_e=4c847ae529d2eff83be4d19d34f84fe5; connecting_hash_lite_version=1787140366; session_temp_active=1; tor_scheme_id=1788056851; tor_port=9331; session_id=7d2bb0b60dc9c5b5ebb4f202a1f08f9a\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 19 Aug 2026 11:52:47 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Jul 2026 01:53:39 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a62c5a3-116d\"\r\nexpires: Fri, 18 Sep 2026 11:52:47 GMT\r\ncache-control: max-age=2592000, public, max-age=2592000\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4461,"size_decoded":1892,"mime_type":"text/css","magic":"ASCII text","md5":"aab74d6ca10a0902b9fac0e304c4be13","sha1":"7cc28584e1cd4acf258f32322b198faa19e2c47c","sha256":"6b1e238b3810eef313f24f098db4d880175b3ed1168f0c9faaaff9b53089c2fa","sha512":"8908ebef958dec57ec62f0841a1631bfa992ce53e13a55fe00686f1c3ecabedfb662d50d5e567c69c03b0470de149c2bddeaa1a9f9903cfce4bdccfc5ffe1d27","ssdeep":"48:z2Gaml89fIcJq7e/BQLQ1nrnccRjXdmnm/IZvJzXsacPaQfk:KM89fI6z/tTnWHO1c","tlshash":"549151651b604f11522b4e38339beb1533188233895d38ececa199edcf8675bd6d17ca","first_seen":"2023-04-18T10:14:13Z","last_seen":"2026-08-20T13:05:56.637621Z","times_seen":1347,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"captcha.zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.zlon12.at/favicon.ico","fqdn":"captcha.zlon12.at","domain":"zlon12.at","tld":"at"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/","date":"2026-08-19T11:52:47.518Z","timestamp":1787140367518,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon12.at","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 23:18:57 GMT","end":"Fri, 06 Nov 2026 23:18:56 GMT"},"fingerprint":{"sha1":"11:E9:0D:7A:96:B9:D9:4D:3C:D9:6F:90:E6:78:01:DE:1B:19:42:4F","sha256":"45:A1:84:A7:21:4D:53:E4:69:B8:BE:A2:5F:C2:9E:0E:69:1E:CC:A8:52:D9:4D:50:7B:8B:D0:2A:26:77:08:D4"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: captcha.zlon12.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://captcha.zlon12.at/?ref=zlon12.at\u0026shop2go=/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra54.gl; session_id_e=4c847ae529d2eff83be4d19d34f84fe5; connecting_hash_lite_version=1787140366; session_temp_active=1; tor_scheme_id=1788056851; tor_port=9331; session_id=7d2bb0b60dc9c5b5ebb4f202a1f08f9a\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 19 Aug 2026 11:52:47 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 598\r\nlast-modified: Wed, 21 Jan 2026 20:51:55 GMT\r\netag: \"256-648ec1827b0c0\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=63072000\r\nserver: nginx, nginx\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: SAMEORIGIN, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":598,"size_decoded":1074,"mime_type":"image/vnd.microsoft.icon","magic":"PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced","md5":"88dce50c34a848e75b6c7d916711e6b9","sha1":"0355f55c57c14900477cc886f3345b1e898fe28e","sha256":"4f0b7e5217318eedc1b42ca1ce5e128c649c97082912f1d800eec1325207ad96","sha512":"f6e0828ce51c9e2cb462b4884f01a5fb7083e4f26eeea1b596c5d04144b9226efb62347199546ce81e0473d97231cb1f6468ccc94e620cf83ffd9035fb63eed5","ssdeep":"","tlshash":"faf00ce3e838f489c98e2ca222911201da7585a723800819b6fac008ac20b885933f92","first_seen":"2023-05-10T12:46:36Z","last_seen":"2026-08-20T13:05:56.635553Z","times_seen":3836,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"captcha.zlon12.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}