{"report_id":"62db81d4-430a-4f3c-875f-807c311e1626","version":0,"status":"done","tags":[],"date":"2026-09-25T05:44:03Z","url":{"schema":"http","addr":"rhliey.com/","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":0,"asn":48753,"as":"Ava Host Srl","country":"Moldova","country_code":"MD"},"final":{"url":{"schema":"https","addr":"rhliey.com/#/","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"title":"Amazon Refund Check","dom":{"size":14101,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8139)","md5":"85a7e673e646b5ac8ad71d6ab2709125","sha1":"77c2b33fdbf4c8de6c2facef1775b4e86cdccedc","sha256":"4347c0952c126c1a3347c3d28df088c9d88fa29a7590d96dbbf6b015df602db4","sha512":"4fd6cebc1749d4059b27fd9d97a765e1a150be681c92b1b17ba43cbe9bc6a5165575ae20ed2139f73cb0665415ab6455131f83081fa3c936acbea7316ad956e6","ssdeep":"384:zYuYFItHYGZ/HuTNWUrGlVBz/2oPAxpKspW6YEJJS+:JdxGGlVtaPpW6YEJJS+","tlshash":"41523021b04d38a63a37a3c0f8631f3914f1f30ad26b8c9526f94aa33ec7d756493659","dom_hash":"domhash24fc48aab9b2913233a9fe67bef3c029","first_seen":"2026-09-25T05:44:08.392886Z","last_seen":"2026-09-25T05:44:08.392886Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rhliey.com/","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":0,"asn":48753,"as":"Ava Host Srl","country":"Moldova","country_code":"MD"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-30T05:44:03Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"m6-211026f8a25b42c08fc190458268b30e.ecs.us-east-2.on.aws","ip":{"addr":"18.119.5.249","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2021-09-29","domain_rank":0,"first_seen":"2026-06-12T03:55:45.306336Z","last_seen":"2026-09-21T13:30:39.033059Z","alert_count":0,"request_count":1,"received_data":349,"sent_data":521,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"rhliey.com","ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"domain_registered":"2026-09-21","domain_rank":0,"first_seen":"2026-09-24T01:05:51.385518Z","last_seen":"2026-09-24T01:05:51.385518Z","alert_count":27,"request_count":9,"received_data":378352,"sent_data":4224,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"connect.facebook.net","ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"domain_registered":"2004-04-01","domain_rank":1088,"first_seen":"2012-05-22T02:51:28Z","last_seen":"2026-09-23T07:33:10.772273Z","alert_count":0,"request_count":2,"received_data":927036,"sent_data":2181,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.174.83.217","port":443,"asn":0,"as":"","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-09-19T06:40:26.980703Z","alert_count":0,"request_count":1,"received_data":577,"sent_data":545,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"connect.facebook.net/en_US/fbevents.js","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"26406ac97f31f41f41879a04a2fba138","sha1":"a7d88b920d6f5a5f02879b7a87e4ff069acbdd82","sha256":"407b4a73534f3738e40e0a9dde6be862360ab81a37b11318f6815b892e043f8c","sha512":"e6c7b5130cf4ae0b9113fa7ff8aea7bc98f474425ad7aa5e317861be26b409cfed9dbe31fcd1d3086aa0013c639519ddf3b0a0c203a4b47bfec5bdf6daaa399c","ssdeep":"6144:i7gApToGDlZ6BYnTD+4Yd0E+brBLA30ru/dK0rZeP+b0mK8CLv+z1Y+COBfvBkn:wnAEmdBb0mK8CL7uKn","tlshash":"6594e7c9b1e5b0a107b7796c966f800772bbd5a238ccc960e51dedc8297c49e4133eb6","size":424690,"data":"","first_seen":"2026-09-23T19:32:02.816191Z","last_seen":"2026-09-26T13:25:03.88933Z","times_seen":87,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"connect.facebook.net/signals/config/1763739624747610?v=2.9.408\u0026r=stable\u0026domain=rhliey.com\u0026hme=f9ad993bedcdbb3fffd47532e189463ba18afe816a0bd364070ce559e4a6ac26\u0026ex_m=117%2C239%2C169%2C27%2C81%2C82%2C160%2C77%2C76%2C11%2C179%2C101%2C20%2C152%2C140%2C46%2C84%2C89%2C148%2C174%2C181%2C8%2C4%2C5%2C7%2C6%2C3%2C102%2C114%2C32%2C17%2C31%2C18%2C33%2C34%2C35%2C37%2C55%2C161%2C86%2C125%2C22%2C24%2C51%2C47%2C49%2C48%2C94%2C103%2C107%2C123%2C159%2C162%2C53%2C124%2C29%2C26%2C132%2C78%2C43%2C164%2C163%2C165%2C156%2C154%2C30%2C42%2C66%2C122%2C176%2C79%2C21%2C127%2C92%2C75%2C23%2C96%2C97%2C129%2C95%2C150%2C149%2C153%2C108%2C175%2C178%2C41%2C56%2C126%2C54%2C183%2C109%2C182%2C208%2C253%2C83%2C267%2C266%2C265%2C14%2C25%2C28%2C40%2C62%2C116%2C68%2C10%2C72%2C110%2C111%2C112%2C118%2C143%2C38%2C36%2C145%2C146%2C147%2C142%2C141%2C170%2C85%2C173%2C171%2C172%2C57%2C67%2C136%2C19%2C177%2C52%2C316%2C317%2C318%2C315%2C331%2C356%2C246%2C235%2C69%2C236%2C234%2C359%2C350%2C59%2C247%2C120%2C144%2C91%2C134%2C61%2C133%2C139%2C138%2C65%2C73%2C71%2C166%2C87%2C88%2C128%2C44%2C39%2C60%2C63%2C113%2C180%2C1%2C137%2C16%2C135%2C12%2C2%2C64%2C104%2C15%2C74%2C70%2C131%2C100%2C99%2C185%2C186%2C105%2C106%2C9%2C115%2C184%2C58%2C157%2C98%2C90%2C80%2C130%2C119%2C167%2C50%2C158%2C0%2C93%2C151%2C155%2C168%2C45%2C121%2C13%2C187","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"f69fd1274a57fa72d81d25d3a8c3e515","sha1":"0cbf2c455957809e1608217c8a5f328bf6cb013f","sha256":"cbc63156eacff2f9bb6bcb55b45603812e347da7a1e303859cfaabd44e7bca18","sha512":"af75e35bfee0b2b9431f0cdaf03afdbccc02c0c39dd5d56753f2dd42da1083113841f4de90c56e6e0e70368df1a760a6671401626e9a4ca6d3b402bddaa0ec22","ssdeep":"6144:OHNFYp68joi0lj6fYfXYXqRbhixwz0wDPJS5CfIFijsu2:KNFGjoi0IqsiVi+z0wDPJS5Cq","tlshash":"08b45cc4b6a568621be67568adbf340bb174445278acc820eb6cdcca3e791494133f7f","size":494366,"data":"","first_seen":"2026-09-25T05:32:57.206301Z","last_seen":"2026-09-25T05:44:08.39663Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"2d6a78ab53be5bc4a6d37c42e772760b","sha1":"32f076aec75ed16ecb874b48f3d3178d4cb46c81","sha256":"58a225a1053179435184af7a71e45ccce47bc71b3d1bbbf14cbf7135f24f4cf0","sha512":"4bb08b63cfb3a7d5c1f089aea9e41ca1094156c40d54d2d90a9a8ee123e58c35dce223748e88feda2cf532357deb184b1387b3045207766812025c714622ed45","ssdeep":"","tlshash":"26c012545838540200f820b8125f6617b4959a3b835c54e0d114ad7c09b814745e9963","size":183,"data":"","first_seen":"2026-08-10T14:47:35.81771Z","last_seen":"2026-09-25T06:13:03.587191Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"961e7595024d40c90f464d70c3a5e82b","sha1":"85c527bb76648360756b513c03eb19aaeceff79c","sha256":"85db212b3ea68764f20ff8ae4eeb290337dc9fd7396d03236648b7064066d27f","sha512":"3deade2182eefd1a2f91d83c61d52f49330489e6c8ded5cbd5ca1f0598e4f6519a08dfeb006256e83ea7544555562b77b724647bc2fc009fb5922a1e57e6729e","ssdeep":"","tlshash":"fef05c5c3c62f82337f93b34c223af2f37a21300348354218a8acc2478248ca284ac8e","size":477,"data":"","first_seen":"2026-09-21T13:30:47.457217Z","last_seen":"2026-09-25T06:13:03.587893Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/assets/index-BO0tuFoh.js","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"a2a0f263c469f32fb80a9e43da029855","sha1":"2ac253325b8676f08783b36201b9040906843f86","sha256":"e411e75c518ebf42486ec3cd5ebecebc779cd237bc7f865000872cdbebf5a900","sha512":"1122bab4a69710da15112453539e1ac5ff1924d01791fc4beaceb1b88f4f35c7c3a2f1a87afa590095b4286ad91c80ed14d749f52a5bebe849d19619ea635d88","ssdeep":"6144:lfcU6MPOn4FR2Fn+5iznhWTmycta0Vehy96RZQozxcR8HH:lXR21+5iITzcta0Vehk6RZQVG","tlshash":"e23407e93282b03243e609f6507b0506f2392955784e94d4f16ceceb3d7785a92bbf6c","size":231430,"data":"","first_seen":"2026-09-21T13:30:47.452575Z","last_seen":"2026-09-25T06:13:03.580847Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/assets/pages-welcome-hub.DJR7x5Kh.js","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"43750016b5b7d91bf5e3c481858db9ff","sha1":"8f33f296f3b664990f042c03f6c96a0ff7f1a9ff","sha256":"daa9350d8d046412ab727d0480f52610b2fd57afaa3ac79ab0d5184752235fc7","sha512":"94aa7eb24cc5fa6b6060ea1ee6d6a4ed3dd84734914d1a0bf9457eb91e1bbe30f390dbdca9a6bfae2c7894bc95269802436642c3173fd44c6f9aa4a64f8e1ab3","ssdeep":"192:QTUPniszX0fplTIlZPy0H5RrszntsIHZlRurZLDhRK25Ytb+a0b:c6niwmlTIzq0HPWqLDXK2abpy","tlshash":"fd02958a791b8b3e4a67422a76466c1822593fff82580d1345f8cd3527e4ebc3737a5c","size":8305,"data":"","first_seen":"2026-09-21T13:30:47.446997Z","last_seen":"2026-09-25T06:13:03.582582Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/assets/_plugin-vue_export-helper.DlAUqK2U.js","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"25e3a5dcaf00fb2b1ba0c8ecea6d2560","sha1":"7850b3fd4aeb69387bdb5a60025d15c41351d5eb","sha256":"cb85b0f263dbe24e857338301c0627076592e9f1f1a5662929f86d2c126444aa","sha512":"2e5cc9b53d5641147f68c73e5db0442d93fb6a64da45cfc051da5550a2fad07e912e651bd730e54325ef74eb706be0c5df612355c1dca144ab6e9cc8c4ecc73b","ssdeep":"","tlshash":"1fb012c81cc3e078939818d47738c15844380448310742b0808c0943e2c20809797c1d","size":91,"data":"","first_seen":"2023-03-08T16:39:49Z","last_seen":"2026-09-26T11:15:11.851714Z","times_seen":26818,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rhliey.com/assets/pages-welcome-hub.DJR7x5Kh.js","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:23.900Z","timestamp":1790315003900,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhliey.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Tue, 22 Sep 2026 11:00:00 GMT","end":"Mon, 21 Dec 2026 10:59:59 GMT"},"fingerprint":{"sha1":"9D:E0:92:F5:EF:05:57:4A:19:2C:49:D3:73:CD:16:71:03:1F:AC:E7","sha256":"55:96:D1:EE:4F:0E:0D:FD:41:CB:47:DE:80:4A:FA:64:61:BA:7C:0A:C0:4E:10:FF:9A:BC:F2:BD:34:CE:76:80"}}},"request":{"raw":"GET /assets/pages-welcome-hub.DJR7x5Kh.js HTTP/1.1\r\nHost: rhliey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rhliey.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:23 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Sep 2026 12:14:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27115-2071\"\r\nexpires: Fri, 25 Sep 2026 17:43:23 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8305,"size_decoded":3931,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8290)","md5":"43750016b5b7d91bf5e3c481858db9ff","sha1":"8f33f296f3b664990f042c03f6c96a0ff7f1a9ff","sha256":"daa9350d8d046412ab727d0480f52610b2fd57afaa3ac79ab0d5184752235fc7","sha512":"94aa7eb24cc5fa6b6060ea1ee6d6a4ed3dd84734914d1a0bf9457eb91e1bbe30f390dbdca9a6bfae2c7894bc95269802436642c3173fd44c6f9aa4a64f8e1ab3","ssdeep":"192:QTUPniszX0fplTIlZPy0H5RrszntsIHZlRurZLDhRK25Ytb+a0b:c6niwmlTIzq0HPWqLDXK2abpy","tlshash":"fd02958a791b8b3e4a67422a76466c1822593fff82580d1345f8cd3527e4ebc3737a5c","first_seen":"2026-09-21T13:30:47.446997Z","last_seen":"2026-09-25T06:13:03.582582Z","times_seen":10,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/static/site-icon.png","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:24.065Z","timestamp":1790315004065,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhliey.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Tue, 22 Sep 2026 11:00:00 GMT","end":"Mon, 21 Dec 2026 10:59:59 GMT"},"fingerprint":{"sha1":"9D:E0:92:F5:EF:05:57:4A:19:2C:49:D3:73:CD:16:71:03:1F:AC:E7","sha256":"55:96:D1:EE:4F:0E:0D:FD:41:CB:47:DE:80:4A:FA:64:61:BA:7C:0A:C0:4E:10:FF:9A:BC:F2:BD:34:CE:76:80"}}},"request":{"raw":"GET /static/site-icon.png HTTP/1.1\r\nHost: rhliey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rhliey.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:24 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:13:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27101-1226e\"\r\nexpires: Sun, 25 Oct 2026 05:43:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74350,"size_decoded":73324,"mime_type":"image/png","magic":"PNG image data, 720 x 589, 8-bit/color RGBA, non-interlaced","md5":"4dd91911b613e8a47eefa9744c0eea7c","sha1":"3fdb6505a6674b07a69e7f200f0ffe69c51a8523","sha256":"309d3df30f5aaf77d8c6ed72ce863636634b06192254bc40b0cbed046f0c6020","sha512":"ecfc90f19961e4c2307e9074fd67236bc5c643c6784574bb74533198cf1914255a541b1b6af2fbb2eb0d51fc5f4a15e021e6672afdf6ed1d5470871d7a521ec9","ssdeep":"1536:uPYpDfeCwwCijjJ2UrjO+GEhPIYpoFjpotmNk1ok8Tm1mNN8:uOfeCNrjjsoORjEoppImNk1WmAb8","tlshash":"f0730203db018c5fd6a48d3a04d705897436eca748e6d2a47316fa470afad690cbbf8d","first_seen":"2026-06-24T12:29:43.693944Z","last_seen":"2026-09-25T06:13:03.584044Z","times_seen":56,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"connect.facebook.net/signals/config/1763739624747610?v=2.9.408\u0026r=stable\u0026domain=rhliey.com\u0026hme=f9ad993bedcdbb3fffd47532e189463ba18afe816a0bd364070ce559e4a6ac26\u0026ex_m=117%2C239%2C169%2C27%2C81%2C82%2C160%2C77%2C76%2C11%2C179%2C101%2C20%2C152%2C140%2C46%2C84%2C89%2C148%2C174%2C181%2C8%2C4%2C5%2C7%2C6%2C3%2C102%2C114%2C32%2C17%2C31%2C18%2C33%2C34%2C35%2C37%2C55%2C161%2C86%2C125%2C22%2C24%2C51%2C47%2C49%2C48%2C94%2C103%2C107%2C123%2C159%2C162%2C53%2C124%2C29%2C26%2C132%2C78%2C43%2C164%2C163%2C165%2C156%2C154%2C30%2C42%2C66%2C122%2C176%2C79%2C21%2C127%2C92%2C75%2C23%2C96%2C97%2C129%2C95%2C150%2C149%2C153%2C108%2C175%2C178%2C41%2C56%2C126%2C54%2C183%2C109%2C182%2C208%2C253%2C83%2C267%2C266%2C265%2C14%2C25%2C28%2C40%2C62%2C116%2C68%2C10%2C72%2C110%2C111%2C112%2C118%2C143%2C38%2C36%2C145%2C146%2C147%2C142%2C141%2C170%2C85%2C173%2C171%2C172%2C57%2C67%2C136%2C19%2C177%2C52%2C316%2C317%2C318%2C315%2C331%2C356%2C246%2C235%2C69%2C236%2C234%2C359%2C350%2C59%2C247%2C120%2C144%2C91%2C134%2C61%2C133%2C139%2C138%2C65%2C73%2C71%2C166%2C87%2C88%2C128%2C44%2C39%2C60%2C63%2C113%2C180%2C1%2C137%2C16%2C135%2C12%2C2%2C64%2C104%2C15%2C74%2C70%2C131%2C100%2C99%2C185%2C186%2C105%2C106%2C9%2C115%2C184%2C58%2C157%2C98%2C90%2C80%2C130%2C119%2C167%2C50%2C158%2C0%2C93%2C151%2C155%2C168%2C45%2C121%2C13%2C187","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:24.152Z","timestamp":1790315004152,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Sat, 04 Jul 2026 00:00:00 GMT","end":"Fri, 02 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"0D:4B:2D:74:CE:4F:11:27:59:D3:3F:7F:FC:14:31:FD:42:16:42:87","sha256":"69:B6:EF:4A:C8:B6:9B:9A:AD:C0:AE:E4:96:EC:7A:89:07:20:FF:6D:B3:70:C8:19:F8:B6:6B:9A:5F:1D:A2:E2"}}},"request":{"raw":"GET /signals/config/1763739624747610?v=2.9.408\u0026r=stable\u0026domain=rhliey.com\u0026hme=f9ad993bedcdbb3fffd47532e189463ba18afe816a0bd364070ce559e4a6ac26\u0026ex_m=117%2C239%2C169%2C27%2C81%2C82%2C160%2C77%2C76%2C11%2C179%2C101%2C20%2C152%2C140%2C46%2C84%2C89%2C148%2C174%2C181%2C8%2C4%2C5%2C7%2C6%2C3%2C102%2C114%2C32%2C17%2C31%2C18%2C33%2C34%2C35%2C37%2C55%2C161%2C86%2C125%2C22%2C24%2C51%2C47%2C49%2C48%2C94%2C103%2C107%2C123%2C159%2C162%2C53%2C124%2C29%2C26%2C132%2C78%2C43%2C164%2C163%2C165%2C156%2C154%2C30%2C42%2C66%2C122%2C176%2C79%2C21%2C127%2C92%2C75%2C23%2C96%2C97%2C129%2C95%2C150%2C149%2C153%2C108%2C175%2C178%2C41%2C56%2C126%2C54%2C183%2C109%2C182%2C208%2C253%2C83%2C267%2C266%2C265%2C14%2C25%2C28%2C40%2C62%2C116%2C68%2C10%2C72%2C110%2C111%2C112%2C118%2C143%2C38%2C36%2C145%2C146%2C147%2C142%2C141%2C170%2C85%2C173%2C171%2C172%2C57%2C67%2C136%2C19%2C177%2C52%2C316%2C317%2C318%2C315%2C331%2C356%2C246%2C235%2C69%2C236%2C234%2C359%2C350%2C59%2C247%2C120%2C144%2C91%2C134%2C61%2C133%2C139%2C138%2C65%2C73%2C71%2C166%2C87%2C88%2C128%2C44%2C39%2C60%2C63%2C113%2C180%2C1%2C137%2C16%2C135%2C12%2C2%2C64%2C104%2C15%2C74%2C70%2C131%2C100%2C99%2C185%2C186%2C105%2C106%2C9%2C115%2C184%2C58%2C157%2C98%2C90%2C80%2C130%2C119%2C167%2C50%2C158%2C0%2C93%2C151%2C155%2C168%2C45%2C121%2C13%2C187 HTTP/1.1\r\nHost: connect.facebook.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rhliey.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: application/x-javascript; charset=utf-8\r\ntiming-allow-origin: *\r\nreporting-endpoints: coop_report=\"https://www.facebook.com/browser_reporting/coop/?minimize=0\", coep_report=\"https://www.facebook.com/browser_reporting/coep/?minimize=0\", permissions_policy=\"https://www.facebook.com/ajax/browser_error_reports/\"\r\nreport-to: {\"max_age\":2592000,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coop\\/?minimize=0\"}],\"group\":\"coop_report\",\"include_subdomains\":true}, {\"max_age\":86400,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coep\\/?minimize=0\"}],\"group\":\"coep_report\"}, {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ncontent-security-policy: default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-zaiGiF34';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c\u0026minimize=0;\r\nx-frame-options: DENY\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-embedder-policy-report-only: require-corp;report-to=\"coep_report\"\r\ncross-origin-opener-policy: same-origin-allow-popups\r\npragma: public\r\ncache-control: public, max-age=1200\r\nexpires: Sat, 01 Jan 2000 00:00:00 GMT\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\norigin-agent-cluster: ?1\r\nstrict-transport-security: max-age=31536000; preload; includeSubDomains\r\nx-fb-debug: 3FaW6Cf+g73Zgr+k32qOy7ECMQ7yBeOKGUBlgU/wWz6RVRnRmhTwxaA/3W+WYFtMf/7uzReqzJKuUblGc9vyOg==\r\ndate: Fri, 25 Sep 2026 05:43:24 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=20, rtx=0, c=118, mss=1232, tbw=122048, tp=107, tpl=0, uplat=199, ullat=0\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=3,i\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":494366,"size_decoded":142413,"mime_type":"application/x-javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (9907)","md5":"f69fd1274a57fa72d81d25d3a8c3e515","sha1":"0cbf2c455957809e1608217c8a5f328bf6cb013f","sha256":"cbc63156eacff2f9bb6bcb55b45603812e347da7a1e303859cfaabd44e7bca18","sha512":"af75e35bfee0b2b9431f0cdaf03afdbccc02c0c39dd5d56753f2dd42da1083113841f4de90c56e6e0e70368df1a760a6671401626e9a4ca6d3b402bddaa0ec22","ssdeep":"6144:OHNFYp68joi0lj6fYfXYXqRbhixwz0wDPJS5CfIFijsu2:KNFGjoi0IqsiVi+z0wDPJS5Cq","tlshash":"08b45cc4b6a568621be67568adbf340bb174445278acc820eb6cdcca3e791494133f7f","first_seen":"2026-09-25T05:32:57.206301Z","last_seen":"2026-09-25T05:44:08.39663Z","times_seen":2,"resource_available":true,"data":null}},"time_used":245,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":221,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.174.83.217","port":443,"asn":0,"as":"","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:26.833Z","timestamp":1790315006833,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Sun, 20 Sep 2026 00:00:00 GMT","end":"Tue, 06 Apr 2027 23:59:59 GMT"},"fingerprint":{"sha1":"4F:35:3A:96:51:3A:BA:A6:46:B8:B9:BC:97:39:74:7E:49:B4:6F:98","sha256":"F8:18:FA:28:6B:ED:A5:CC:73:11:D3:85:FB:0F:80:CA:B3:EF:76:89:C6:F1:62:90:E2:2C:5A:F5:E2:42:57:56"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rhliey.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:27 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Fri, 25 Sep 2026 15:43:27 GMT\r\ncache-control: max-age=36000\r\nset-cookie: __uni__uid=rBACaWq2Cf9NPbOKBEdqAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"__uni__uid","value":"rBACaWq2Cf9NPbOKBEdqAg==","quoted":false,"path":"/","domain":"dcloud.net.cn","raw_expires":"Thu, 31-Dec-37 23:55:55 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__uni__uid=rBACaWq2Cf9NPbOKBEdqAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":577,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-09-26T11:38:12.762392Z","times_seen":20566,"resource_available":false,"data":null}},"time_used":690,"timings":{"blocked":0,"dns":4,"connect":228,"send":0,"wait":226,"receive":0,"ssl":233},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-25T05:43:22.926Z","timestamp":1790315002926,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhliey.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Tue, 22 Sep 2026 11:00:00 GMT","end":"Mon, 21 Dec 2026 10:59:59 GMT"},"fingerprint":{"sha1":"9D:E0:92:F5:EF:05:57:4A:19:2C:49:D3:73:CD:16:71:03:1F:AC:E7","sha256":"55:96:D1:EE:4F:0E:0D:FD:41:CB:47:DE:80:4A:FA:64:61:BA:7C:0A:C0:4E:10:FF:9A:BC:F2:BD:34:CE:76:80"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rhliey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:23 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 22 Sep 2026 12:13:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab270fe-791\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1937,"size_decoded":1469,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"b25780b7eea53f4735511dc5eb9510a8","sha1":"710d467c623deefb078cc8ccaf7c4911b470613b","sha256":"3e983be4d67517e4e97f608fa637203539a09c8b5027b689fa8ff3d6548dfdef","sha512":"643c20c0a2bd73562546fbe503b1958868c315da014c6811cb738851b0ea3a82a5be13e318b55ac501d0e08cc77af77cefab9958048b3e0ee7406395acaa39a8","ssdeep":"","tlshash":"134186079c10e80762f41734a6a2f61922e5d72783899da4b4c9d03d9ed4bc64cebb6d","first_seen":"2026-09-21T13:30:47.445739Z","last_seen":"2026-09-25T06:13:03.585642Z","times_seen":10,"resource_available":true,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":7,"connect":54,"send":0,"wait":62,"receive":0,"ssl":74},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/static/entry/portal-brand-mark.png","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:24.100Z","timestamp":1790315004100,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhliey.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Tue, 22 Sep 2026 11:00:00 GMT","end":"Mon, 21 Dec 2026 10:59:59 GMT"},"fingerprint":{"sha1":"9D:E0:92:F5:EF:05:57:4A:19:2C:49:D3:73:CD:16:71:03:1F:AC:E7","sha256":"55:96:D1:EE:4F:0E:0D:FD:41:CB:47:DE:80:4A:FA:64:61:BA:7C:0A:C0:4E:10:FF:9A:BC:F2:BD:34:CE:76:80"}}},"request":{"raw":"GET /static/entry/portal-brand-mark.png HTTP/1.1\r\nHost: rhliey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rhliey.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:24 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:14:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab2711c-382a\"\r\nexpires: Sun, 25 Oct 2026 05:43:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14378,"size_decoded":14872,"mime_type":"image/png","magic":"PNG image data, 542 x 165, 8-bit colormap, non-interlaced","md5":"fadb8e5d1532ae95893aced1c6ee1822","sha1":"d6859963024cdfed23cbbfa3e393b2535afb6844","sha256":"66753e608935e672d8e6b9f1d5be8d8dae426b085589e4952b7f9f93f87a14fa","sha512":"c2ab4329a4a947affc2456278657a156c493b57232fdd7c16d1b94e29bc89946a0307e43f72f6430fb32e924453953be1f284ef5a606bfecb0b1ea48925cf4a0","ssdeep":"384:PIjHPNcsdyvnAMpBnQTiJ8fr5l8YSJov4Fpac2Ly:gjFck2nAMpBnSiJkl8YSU4Fn2+","tlshash":"1652cf2b184bc860ce5ba5a58227d71ef53c835c79d16026e60bec57cf84de12c0e393","first_seen":"2026-08-18T01:32:15.528002Z","last_seen":"2026-09-25T06:13:03.584906Z","times_seen":19,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"m6-211026f8a25b42c08fc190458268b30e.ecs.us-east-2.on.aws/events?cee=no","fqdn":"m6-211026f8a25b42c08fc190458268b30e.ecs.us-east-2.on.aws","domain":"m6-211026f8a25b42c08fc190458268b30e.ecs.us-east-2.on.aws","tld":""},"ip":{"addr":"18.119.5.249","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:24.498Z","timestamp":1790315004498,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m6-211026f8a25b42c08fc190458268b30e.ecs.us-east-2.on.aws","organization":""},"issuer":{"commonName":"Amazon ECDSA 256 M04","organization":"Amazon"},"validity":{"start":"Fri, 12 Jun 2026 00:00:00 GMT","end":"Sat, 26 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A1:95:24:71:23:15:66:54:01:C7:E2:DE:77:90:6C:DF:18:59:92:4A","sha256":"8E:3C:F5:EA:4B:92:FD:48:2F:71:CB:CD:4B:8E:77:8A:AA:02:F3:A1:B1:43:AB:89:DA:FA:63:05:FA:04:5C:44"}}},"request":{"raw":"POST /events?cee=no HTTP/1.1\r\nHost: m6-211026f8a25b42c08fc190458268b30e.ecs.us-east-2.on.aws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain;charset=UTF-8\r\nReferer: https://rhliey.com/\r\nContent-Length: 331\r\nOrigin: https://rhliey.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":331,"data":"{\"event_name\":\"PageView\",\"smart_setup\":{\"is_auto_web_details\":true},\"event_id\":\"ob3_plugin-set_8ff25ca44706b522d29a4473fa411c3a3d319fb5a3caa340493824b9d6e9aef2\",\"fb.pixel_id\":\"1763739624747610\",\"website_context\":{\"location\":\"https://rhliey.com/#/\",\"referrer\":\"\",\"isInIFrame\":false},\"fb.fbp\":\"fb.1.1790315004485.565290096759773604\"}"}},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 25 Sep 2026 05:43:24 GMT\r\ncontent-type: application/json\r\ncontent-length: 0\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\nvary: origin\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://rhliey.com\r\ncontent-security-policy: default-src 'none'\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":1201,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T13:46:40.165102Z","times_seen":18671674,"resource_available":true,"data":null}},"time_used":331,"timings":{"blocked":0,"dns":2,"connect":110,"send":0,"wait":107,"receive":0,"ssl":112},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/assets/uni.10eeaeb8.css","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:23.582Z","timestamp":1790315003582,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhliey.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Tue, 22 Sep 2026 11:00:00 GMT","end":"Mon, 21 Dec 2026 10:59:59 GMT"},"fingerprint":{"sha1":"9D:E0:92:F5:EF:05:57:4A:19:2C:49:D3:73:CD:16:71:03:1F:AC:E7","sha256":"55:96:D1:EE:4F:0E:0D:FD:41:CB:47:DE:80:4A:FA:64:61:BA:7C:0A:C0:4E:10:FF:9A:BC:F2:BD:34:CE:76:80"}}},"request":{"raw":"GET /assets/uni.10eeaeb8.css HTTP/1.1\r\nHost: rhliey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rhliey.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:23 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 22 Sep 2026 12:14:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27119-1ca8\"\r\nexpires: Fri, 25 Sep 2026 17:43:23 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7336,"size_decoded":2317,"mime_type":"text/css","magic":"ASCII text, with very long lines (7335)","md5":"bd585bdcd5c970cfbb39fa6a8d400a1b","sha1":"9d158c1cbc185311274d64ca639798288c1c4e65","sha256":"10eeaeb81f6fda8d0e9ef65a69d9e33f08357eafd5e8f7a6c511efe36d4b7cd7","sha512":"dc9933ceb803bfabb9f6b14ec8b1fa52619c25d9b0deb8a7609dcc35970f7ba3840b1d7dbac8d554d4ef20e464ffe7ae54ff2ba35f850b080cd7c77109c730cb","ssdeep":"96:Ubf2Vi8Lg7J0CQLnDSL9LBunNXVAG5MtmD/PFhZKw3:Ujj8LGJ0CQLnWL9MNXVA8MED/Phd","tlshash":"22e18471d440132ef51bcf3e12e2db8e312245b2dd523f28bb6534b48f9a1c6693a786","first_seen":"2026-08-18T01:32:15.533382Z","last_seen":"2026-09-25T06:13:03.586474Z","times_seen":19,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/assets/index-BO0tuFoh.js","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:23.583Z","timestamp":1790315003583,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhliey.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Tue, 22 Sep 2026 11:00:00 GMT","end":"Mon, 21 Dec 2026 10:59:59 GMT"},"fingerprint":{"sha1":"9D:E0:92:F5:EF:05:57:4A:19:2C:49:D3:73:CD:16:71:03:1F:AC:E7","sha256":"55:96:D1:EE:4F:0E:0D:FD:41:CB:47:DE:80:4A:FA:64:61:BA:7C:0A:C0:4E:10:FF:9A:BC:F2:BD:34:CE:76:80"}}},"request":{"raw":"GET /assets/index-BO0tuFoh.js HTTP/1.1\r\nHost: rhliey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rhliey.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:23 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Sep 2026 12:14:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab2710c-38806\"\r\nexpires: Fri, 25 Sep 2026 17:43:23 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":231430,"size_decoded":88354,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (50134)","md5":"a2a0f263c469f32fb80a9e43da029855","sha1":"2ac253325b8676f08783b36201b9040906843f86","sha256":"e411e75c518ebf42486ec3cd5ebecebc779cd237bc7f865000872cdbebf5a900","sha512":"1122bab4a69710da15112453539e1ac5ff1924d01791fc4beaceb1b88f4f35c7c3a2f1a87afa590095b4286ad91c80ed14d749f52a5bebe849d19619ea635d88","ssdeep":"6144:lfcU6MPOn4FR2Fn+5iznhWTmycta0Vehy96RZQozxcR8HH:lXR21+5iITzcta0Vehk6RZQVG","tlshash":"e23407e93282b03243e609f6507b0506f2392955784e94d4f16ceceb3d7785a92bbf6c","first_seen":"2026-09-21T13:30:47.452575Z","last_seen":"2026-09-25T06:13:03.580847Z","times_seen":10,"resource_available":true,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"connect.facebook.net/en_US/fbevents.js","fqdn":"connect.facebook.net","domain":"facebook.net","tld":"net"},"ip":{"addr":"31.13.72.12","port":443,"asn":32934,"as":"FACEBOOK","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:23.873Z","timestamp":1790315003873,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.facebook.com","organization":""},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Sat, 04 Jul 2026 00:00:00 GMT","end":"Fri, 02 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"0D:4B:2D:74:CE:4F:11:27:59:D3:3F:7F:FC:14:31:FD:42:16:42:87","sha256":"69:B6:EF:4A:C8:B6:9B:9A:AD:C0:AE:E4:96:EC:7A:89:07:20:FF:6D:B3:70:C8:19:F8:B6:6B:9A:5F:1D:A2:E2"}}},"request":{"raw":"GET /en_US/fbevents.js HTTP/1.1\r\nHost: connect.facebook.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rhliey.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: application/x-javascript; charset=utf-8\r\ntiming-allow-origin: *\r\nreporting-endpoints: coop_report=\"https://www.facebook.com/browser_reporting/coop/?minimize=0\", coep_report=\"https://www.facebook.com/browser_reporting/coep/?minimize=0\", permissions_policy=\"https://www.facebook.com/ajax/browser_error_reports/\"\r\nreport-to: {\"max_age\":2592000,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coop\\/?minimize=0\"}],\"group\":\"coop_report\",\"include_subdomains\":true}, {\"max_age\":86400,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/browser_reporting\\/coep\\/?minimize=0\"}],\"group\":\"coep_report\"}, {\"max_age\":21600,\"endpoints\":[{\"url\":\"https:\\/\\/www.facebook.com\\/ajax\\/browser_error_reports\\/\"}],\"group\":\"permissions_policy\"}\r\ncontent-security-policy: default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-590k6aMM';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c\u0026minimize=0;\r\nx-frame-options: DENY\r\ndocument-policy: force-load-at-top, include-js-call-stacks-in-crash-reports\r\npermissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to=\"permissions_policy\"\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-embedder-policy-report-only: require-corp;report-to=\"coep_report\"\r\ncross-origin-opener-policy: same-origin-allow-popups\r\npragma: public\r\ncache-control: public, max-age=1200\r\nexpires: Sat, 01 Jan 2000 00:00:00 GMT\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\norigin-agent-cluster: ?1\r\nstrict-transport-security: max-age=31536000; preload; includeSubDomains\r\nx-fb-debug: MhcGoIDKf2Nkm27DTTvP0o2XaGHlmSuiNdSY7orDeV8lrxqm9Pbz/BDcaKGZ+C4avgbsdE0P2I1Rva5S//YMOg==\r\ncontent-length: 111354\r\ndate: Fri, 25 Sep 2026 05:43:23 GMT\r\nx-fb-connection-quality: EXCELLENT; q=0.9, rtt=23, rtx=0, c=23, mss=1232, tbw=5088, tp=9, tpl=0, uplat=1, ullat=-1\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=3,i\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":424690,"size_decoded":115353,"mime_type":"application/x-javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (9255)","md5":"26406ac97f31f41f41879a04a2fba138","sha1":"a7d88b920d6f5a5f02879b7a87e4ff069acbdd82","sha256":"407b4a73534f3738e40e0a9dde6be862360ab81a37b11318f6815b892e043f8c","sha512":"e6c7b5130cf4ae0b9113fa7ff8aea7bc98f474425ad7aa5e317861be26b409cfed9dbe31fcd1d3086aa0013c639519ddf3b0a0c203a4b47bfec5bdf6daaa399c","ssdeep":"6144:i7gApToGDlZ6BYnTD+4Yd0E+brBLA30ru/dK0rZeP+b0mK8CLv+z1Y+COBfvBkn:wnAEmdBb0mK8CL7uKn","tlshash":"6594e7c9b1e5b0a107b7796c966f800772bbd5a238ccc960e51dedc8297c49e4133eb6","first_seen":"2026-09-23T19:32:02.816191Z","last_seen":"2026-09-26T13:25:03.88933Z","times_seen":87,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":4,"connect":29,"send":0,"wait":22,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/assets/_plugin-vue_export-helper.DlAUqK2U.js","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:23.902Z","timestamp":1790315003902,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhliey.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Tue, 22 Sep 2026 11:00:00 GMT","end":"Mon, 21 Dec 2026 10:59:59 GMT"},"fingerprint":{"sha1":"9D:E0:92:F5:EF:05:57:4A:19:2C:49:D3:73:CD:16:71:03:1F:AC:E7","sha256":"55:96:D1:EE:4F:0E:0D:FD:41:CB:47:DE:80:4A:FA:64:61:BA:7C:0A:C0:4E:10:FF:9A:BC:F2:BD:34:CE:76:80"}}},"request":{"raw":"GET /assets/_plugin-vue_export-helper.DlAUqK2U.js HTTP/1.1\r\nHost: rhliey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rhliey.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:23 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 91\r\nlast-modified: Tue, 22 Sep 2026 12:14:19 GMT\r\netag: \"6ab2711b-5b\"\r\nexpires: Fri, 25 Sep 2026 17:43:23 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":91,"size_decoded":608,"mime_type":"application/javascript","magic":"ASCII text","md5":"25e3a5dcaf00fb2b1ba0c8ecea6d2560","sha1":"7850b3fd4aeb69387bdb5a60025d15c41351d5eb","sha256":"cb85b0f263dbe24e857338301c0627076592e9f1f1a5662929f86d2c126444aa","sha512":"2e5cc9b53d5641147f68c73e5db0442d93fb6a64da45cfc051da5550a2fad07e912e651bd730e54325ef74eb706be0c5df612355c1dca144ab6e9cc8c4ecc73b","ssdeep":"","tlshash":"1fb012c81cc3e078939818d47738c15844380448310742b0808c0943e2c20809797c1d","first_seen":"2023-03-08T16:39:49Z","last_seen":"2026-09-26T11:15:11.851714Z","times_seen":26818,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/assets/index-DMl9amc0.css","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:23.585Z","timestamp":1790315003585,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhliey.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Tue, 22 Sep 2026 11:00:00 GMT","end":"Mon, 21 Dec 2026 10:59:59 GMT"},"fingerprint":{"sha1":"9D:E0:92:F5:EF:05:57:4A:19:2C:49:D3:73:CD:16:71:03:1F:AC:E7","sha256":"55:96:D1:EE:4F:0E:0D:FD:41:CB:47:DE:80:4A:FA:64:61:BA:7C:0A:C0:4E:10:FF:9A:BC:F2:BD:34:CE:76:80"}}},"request":{"raw":"GET /assets/index-DMl9amc0.css HTTP/1.1\r\nHost: rhliey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rhliey.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:23 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 22 Sep 2026 12:14:05 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab2710d-6b51\"\r\nexpires: Fri, 25 Sep 2026 17:43:23 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27473,"size_decoded":4880,"mime_type":"text/css","magic":"ASCII text, with very long lines (27472)","md5":"b559022718b3f9d9b87cf0da46d9ca37","sha1":"5f5c7844dc90b2a1f9c82b9dcc703b754f5e953f","sha256":"0304ea13c631384e05bf2d61d14091a29f5259597d1855f28f29072a02507217","sha512":"867c3ced4eeb72f64cd86a5e2c01ab9b8ea35f5cf65d7979f93385ee252e5fc52f33f718ec9caf7d87ad7243f4631cad56d7def94a22d20ed8a017e78f9c9d57","ssdeep":"384:FgDzFzaGIK5jBzQxtGkH9213E9z4TYDChl:ODpOEn","tlshash":"10c2eeb2aa503d4be27d8b33ec911768351050a1936313f277a76f9a8d0d65f46633ce","first_seen":"2026-08-18T01:32:15.538392Z","last_seen":"2026-09-25T06:13:03.581819Z","times_seen":19,"resource_available":true,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rhliey.com/assets/welcome-hub-C-o_AcSb.css","fqdn":"rhliey.com","domain":"rhliey.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rhliey.com/","date":"2026-09-25T05:43:23.905Z","timestamp":1790315003905,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rhliey.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Tue, 22 Sep 2026 11:00:00 GMT","end":"Mon, 21 Dec 2026 10:59:59 GMT"},"fingerprint":{"sha1":"9D:E0:92:F5:EF:05:57:4A:19:2C:49:D3:73:CD:16:71:03:1F:AC:E7","sha256":"55:96:D1:EE:4F:0E:0D:FD:41:CB:47:DE:80:4A:FA:64:61:BA:7C:0A:C0:4E:10:FF:9A:BC:F2:BD:34:CE:76:80"}}},"request":{"raw":"GET /assets/welcome-hub-C-o_AcSb.css HTTP/1.1\r\nHost: rhliey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rhliey.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 25 Sep 2026 05:43:23 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 22 Sep 2026 12:14:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab2711b-2119\"\r\nexpires: Fri, 25 Sep 2026 17:43:23 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8473,"size_decoded":2935,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (8470)","md5":"9ff87ca3738a871998a7c28f82385370","sha1":"15673381760c844c2fb2a8a442e6c1b26a2ee3a9","sha256":"ff69b744996abdc2a806974c53741c2be6c6b712a7bde68491a1eb8ecabd8913","sha512":"4d033c8af1284550a4825bac2f201c6379bdc5bd6833de7425c1714daf00ecae1493703b0b4f4d643bfd22f7ad654017648f606d143f91b2bf47e4582cbefc48","ssdeep":"192:/2CPLhpEmkiO826WDaSSEsp6dqdgCQh5r:OChpdZO0WDaf+p","tlshash":"6502622376a5f138f97bd4b2b9a4069f7050f803a82357dacda3a215c9c72fb5761348","first_seen":"2026-08-30T21:25:42.470253Z","last_seen":"2026-09-25T06:13:03.578416Z","times_seen":18,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"rhliey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"rhliey.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}