{"report_id":"6bf06ff3-e905-41a7-8ddf-b12c5edf1724","version":6,"status":"done","tags":[],"date":"2026-03-21T21:47:43Z","url":{"schema":"http","addr":"web.safepal.guru/","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":0,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"web.safepal.guru/login","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"title":"safepal.guru","dom":{"size":1485,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"1fdda54ba6788987845dd668658ba8c4","sha1":"11b70756fe0f3976d798efe29b8aed4ce937eb5b","sha256":"4107a0f8946ba6cc2b3c5cb127b88cf78a865efe4126f18d81696b941d450707","sha512":"58e3fba9ac1be45a058507b147c62174652a3b91892e3aebb9ccdabeb6c5b71e178db11b7ba0905d65593b7482d752745b40e744b8afe7e8fae77a29f0aba90e","ssdeep":"","tlshash":"2d31fed326e98519735141926891b208ada9e09fd90ced06bd9830fadfd5dc788b342e","dom_hash":"domhash658d50e4b679efa5f1d84c5c75731089","first_seen":"2026-03-21T21:47:50.982874Z","last_seen":"2026-03-21T21:47:50.982874Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"web.safepal.guru/","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":0,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-25T21:47:43Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-21T21:47:20Z","timestamp":1774129640,"ip_dst":{"addr":"Client IP","port":40888,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 43","source":"{\"timestamp\":\"2026-03-21T21:47:20.871793+0000\",\"flow_id\":656378677490256,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"194.33.61.24\",\"src_port\":443,\"dest_ip\":\"172.18.0.24\",\"dest_port\":40888,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400042,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 43\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2026-03-21T21:47:20.848464+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"telegram.org","ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":499,"first_seen":"2013-12-18T13:14:30Z","last_seen":"2026-03-18T14:30:52.272562Z","alert_count":0,"request_count":6,"received_data":342642,"sent_data":2679,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-03-15T22:19:58.945817Z","alert_count":0,"request_count":1,"received_data":18668,"sent_data":550,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"web.safepal.guru","ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":29,"request_count":29,"received_data":2136089,"sent_data":13110,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-03-15T22:16:12.279722Z","alert_count":0,"request_count":5,"received_data":107683,"sent_data":2684,"comment":"","tags":null,"fingerprints":null},{"fqdn":"oauth.telegram.org","ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":101848,"first_seen":"2018-02-07T13:36:20Z","last_seen":"2026-03-18T05:43:55.918612Z","alert_count":0,"request_count":1,"received_data":2112,"sent_data":684,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"telegram.org/js/telegram-widget.js?23","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ff8b98c72268de58837846f2056c65a","sha1":"e77fcc14f1efd17d319c9f82627e5789333b9dbe","sha256":"0f6cdd09b3bbebf50c4e1679aff6f021f5e183a4ba2dea3a0801394599ff6afd","sha512":"1a680a7e87f16520da934f4034cdc601ebef9c306c7f5e3ea165588f044142cadcf5eb06cefedc8ea7768ff63830586a2776351c7b9429f1e33b639adca5f1ed","ssdeep":"384:+vLsc8o/o9o7IFdWDoCzh3o4t6/7c8cBoYgNqPb:YLfwu7SU0CF3gLcHPb","tlshash":"2492819e1af72224a567713a4b5fa1093232e163700ddc503e6c5b90bf90a6767b0fdd","size":20469,"data":"","first_seen":"2023-04-05T01:44:44Z","last_seen":"2026-06-29T16:20:15.623033Z","times_seen":2919,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/js/widget-frame.js?66","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"c4825aabfb1129de5a11f9f2377834d9","sha1":"39d76a8d35fa411e0389e1d3a0d4e9000babfc89","sha256":"53df8dbdcd2cc75a317fdbc07e08e2e75e7e25a052fa2ed03871125f67b50001","sha512":"8c4f764301c1d735c6ea364d9cbbb8a399231f83e857b4322ddb615cda594f82aab5c2ff0528938e4ef97243b1c745bc85e94522a9f5993ccb522808ecce1dff","ssdeep":"768:a3+62J1xNNt3p1SG6CwPHG+AIieDPxsyk7Te9vwCiPZZpMEZF5ibQafIw8JBgHAe:+j2jNt3Qsyk7L1ZF8sv7e6M","tlshash":"3f933f4d69f33166a477b17a9baf55093635d003110ece217d0ca394af84934abfbbe8","size":97101,"data":"","first_seen":"2025-08-28T14:01:30.149557Z","last_seen":"2026-06-26T16:40:45.497205Z","times_seen":998,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/index-CkrgauFY.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"217465eb1fb426359b9d65d832dae4f0","sha1":"b15ac5446a5c8fb3abac2d60a116e479d3649d6a","sha256":"628dac477810089ad5d83d35db95edc703b08a9eea6e7f8c00b9a407f09bf0a3","sha512":"5315222026cebb436f998076c2514ded43c28905ec86d4f67500e356e381d7ec6695cb1a238805b458f16f6185eb1f95a2987652563624436059d5bca38ba4cd","ssdeep":"3072:HacwR4ETgv0qPglLKY5gxxzAYFd0SwkQY7wNQ8YIbIXPqgiqJDdgi6ia0:HacwRs0DRQvJwkQgqIXPDx","tlshash":"31540b447211afbcfd9708d8be7ea00cb03a1f5cf53ec454e07e58252a69956ba23bd4","size":288699,"data":"","first_seen":"2026-03-21T21:47:50.984709Z","last_seen":"2026-03-21T21:47:50.984709Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-motion-UFPSjczj.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"importedModule","is_inline":false,"md5":"31c1e74e07164f8d0d0d13d66ac74015","sha1":"785c13ca0bfa473a1358108a52db154921f8fa64","sha256":"53db062b58f25fa72719101f3e05db761b0712da198094035295d0c58b756c5a","sha512":"059dd6be60ce008d19eec5d47d1736f1a74242499437b70c34e5c25e7ff4dfbd75c839490bea422ac5d1d56896d7f6419ddf948fe0889b1148e18ba3e3d000c1","ssdeep":"3072:5yEIcCQdCSpoI3Ziaaq6+aEWjTRImtjlbb8w4D/Kmh:6cCQdCSpopaaP+aE0RNjB8JDimh","tlshash":"31c308c572917162d3db85e9c0bf0741b73628943009c0acb63dadcb7d2154aa6bbb7e","size":121523,"data":"","first_seen":"2026-03-15T08:45:03.654791Z","last_seen":"2026-04-28T18:47:16.458724Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-query-CeH3LFOn.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"importedModule","is_inline":false,"md5":"37bfd45eaeef354c1ba152a94281f471","sha1":"f7227b2b202729f1eec5e41e0cfa72775ba7776d","sha256":"1e7298e495979d1f8b6170dd94ea839588664cf2e370cc48e49dedb0faeae7dc","sha512":"c14684fed55f8cf0051180bee320f11536df0be3e457f19b80e4de4b48f9635975fb202c90a9c6b0b4d43bc4f5cac88d79fc36dca313f1bbddf19079fa41ca79","ssdeep":"768:wL5E3W/hGHp4eQhasJ2DloIvsGPx8By9GNODyflgJGeVn6B+ucxT18VJRuA+j93O:wVx2hdvoBa8Y793+8gl","tlshash":"8403b9d67146a2273ad18491dc3e4125e2346d04340a806cbafcade7f963dcef5bea35","size":39678,"data":"","first_seen":"2026-03-15T08:45:03.658237Z","last_seen":"2026-03-21T21:47:51.008392Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-utils-Bg3yRKsz.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"importedModule","is_inline":false,"md5":"aff184f94ad0aac0290158ea86a41c9e","sha1":"7df96b0db1d4023e234efff88877737ab6f96ee2","sha256":"2deb280564a5670ee2ed281ccc2af34bf38de8fff5e4e6559e978ffe7ca169f1","sha512":"76c7491bdff85d8842d236a459573a7093dfafa95ed2b07a8001259730a39967183699175fa6ba18967598b6712254a5cc23438c437f26d37417a8af696f88ab","ssdeep":"1536:unz2ft8w9CDuRCZdIF1HJAYPOv3sMlSN78gkY3uLFZBbqAn:unSf6w9IbIFpqMA3LLn","tlshash":"22837da5b583203b17df42e6e07e550ae23c5902b00cc594f29dcdb61fa564a51bbf2e","size":88780,"data":"","first_seen":"2026-03-21T21:47:50.995931Z","last_seen":"2026-03-21T21:47:50.995931Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oauth.telegram.org/embed/safepal_guru_bot?origin=https%3A%2F%2Fweb.safepal.guru\u0026return_to=https%3A%2F%2Fweb.safepal.guru%2Flogin\u0026size=large\u0026userpic=true\u0026request_access=write\u0026radius=8","fqdn":"oauth.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"53b6be0f202fb25fce4076bd27f2d81a","sha1":"3dd9cf1fafdd5181d0848a1f98c8bf5014f3f48a","sha256":"5a7b86e7a9338bb7c9a0eecd966f2b42a1be4da0e316561a156b3f4671b353db","sha512":"fa18fcb80315b969fc040d03ea94a41a845e352d53b66d46ddbaf95d9ef936eff286e18145ad9519b2174d62e8eb4316f957f85ed71b5fafeed692c69991fdd4","ssdeep":"","tlshash":"2b600000003c330000c33c03c00f30f033c03000000000000000000000c000c0003003","size":13,"data":"","first_seen":"2023-03-07T01:31:07Z","last_seen":"2026-08-13T20:39:07.306117Z","times_seen":970,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/js/telegram-web-app.js","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"bb0a2fecf6cd27fba9cd29610fd2ccdc","sha1":"7546ed807d56be081be97fa1e4859381ecccf58e","sha256":"dc67f1e084e069a3fb629f3154765856fe0aa805a4e138bc42c228bc3d656a78","sha512":"5350795e68c371956350f88354aac62900d7fc5974817e93f49f218fa60becda436da0a8bf17d6239e2ef882cee0b18bfe66e181baa6f1ca04b57817c2920166","ssdeep":"1536:pO5TpRdoKd4F0WN2ZbBcn9cF9KTfVjLo03ueLE+wFFz1NIVIB/MGYV7p/xHK8ITq:s5TpRdfcKFU7Rx1H","tlshash":"31b33e4d6cb3612285b3b1bf8b5f924172759883301def20794d9b646f80e7c53eaad8","size":114950,"data":"","first_seen":"2026-03-10T21:38:17.367441Z","last_seen":"2026-08-06T08:41:46.722793Z","times_seen":775,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-react-Cvri6UMh.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"importedModule","is_inline":false,"md5":"3bf71f321fb2742867c80d660c7d2a77","sha1":"44d7596a8ed071c0c064eea2eadd200dbfdf6a5d","sha256":"3e123e2104d5d46946d94dbe9be302c1efabd852df33d98372408e84d9ebb0be","sha512":"de53072a116624a4461da68c2e3c289c737309975a9f516b0815096425f2f9500ae48a7a85340fd63e0d66e7f2adcbc5e2f9155fe08a4aae8b8bd8f27f6591ea","ssdeep":"3072:t8sQmPMhfADyNRlOzhZi/2roVMMBwhSEFaByhKY/203w2prq7hjw8e/sbWLnSrl:KmPMckjO4BSMctLnyl","tlshash":"1b342ce832ad76666fb252a500af110772782c33240d8861f165fd9e36b444a51fbffe","size":253019,"data":"","first_seen":"2026-03-15T08:45:03.648626Z","last_seen":"2026-04-28T18:47:16.452328Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/en-BTMBPQzI.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"cfab601fa49eabf03ef0c2683d8ec8cb","sha1":"049f240b269e17a98a2efd020ab272a26995c022","sha256":"2bc38fdbd032f2c1bc518d6e14b10ea66bdb7b003786ae1f0848049612385bf0","sha512":"d19624290aa9ec43ffd28ce9d0b6f293aa9f689be15f87043e4033c735f491ea3dace8859ad585500a5a3aaa80d7b89cad43f0e5261c26bef8248122c0ac8afe","ssdeep":"3072:E7V+at7fh4yp0VSvhdJZap5I+bE4oBwxVmcQc4jXhw9U:EsM75dbapu4kwzmcQc4jXhw9U","tlshash":"2dc3070b49066eba0bc753eb7cd75f5636f902a791a084a0dccdc12d01e9bd8f22f659","size":125286,"data":"","first_seen":"2026-03-21T21:47:51.011333Z","last_seen":"2026-03-21T21:47:51.011333Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oauth.telegram.org/embed/safepal_guru_bot?origin=https%3A%2F%2Fweb.safepal.guru\u0026return_to=https%3A%2F%2Fweb.safepal.guru%2Flogin\u0026size=large\u0026userpic=true\u0026request_access=write\u0026radius=8","fqdn":"oauth.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"c411db8175c2e3db90ac7fb79b471226","sha1":"4f337b62c60b109cc63bd02b467d3c4ae86976b4","sha256":"d423b0cf721014caf49f1f4d4cc51f6736be37bf215f91f2cafe3fb37720c8c1","sha512":"ead3fc4888f3c30d73a311ae63f3842526e2f1108ebb409611beae603eee11a08cc7f5bc74cdef42aacc7ed08b0f8330fc6cd05cd4a6db13e4a76a5b5d28110e","ssdeep":"","tlshash":"bdc0229332ca4220d2e082c52c285300b453a0aa9809e95e16393cca84940cf203003a","size":178,"data":"","first_seen":"2026-03-21T21:47:51.013955Z","last_seen":"2026-03-21T21:47:51.013955Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/ru-ex5GicUA.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"33d5e402009b12b1f7420eae38a85207","sha1":"47e7a4b2d33199ff7b524be23411913265fcc24e","sha256":"df9ccd32e0598eb6b5ee9f0f7694616ac659ebd9bbca8914c9085c05d0dbc425","sha512":"2b7d6a80f04523dfb5dbd195667aeb090bfd16f806eeea05bf9476e84fdfb4764b3fa186d60a15403293776b409d43115a9c9a8431effec04a9ba9665588d591","ssdeep":"6144:Ns9ulEir37peFqiOd3lmVlGPKUR/akazCwCBk0VW3g5ulfy3tDUy22xjzkqIwDpP:Ns9ulEirrMFqiOd3lmVlGPp/akyCwCRb","tlshash":"0824fd61569db4ee1205f45bdc046e0b3abf44fe7fab435209b42d7e30f2124d63aa1a","size":216282,"data":"","first_seen":"2026-03-21T21:47:50.99314Z","last_seen":"2026-03-21T21:47:50.99314Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/login","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"eval","is_inline":false,"md5":"0dc5a4770b10400d541ada510ffde422","sha1":"0b418d63a3e05087407eb4c612d22665249c28d0","sha256":"01b9508e2299d7438ab5bee91c125cee3acad8711101d4e3d3c033cd655a770b","sha512":"c1f0cf6fcdce97b30e1dd46f3f348f2edb80d3bf0f6698e22900840cf59d6f2d0ca515ccb7b62670fdccafbee44119d5f67d4eb589df6aa97407be48ce2b0f09","ssdeep":"","tlshash":"76900455d504d01111153531c017d10d4c31d70cdd4110f454f444f5d734d544411705","size":46,"data":"","first_seen":"2026-03-15T08:45:03.663275Z","last_seen":"2026-07-08T09:00:37.226086Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-telegram-BBdFq5Ea.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"importedModule","is_inline":false,"md5":"e570d6b369eef16b6df1ef804afb30d5","sha1":"f5c0e2b0cafc47627b1a634fbe479e03c5ff051a","sha256":"4cc4a81ac2c9ab9bc0110de413bb169ea58f453d7dbd0ad532ff85d8f3c9b141","sha512":"1cb4bc0fafa738c85a1167baa828048bd32d9db53f412dc3911db0ae36cbc3e31c31e8cb4849d227e554b506e294a830241f15624589c582239487eba5fb8baa","ssdeep":"1536:+Rydx/SnYzCqaeeIAArggc5P009DANCf0RUF:+Ryd9yx/Acx009cNxRUF","tlshash":"96331bce32a6f03203ea14fa50bb4196f36626d0740dd6f0b17cddaa355a94a4237f6d","size":53547,"data":"","first_seen":"2026-03-21T21:47:51.003014Z","last_seen":"2026-03-21T21:47:51.003014Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-twemoji-BrQQgBPK.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"importedModule","is_inline":false,"md5":"b327a5611dfb33e22fa950ef4adf892f","sha1":"ed30103a58803c40355c2f35e8045308426a765a","sha256":"b51943e1282a65892027008b35b98cba7f56e714547a3b33691767a4f3217ae3","sha512":"d8ff6054ef686854e758cf947d686942ec68e998fb86ec30dce4fbdac5e9584ac5ceb1f104fdf5ea942a37cf0e5af3f13f2db5cd2f1d8355382d022cdc333b7e","ssdeep":"384:rdTPvZpRZTbXU/3j//bEPhXgA5hqmwJldEcbJ36Use:rdTPR9XU/3j//YpXgAiblqcVqUse","tlshash":"2da2b38bb33a5e8f747e3bd78d968f4dd59a555321c0f078dbeaf6c129a00968274c80","size":22706,"data":"","first_seen":"2026-03-15T08:45:03.652779Z","last_seen":"2026-04-28T18:47:16.44839Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-i18n-MEDaAegx.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"importedModule","is_inline":false,"md5":"0fb5e12b80a26c957b440999f2e1b6ef","sha1":"fce1b3ceb86619727af37a3fba3ce6e85c705fca","sha256":"7bb2127d4fbd991dc48c9272a553ce6a6d330779075920cbfd3043e586ceb58d","sha512":"ede68e4118e62461f8f77b48052cef4645c8fa9fc4210c6630a4a0417dd87e81602f0d9a4f38a8b8160653cab5f7e5afbd4b503f0884d8f91590f96ad8faa076","ssdeep":"768:Z1Y9CoeLEysbGrnsYRzDP4lwAcPRH+Q7ohKmHdT1Mlm+VrpQoTCwzUhUSEFvlstA:ycs8gnnckgiKvLOjf1GPILJfSn","tlshash":"3c431ac971ebaa2643ea80d530701504a635ad553448684dfe7cafe7e4d3e0a93fbb34","size":55283,"data":"","first_seen":"2026-03-15T08:45:03.634678Z","last_seen":"2026-03-21T21:47:51.003899Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-radix-Il3hGQzs.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"importedModule","is_inline":false,"md5":"b40f44f8e9d54ba24ba76950e087d7e2","sha1":"95262238e93cf7eed138d22082c9af7654662cca","sha256":"48b62638306f8dfeea0120af63b4f1e38e10a5742860c9a4d7180c480f552c2d","sha512":"6da8eac018fce340d0250c714590092889dc53be7507888b3cba54cbf6e995316a32b6fe4a98799e5384ef99e4023001f30d61f7b4fe0be23b7cbf253299da06","ssdeep":"768:nIo3ZBTZlbaKaUcTQBypF9JcVP+3bYNVRGVxGyxLQOWDjbWWnUd:IsTuQBb+IAxGJzUd","tlshash":"b8b218d62042b970c7a884d6847fc52cbb371a28305e4490f17d9c6e2daa541e6b7ffe","size":24842,"data":"","first_seen":"2026-03-15T08:45:03.660034Z","last_seen":"2026-04-28T18:47:16.449291Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"web.safepal.guru/assets/index-CkrgauFY.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.093Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/index-CkrgauFY.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 288699\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-467bb\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":288699,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33196)","md5":"217465eb1fb426359b9d65d832dae4f0","sha1":"b15ac5446a5c8fb3abac2d60a116e479d3649d6a","sha256":"628dac477810089ad5d83d35db95edc703b08a9eea6e7f8c00b9a407f09bf0a3","sha512":"5315222026cebb436f998076c2514ded43c28905ec86d4f67500e356e381d7ec6695cb1a238805b458f16f6185eb1f95a2987652563624436059d5bca38ba4cd","ssdeep":"3072:HacwR4ETgv0qPglLKY5gxxzAYFd0SwkQY7wNQ8YIbIXPqgiqJDdgi6ia0:HacwRs0DRQvJwkQgqIXPDx","tlshash":"31540b447211afbcfd9708d8be7ea00cb03a1f5cf53ec454e07e58252a69956ba23bd4","first_seen":"2026-03-21T21:47:50.984709Z","last_seen":"2026-03-21T21:47:50.984709Z","times_seen":1,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":104,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/api/cabinet/branding/telegram-widget","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.687Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /api/cabinet/branding/telegram-widget HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/json\r\ncontent-length: 139\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":139,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"89194c2142ab17f291529034712aa1b6","sha1":"0a5a6b10437f319337744ee0e2ee0badfeca1bb2","sha256":"8050e24162fbb2b5527e7b511538730eb93f2310cf5706b633e9564cf3b9981b","sha512":"448d3feedcafdb6526cf9c259740c712a6e20342c42d73730b48261a95b079ec22cfbcfd6e0c782834c6ba41446483de25a849909a6ec6d8c24009ee9954b323","ssdeep":"","tlshash":"05c02b8b00730ff4b181d30380300742057cc0b3f0518e08682c0909624c002732244b","first_seen":"2026-03-21T21:47:50.986042Z","last_seen":"2026-03-21T21:47:50.986042Z","times_seen":1,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/api/cabinet/branding","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /api/cabinet/branding HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/json\r\ncontent-length: 100\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":100,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"781db80020e9ffd027d18fa8488fbde0","sha1":"3599ada919c1e060a26c68ffb979ab832565af18","sha256":"a2c59bed0cfbb5b8be40c2c4398629d5cfe29eabb506efd004527edb05eb9394","sha512":"a054800e27d9dfb99eb9ae5f5ceb3b852648d8c9c614c69f894e7d0fd04dcb88ed2b8cbc85fa17d80ec48cedde3f397c450e3809131b2bbb33dd70dd55fc5288","ssdeep":"","tlshash":"78b0126e0d1d053c82861dea589f605c60311752700c0ec65334a6eb5058259d0c1449","first_seen":"2026-03-21T21:47:50.987282Z","last_seen":"2026-03-21T21:47:50.987282Z","times_seen":1,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/api/cabinet/branding/email-auth","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /api/cabinet/branding/email-auth HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/json\r\ncontent-length: 46\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"e3c7f7e5c4b9b582b5c784a921bceef9","sha1":"18138f3d9a6fdaafbc7b142d13fc166af94181fc","sha256":"e6d19d25fc239fc7138f48cb3b32db7dd3e2f8c99c7d95ed0a8f5b2bd5c9b771","sha512":"db1527571c9b47f8618fae2663900375baa1e8d9111bd5c8d9d88d1c2c51ef9fe2929ed8ad6c0f52ba7b50fbeb4ad04ab2b0e7c158979624948fca8d4feb8246","ssdeep":"","tlshash":"c69002450c1924983541c121c224514302218c742413242980510028209b6a04311821","first_seen":"2026-03-21T21:47:50.988487Z","last_seen":"2026-07-08T09:00:37.203111Z","times_seen":5,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-21T21:47:20.811Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:20 GMT\r\ncontent-type: text/html\r\ncontent-length: 2021\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-7e5\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2021,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"375758a960a54b12255242411d868a21","sha1":"f54104273ebfca6b4f7f7db15f37df9ffb3b40f4","sha256":"61bcbb8a12dedccbe6ea1c3e634334a3b62396e0489d767ca1c68cbea2f61ce5","sha512":"d92160ad9ab577b7a9065459c6139937e9efd7e639901ee5854a73776141822da2836660ca31e18439ec5383b17fa740f1024b5ef1ef5fdd2bdf747ea58d4f98","ssdeep":"","tlshash":"a841a01531a0c80622201b15bac1f4286e42f7475649e9e5f0ee70becf55fd18f9797a","first_seen":"2026-03-21T21:47:50.989799Z","last_seen":"2026-03-21T21:47:50.989799Z","times_seen":1,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":98,"dns":38,"connect":24,"send":0,"wait":23,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/index-CXjQHjI5.css","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.095Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/index-CXjQHjI5.css HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: text/css\r\ncontent-length: 162157\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-2796d\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":162157,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"54042627fc8aeba8bf3b4fe3828e832b","sha1":"c6dc45027ea576d0ff1ecdf77b7bd68f494a98b5","sha256":"7a48f1a473d60ec26d249a06c447ae509e52f3447ab4ac360394ae817010c8c6","sha512":"cf86429db3f3accff526220d4cf9aec7820bfadb90c62fa4dc35c08a4560bfc6f6531dc6df919ed4afd631775b6daad93513f59ac9888648b15dde4ee67f883c","ssdeep":"1536:k3lwhQ8cthcs+XPg4JWdmYBW6i8MUNZtmAvf02XeCeOTMRG:NhQ8cthcs+XPg4JWU98MUZeCeOIRG","tlshash":"bff33425b659503b7c13a0fec39cea5da11fb0c1de3a1baabd8192145bd23fb1cd6904","first_seen":"2026-03-21T21:47:50.990694Z","last_seen":"2026-03-21T21:47:50.990694Z","times_seen":1,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-twemoji-BrQQgBPK.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.320Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-twemoji-BrQQgBPK.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 22706\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-58b2\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22706,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (22701)","md5":"b327a5611dfb33e22fa950ef4adf892f","sha1":"ed30103a58803c40355c2f35e8045308426a765a","sha256":"b51943e1282a65892027008b35b98cba7f56e714547a3b33691767a4f3217ae3","sha512":"d8ff6054ef686854e758cf947d686942ec68e998fb86ec30dce4fbdac5e9584ac5ceb1f104fdf5ea942a37cf0e5af3f13f2db5cd2f1d8355382d022cdc333b7e","ssdeep":"384:rdTPvZpRZTbXU/3j//bEPhXgA5hqmwJldEcbJ36Use:rdTPR9XU/3j//YpXgAiblqcVqUse","tlshash":"2da2b38bb33a5e8f747e3bd78d968f4dd59a555321c0f078dbeaf6c129a00968274c80","first_seen":"2026-03-15T08:45:03.652779Z","last_seen":"2026-04-28T18:47:16.44839Z","times_seen":4,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/ru-ex5GicUA.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.495Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/ru-ex5GicUA.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 216748\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-34eac\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":216748,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (45753), with no line terminators","md5":"33d5e402009b12b1f7420eae38a85207","sha1":"47e7a4b2d33199ff7b524be23411913265fcc24e","sha256":"df9ccd32e0598eb6b5ee9f0f7694616ac659ebd9bbca8914c9085c05d0dbc425","sha512":"2b7d6a80f04523dfb5dbd195667aeb090bfd16f806eeea05bf9476e84fdfb4764b3fa186d60a15403293776b409d43115a9c9a8431effec04a9ba9665588d591","ssdeep":"6144:Ns9ulEir37peFqiOd3lmVlGPKUR/akazCwCBk0VW3g5ulfy3tDUy22xjzkqIwDpP:Ns9ulEirrMFqiOd3lmVlGPp/akyCwCRb","tlshash":"0824fd61569db4ee1205f45bdc046e0b3abf44fe7fab435209b42d7e30f2124d63aa1a","first_seen":"2026-03-21T21:47:50.99314Z","last_seen":"2026-03-21T21:47:50.99314Z","times_seen":1,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://web.safepal.guru\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 24836\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 18 Mar 2026 19:26:21 GMT\r\nexpires: Thu, 18 Mar 2027 19:26:21 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:08:28 GMT\r\ncontent-type: font/woff2\r\nage: 267660\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24836,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24836, version 1.0","md5":"938c6e8019b69313372c47dbb7a7c930","sha1":"b42951014c5eca12749d87a4706caf22dc4fe081","sha256":"a30ddcd349703aff7464c34bef3fffdff405ee50c113440d7c8693c02d210972","sha512":"5537c005cd8f321f26fe67f6292b3ec14e88ff4b2365311628dbbe4753e01e568f6881b9f2e7d71e8e6b2c261ed25f372829dd28f89f865ce574b4e1fec29614","ssdeep":"768:3KQaj5c95F1QmIwa55Go1COpZLpkkM46CU+YIC:ahj5cXow65xCM5pkkM468YB","tlshash":"a2b2f105ee49b3d4b276f1fcfa802884179282f27dabda8f3f2015981dd8e5b8d45320","first_seen":"2025-06-02T20:09:41.98255Z","last_seen":"2026-08-14T06:47:26.395684Z","times_seen":38005,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":88,"dns":1,"connect":8,"send":0,"wait":9,"receive":6,"ssl":79},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://web.safepal.guru\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 24836\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 18 Mar 2026 19:26:21 GMT\r\nexpires: Thu, 18 Mar 2027 19:26:21 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:08:28 GMT\r\ncontent-type: font/woff2\r\nage: 267660\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24836,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24836, version 1.0","md5":"938c6e8019b69313372c47dbb7a7c930","sha1":"b42951014c5eca12749d87a4706caf22dc4fe081","sha256":"a30ddcd349703aff7464c34bef3fffdff405ee50c113440d7c8693c02d210972","sha512":"5537c005cd8f321f26fe67f6292b3ec14e88ff4b2365311628dbbe4753e01e568f6881b9f2e7d71e8e6b2c261ed25f372829dd28f89f865ce574b4e1fec29614","ssdeep":"768:3KQaj5c95F1QmIwa55Go1COpZLpkkM46CU+YIC:ahj5cXow65xCM5pkkM468YB","tlshash":"a2b2f105ee49b3d4b276f1fcfa802884179282f27dabda8f3f2015981dd8e5b8d45320","first_seen":"2025-06-02T20:09:41.98255Z","last_seen":"2026-08-14T06:47:26.395684Z","times_seen":38005,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":131,"dns":0,"connect":8,"send":0,"wait":8,"receive":2,"ssl":122},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"oauth.telegram.org/embed/safepal_guru_bot?origin=https%3A%2F%2Fweb.safepal.guru\u0026return_to=https%3A%2F%2Fweb.safepal.guru%2Flogin\u0026size=large\u0026userpic=true\u0026request_access=write\u0026radius=8","fqdn":"oauth.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Mon, 11 Aug 2025 13:36:48 GMT","end":"Sat, 12 Sep 2026 13:36:48 GMT"},"fingerprint":{"sha1":"85:08:98:2F:A3:60:90:21:E8:78:21:C8:A4:96:E1:A2:E6:9D:2C:64","sha256":"49:35:FF:BC:17:D1:E9:B3:15:37:E4:67:C2:3A:A0:69:6C:37:DC:52:3F:7C:02:D6:30:C4:6E:45:7C:CA:F0:D2"}}},"request":{"raw":"GET /embed/safepal_guru_bot?origin=https%3A%2F%2Fweb.safepal.guru\u0026return_to=https%3A%2F%2Fweb.safepal.guru%2Flogin\u0026size=large\u0026userpic=true\u0026request_access=write\u0026radius=8 HTTP/1.1\r\nHost: oauth.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 747\r\nset-cookie: stel_ssid=130add6fadba7a9c07_13144503113260874722; expires=Wed, 24 Mar 2027 04:27:30 GMT; path=/; samesite=None; secure; HttpOnly\r\npragma: no-cache\r\ncache-control: no-store\r\nx-frame-options: ALLOW-FROM https://web.safepal.guru\r\ncontent-security-policy: frame-ancestors https://web.safepal.guru\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1551,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"f1e6de8de365590f8942c4aedc03d0b3","sha1":"086b0c19bb60a01b1fba49715f105222193aab64","sha256":"d4c4d77e0c055d75c4138a5f0ff84a77ced38a4b3331fa2d287777a0ddfbc362","sha512":"5bb8e5f79514f9ecfa4b30da20a76589551c995634361c479f9160f6169e31d1412a749cc5cbf09bbb34dadc278aa7efd1ee95ef017ccd4522f61abc4a8a3e3e","ssdeep":"","tlshash":"ae3120d326e8c515734100a268c1b2046da9e0cfea0ced097d9830badfd5dc248a702f","first_seen":"2026-03-21T21:47:50.994944Z","last_seen":"2026-03-21T21:47:50.994944Z","times_seen":1,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-utils-Bg3yRKsz.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.319Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-utils-Bg3yRKsz.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 88780\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-15acc\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88780,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (34462)","md5":"aff184f94ad0aac0290158ea86a41c9e","sha1":"7df96b0db1d4023e234efff88877737ab6f96ee2","sha256":"2deb280564a5670ee2ed281ccc2af34bf38de8fff5e4e6559e978ffe7ca169f1","sha512":"76c7491bdff85d8842d236a459573a7093dfafa95ed2b07a8001259730a39967183699175fa6ba18967598b6712254a5cc23438c437f26d37417a8af696f88ab","ssdeep":"1536:unz2ft8w9CDuRCZdIF1HJAYPOv3sMlSN78gkY3uLFZBbqAn:unSf6w9IbIFpqMA3LLn","tlshash":"22837da5b583203b17df42e6e07e550ae23c5902b00cc594f29dcdb61fa564a51bbf2e","first_seen":"2026-03-21T21:47:50.995931Z","last_seen":"2026-03-21T21:47:50.995931Z","times_seen":1,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-utils-Bg3yRKsz.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-utils-Bg3yRKsz.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 88780\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-15acc\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88780,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (34462)","md5":"aff184f94ad0aac0290158ea86a41c9e","sha1":"7df96b0db1d4023e234efff88877737ab6f96ee2","sha256":"2deb280564a5670ee2ed281ccc2af34bf38de8fff5e4e6559e978ffe7ca169f1","sha512":"76c7491bdff85d8842d236a459573a7093dfafa95ed2b07a8001259730a39967183699175fa6ba18967598b6712254a5cc23438c437f26d37417a8af696f88ab","ssdeep":"1536:unz2ft8w9CDuRCZdIF1HJAYPOv3sMlSN78gkY3uLFZBbqAn:unSf6w9IbIFpqMA3LLn","tlshash":"22837da5b583203b17df42e6e07e550ae23c5902b00cc594f29dcdb61fa564a51bbf2e","first_seen":"2026-03-21T21:47:50.995931Z","last_seen":"2026-03-21T21:47:50.995931Z","times_seen":1,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-radix-Il3hGQzs.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.466Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-radix-Il3hGQzs.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 24842\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-610a\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24842,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (24841)","md5":"b40f44f8e9d54ba24ba76950e087d7e2","sha1":"95262238e93cf7eed138d22082c9af7654662cca","sha256":"48b62638306f8dfeea0120af63b4f1e38e10a5742860c9a4d7180c480f552c2d","sha512":"6da8eac018fce340d0250c714590092889dc53be7507888b3cba54cbf6e995316a32b6fe4a98799e5384ef99e4023001f30d61f7b4fe0be23b7cbf253299da06","ssdeep":"768:nIo3ZBTZlbaKaUcTQBypF9JcVP+3bYNVRGVxGyxLQOWDjbWWnUd:IsTuQBb+IAxGJzUd","tlshash":"b8b218d62042b970c7a884d6847fc52cbb371a28305e4490f17d9c6e2daa541e6b7ffe","first_seen":"2026-03-15T08:45:03.660034Z","last_seen":"2026-04-28T18:47:16.449291Z","times_seen":4,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/api/cabinet/branding/colors","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /api/cabinet/branding/colors HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/json\r\ncontent-length: 286\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":286,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"e3c6c82016d67ea9824e06778188ccff","sha1":"63f1c611e090dda2c1b935be245150d0b69e4a8c","sha256":"438c07c75e15c68816eb5d6a1f707d29c5bee867fad56ac28fad9bc5b6f13cb3","sha512":"3b91bef5abd7cd3ed8e7bb9a0558f8f1a4263638d24a3e85b1957378ab783108e8fa0b6dd8f0c158056e0ace0e8af2cf0a4ca5dfe152c7261d18cb3fcf2754ff","ssdeep":"","tlshash":"9fd02e010e812801a3eb19db0466ee937bcdf280f09e2495c46cb716b0ccb8e673b0a6","first_seen":"2026-02-06T20:59:00.811082Z","last_seen":"2026-07-05T08:20:39.698474Z","times_seen":5,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/api/cabinet/auth/oauth/providers","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.690Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /api/cabinet/auth/oauth/providers HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/json\r\ncontent-length: 16\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"18692d3d5419df2c74bab7c127529fa9","sha1":"16d0d017ae767e994a2a6c9df2267928976b6d34","sha256":"ee203d24e9722116c133153095cd65f7d94d8261bed4bd77da698dda07e8c98d","sha512":"ae6eb9fdf5c266812c9850dd43b637b5d886c023817d2bd57679115e5c13c1ba74bb552fd51039b0b490c01bdc135381663cecb2ffe756efc5b1a69bcde9766d","ssdeep":"","tlshash":"8c6000208800000000000c08a8a808008088000200200020082200a882028080c80888","first_seen":"2023-05-04T19:35:05Z","last_seen":"2026-08-13T04:33:02.141575Z","times_seen":178,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggOxSuXd.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/manrope/v20/xn7gYHE41ni1AdIRggOxSuXd.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://web.safepal.guru\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 14500\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 15 Mar 2026 00:19:00 GMT\r\nexpires: Mon, 15 Mar 2027 00:19:00 GMT\r\ncache-control: public, max-age=31536000\r\nage: 595701\r\nlast-modified: Thu, 04 Sep 2025 17:09:13 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14500,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14500, version 1.0","md5":"e58febde317b69ceb51690ea201850c9","sha1":"d8fc94bf7a39043a7759bd564a7e16b3ea080736","sha256":"c268b459a9329e59fecf39a17618efd44c71735532048d60b12aab76a8c14914","sha512":"af17f0a6913d974bd7d38a060549dacd158c667abb08f830d44d302c1a1cb4f8106eeeb772d2b4066be2c5a1e763d26042c707343770f5e84b0f5165cab9d96b","ssdeep":"384:4VvSHMmDtGjtHrBRvGjLWPSNRXZpyJ+kC18bZ:4VvSsmDt6LBROj1RXZ4J+318bZ","tlshash":"8a52b05ef04e86f0b51f2a7ece5c6a1153725e56134f2e50e967b0c8c75e82a1e27142","first_seen":"2025-06-05T11:45:07.756161Z","last_seen":"2026-08-14T06:33:03.013294Z","times_seen":3737,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":29,"dns":1,"connect":8,"send":0,"wait":8,"receive":1,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/css/widget-frame.css?73","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://oauth.telegram.org/embed/safepal_guru_bot?origin=https%3A%2F%2Fweb.safepal.guru\u0026return_to=https%3A%2F%2Fweb.safepal.guru%2Flogin\u0026size=large\u0026userpic=true\u0026request_access=write\u0026radius=8","date":"2026-03-21T21:47:21.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Mon, 11 Aug 2025 13:36:48 GMT","end":"Sat, 12 Sep 2026 13:36:48 GMT"},"fingerprint":{"sha1":"85:08:98:2F:A3:60:90:21:E8:78:21:C8:A4:96:E1:A2:E6:9D:2C:64","sha256":"49:35:FF:BC:17:D1:E9:B3:15:37:E4:67:C2:3A:A0:69:6C:37:DC:52:3F:7C:02:D6:30:C4:6E:45:7C:CA:F0:D2"}}},"request":{"raw":"GET /css/widget-frame.css?73 HTTP/1.1\r\nHost: telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oauth.telegram.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0\r\ndate: Sat, 21 Mar 2026 21:47:22 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 29 Jan 2026 17:33:59 GMT\r\netag: W/\"697b9a07-162c0\"\r\nexpires: Wed, 25 Mar 2026 21:47:22 GMT\r\ncache-control: max-age=345600\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":90816,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2404)","md5":"c6e95ea2283d3a6254e7ef8df6f3aaaa","sha1":"06a194cb861a4b5bc627031915f12fed31f660d5","sha256":"cec1c55246920cf7576237abb8db6ed88df513cb8480702adb607c94c7a7a7f3","sha512":"052fd320e7a8c368719384fb6b86e3aabc9e95221d07ce7d65e7f918dc7f7a5f971ee89ae2e5746e14dd5ed86b2059a505781378bc7018f2485b1e93c842aa8d","ssdeep":"1536:excVvHIy0IZMqj/S1PqvJflMSnAk7Zu/2:bZa+1n9u+","tlshash":"4a93c59f5ab1ad08782bc15b74c5761c2b3c9b87d505ee2a9ed930188f80ed5b83370e","first_seen":"2026-01-29T23:12:50.891319Z","last_seen":"2026-06-26T16:40:45.47829Z","times_seen":550,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/js/widget-frame.js?66","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://oauth.telegram.org/embed/safepal_guru_bot?origin=https%3A%2F%2Fweb.safepal.guru\u0026return_to=https%3A%2F%2Fweb.safepal.guru%2Flogin\u0026size=large\u0026userpic=true\u0026request_access=write\u0026radius=8","date":"2026-03-21T21:47:21.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Mon, 11 Aug 2025 13:36:48 GMT","end":"Sat, 12 Sep 2026 13:36:48 GMT"},"fingerprint":{"sha1":"85:08:98:2F:A3:60:90:21:E8:78:21:C8:A4:96:E1:A2:E6:9D:2C:64","sha256":"49:35:FF:BC:17:D1:E9:B3:15:37:E4:67:C2:3A:A0:69:6C:37:DC:52:3F:7C:02:D6:30:C4:6E:45:7C:CA:F0:D2"}}},"request":{"raw":"GET /js/widget-frame.js?66 HTTP/1.1\r\nHost: telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oauth.telegram.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0\r\ndate: Sat, 21 Mar 2026 21:47:22 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 28 Aug 2025 12:46:06 GMT\r\netag: W/\"68b04f8e-17b4e\"\r\nexpires: Wed, 25 Mar 2026 21:47:22 GMT\r\ncache-control: max-age=345600\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97102,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3713)","md5":"c4825aabfb1129de5a11f9f2377834d9","sha1":"39d76a8d35fa411e0389e1d3a0d4e9000babfc89","sha256":"53df8dbdcd2cc75a317fdbc07e08e2e75e7e25a052fa2ed03871125f67b50001","sha512":"8c4f764301c1d735c6ea364d9cbbb8a399231f83e857b4322ddb615cda594f82aab5c2ff0528938e4ef97243b1c745bc85e94522a9f5993ccb522808ecce1dff","ssdeep":"768:a3+62J1xNNt3p1SG6CwPHG+AIieDPxsyk7Te9vwCiPZZpMEZF5ibQafIw8JBgHAe:+j2jNt3Qsyk7L1ZF8sv7e6M","tlshash":"3f933f4d69f33166a477b17a9baf55093635d003110ece217d0ca394af84934abfbbe8","first_seen":"2025-08-28T14:01:30.149557Z","last_seen":"2026-06-26T16:40:45.497205Z","times_seen":998,"resource_available":true,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500\u0026family=Manrope:wght@400;500;600;700;800\u0026family=Outfit:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.090Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"63:D1:AE:99:1E:49:D7:6C:71:F3:BA:F5:BA:47:74:1E:EB:90:E7:D6","sha256":"69:90:BB:9D:82:60:82:88:FF:CE:F6:B3:3D:DD:B5:B5:FB:F0:56:17:FD:FA:0D:BC:9C:5B:83:51:98:0D:2F:CF"}}},"request":{"raw":"GET /css2?family=IBM+Plex+Mono:wght@400;500\u0026family=Manrope:wght@400;500;600;700;800\u0026family=Outfit:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 21 Mar 2026 21:47:21 GMT\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17982,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"89b86d3de9387287e123951aec204d1d","sha1":"a58fbf5a53f7a1b1bf31053826588033e78b15ae","sha256":"0d3f99f557c8061c6f4b08772dd9d19fb6f9b17fd50570148bde0d2008ff8034","sha512":"50cd35bc216988864dc7ed02bdd302bc6967dd845467487cdabad187457822be9662eb3924ba441afb45539e08d8b50468a083d34b1a331469506404dcc0691f","ssdeep":"192:ZYpZQxFPE26Bs3U3I5JDEV3WW89RJ8rV3118+4JlOV3MM8b/JGNV3TT80uJHYV3x:a3QusfwU+ME02EQx","tlshash":"ee82db90006be404eb470cd137cf7e3aad4e61567441c5ba9ffe1c98adabd222365b1e","first_seen":"2026-03-15T08:45:03.650864Z","last_seen":"2026-07-05T08:20:39.72019Z","times_seen":13,"resource_available":false,"data":null}},"time_used":262,"timings":{"blocked":113,"dns":1,"connect":21,"send":0,"wait":32,"receive":0,"ssl":92},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/js/telegram-web-app.js","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Mon, 11 Aug 2025 13:36:48 GMT","end":"Sat, 12 Sep 2026 13:36:48 GMT"},"fingerprint":{"sha1":"85:08:98:2F:A3:60:90:21:E8:78:21:C8:A4:96:E1:A2:E6:9D:2C:64","sha256":"49:35:FF:BC:17:D1:E9:B3:15:37:E4:67:C2:3A:A0:69:6C:37:DC:52:3F:7C:02:D6:30:C4:6E:45:7C:CA:F0:D2"}}},"request":{"raw":"GET /js/telegram-web-app.js HTTP/1.1\r\nHost: telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 10 Mar 2026 10:53:09 GMT\r\netag: W/\"69aff815-1c106\"\r\nexpires: Wed, 25 Mar 2026 21:47:21 GMT\r\ncache-control: max-age=345600\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":114950,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (768)","md5":"bb0a2fecf6cd27fba9cd29610fd2ccdc","sha1":"7546ed807d56be081be97fa1e4859381ecccf58e","sha256":"dc67f1e084e069a3fb629f3154765856fe0aa805a4e138bc42c228bc3d656a78","sha512":"5350795e68c371956350f88354aac62900d7fc5974817e93f49f218fa60becda436da0a8bf17d6239e2ef882cee0b18bfe66e181baa6f1ca04b57817c2920166","ssdeep":"1536:pO5TpRdoKd4F0WN2ZbBcn9cF9KTfVjLo03ueLE+wFFz1NIVIB/MGYV7p/xHK8ITq:s5TpRdfcKFU7Rx1H","tlshash":"31b33e4d6cb3612285b3b1bf8b5f924172759883301def20794d9b646f80e7c53eaad8","first_seen":"2026-03-10T21:38:17.367441Z","last_seen":"2026-08-06T08:41:46.722793Z","times_seen":775,"resource_available":true,"data":null}},"time_used":322,"timings":{"blocked":138,"dns":11,"connect":21,"send":0,"wait":42,"receive":0,"ssl":108},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-telegram-BBdFq5Ea.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-telegram-BBdFq5Ea.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 53547\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-d12b\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53547,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27147)","md5":"e570d6b369eef16b6df1ef804afb30d5","sha1":"f5c0e2b0cafc47627b1a634fbe479e03c5ff051a","sha256":"4cc4a81ac2c9ab9bc0110de413bb169ea58f453d7dbd0ad532ff85d8f3c9b141","sha512":"1cb4bc0fafa738c85a1167baa828048bd32d9db53f412dc3911db0ae36cbc3e31c31e8cb4849d227e554b506e294a830241f15624589c582239487eba5fb8baa","ssdeep":"1536:+Rydx/SnYzCqaeeIAArggc5P009DANCf0RUF:+Ryd9yx/Acx009cNxRUF","tlshash":"96331bce32a6f03203ea14fa50bb4196f36626d0740dd6f0b17cddaa355a94a4237f6d","first_seen":"2026-03-21T21:47:51.003014Z","last_seen":"2026-03-21T21:47:51.003014Z","times_seen":1,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-i18n-MEDaAegx.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-i18n-MEDaAegx.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 55283\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-d7f3\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55283,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (55266)","md5":"0fb5e12b80a26c957b440999f2e1b6ef","sha1":"fce1b3ceb86619727af37a3fba3ce6e85c705fca","sha256":"7bb2127d4fbd991dc48c9272a553ce6a6d330779075920cbfd3043e586ceb58d","sha512":"ede68e4118e62461f8f77b48052cef4645c8fa9fc4210c6630a4a0417dd87e81602f0d9a4f38a8b8160653cab5f7e5afbd4b503f0884d8f91590f96ad8faa076","ssdeep":"768:Z1Y9CoeLEysbGrnsYRzDP4lwAcPRH+Q7ohKmHdT1Mlm+VrpQoTCwzUhUSEFvlstA:ycs8gnnckgiKvLOjf1GPILJfSn","tlshash":"3c431ac971ebaa2643ea80d530701504a635ad553448684dfe7cafe7e4d3e0a93fbb34","first_seen":"2026-03-15T08:45:03.634678Z","last_seen":"2026-03-21T21:47:51.003899Z","times_seen":3,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/api/cabinet/branding/themes","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.527Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /api/cabinet/branding/themes HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/json\r\ncontent-length: 26\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"63792c0b7e6b2253a9b201ef93882cf4","sha1":"093611cf5534d107d94a56eec7b0585e6b22e547","sha256":"6868e08bf0c55cb499255d6a1400997ec06aef82da5ee27499de4b110c6b4d7e","sha512":"b1f72115333f19701d48e568a3009373ad812f63f43648cd147a226c7237362017afff5c2111cae505aae84674822f45fc93a15d5a9fbe752465592a600ad43f","ssdeep":"","tlshash":"6d8000022c000038c000088a8208ff280a3c023200000008e0cca08a283020e8023003","first_seen":"2026-02-06T20:59:00.808391Z","last_seen":"2026-07-08T09:00:37.219002Z","times_seen":7,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/manrope/v20/xn7gYHE41ni1AdIRggexSg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://web.safepal.guru\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 24836\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 18 Mar 2026 19:26:21 GMT\r\nexpires: Thu, 18 Mar 2027 19:26:21 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:08:28 GMT\r\ncontent-type: font/woff2\r\nage: 267660\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24836,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24836, version 1.0","md5":"938c6e8019b69313372c47dbb7a7c930","sha1":"b42951014c5eca12749d87a4706caf22dc4fe081","sha256":"a30ddcd349703aff7464c34bef3fffdff405ee50c113440d7c8693c02d210972","sha512":"5537c005cd8f321f26fe67f6292b3ec14e88ff4b2365311628dbbe4753e01e568f6881b9f2e7d71e8e6b2c261ed25f372829dd28f89f865ce574b4e1fec29614","ssdeep":"768:3KQaj5c95F1QmIwa55Go1COpZLpkkM46CU+YIC:ahj5cXow65xCM5pkkM468YB","tlshash":"a2b2f105ee49b3d4b276f1fcfa802884179282f27dabda8f3f2015981dd8e5b8d45320","first_seen":"2025-06-02T20:09:41.98255Z","last_seen":"2026-08-14T06:47:26.395684Z","times_seen":38005,"resource_available":false,"data":null}},"time_used":365,"timings":{"blocked":176,"dns":0,"connect":21,"send":0,"wait":8,"receive":2,"ssl":155},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/css/font-roboto.css?1","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://oauth.telegram.org/embed/safepal_guru_bot?origin=https%3A%2F%2Fweb.safepal.guru\u0026return_to=https%3A%2F%2Fweb.safepal.guru%2Flogin\u0026size=large\u0026userpic=true\u0026request_access=write\u0026radius=8","date":"2026-03-21T21:47:21.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Mon, 11 Aug 2025 13:36:48 GMT","end":"Sat, 12 Sep 2026 13:36:48 GMT"},"fingerprint":{"sha1":"85:08:98:2F:A3:60:90:21:E8:78:21:C8:A4:96:E1:A2:E6:9D:2C:64","sha256":"49:35:FF:BC:17:D1:E9:B3:15:37:E4:67:C2:3A:A0:69:6C:37:DC:52:3F:7C:02:D6:30:C4:6E:45:7C:CA:F0:D2"}}},"request":{"raw":"GET /css/font-roboto.css?1 HTTP/1.1\r\nHost: telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://oauth.telegram.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0\r\ndate: Sat, 21 Mar 2026 21:47:22 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 20 Oct 2022 11:05:33 GMT\r\netag: W/\"63512b7d-1816\"\r\nexpires: Wed, 25 Mar 2026 21:47:22 GMT\r\ncache-control: max-age=345600\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6166,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"c706681409217a14a24c7e2deb8cf423","sha1":"08b443fe5bc6a223a9de08fb56282365b1d13857","sha256":"84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974","sha512":"2520a5417426cea58972529b3776713958ff259cc8467ebafbe291bd040e27195054c4133f4a9518d78da38ddf4f7cdac64da0813da33bbe707ad13af5baa7c1","ssdeep":"192:KR6tGVFJ3qFl5p3AkmztIZa+XqtRcalH9:wTY7t8t","tlshash":"53d18b40485a6000eb871cd677cf7e3abd8e55053042c576effd14a8adebc269368b4e","first_seen":"2023-05-29T15:15:29Z","last_seen":"2026-08-13T20:39:07.301112Z","times_seen":19255,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-i18n-MEDaAegx.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-i18n-MEDaAegx.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 55283\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-d7f3\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55283,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (55266)","md5":"0fb5e12b80a26c957b440999f2e1b6ef","sha1":"fce1b3ceb86619727af37a3fba3ce6e85c705fca","sha256":"7bb2127d4fbd991dc48c9272a553ce6a6d330779075920cbfd3043e586ceb58d","sha512":"ede68e4118e62461f8f77b48052cef4645c8fa9fc4210c6630a4a0417dd87e81602f0d9a4f38a8b8160653cab5f7e5afbd4b503f0884d8f91590f96ad8faa076","ssdeep":"768:Z1Y9CoeLEysbGrnsYRzDP4lwAcPRH+Q7ohKmHdT1Mlm+VrpQoTCwzUhUSEFvlstA:ycs8gnnckgiKvLOjf1GPILJfSn","tlshash":"3c431ac971ebaa2643ea80d530701504a635ad553448684dfe7cafe7e4d3e0a93fbb34","first_seen":"2026-03-15T08:45:03.634678Z","last_seen":"2026-03-21T21:47:51.003899Z","times_seen":3,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/api/cabinet/branding/logo","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /api/cabinet/branding/logo HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 15217\r\ncache-control: public, max-age=3600\r\naccept-ranges: bytes\r\nlast-modified: Sat, 21 Mar 2026 21:45:04 GMT\r\netag: \"1566292fc4965071601bd172fa33c919\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15217,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1080 x 1080, 8-bit/color RGBA, non-interlaced","md5":"8cbda24112f1307eef9f0bd423f00d74","sha1":"64e38be32d975b876ec82ef335f90a32a3622691","sha256":"32fd46923b92ecc9bfdae23f1a0f6cb552f51bb6fd7b4f93a3a31bfba24eac05","sha512":"7ddad2063a5426959e3f73dbe42840bed087fae4ffb538aaa2ea76f0a56f01ffea2aac7d3d3d2bf0c383935c1374383cb55507697f55f0a5f19bdee4b2884351","ssdeep":"384:JrJ1xQnmwIqpfxieB14Zk/pBxsQjsoZoH8W9ro:j1xlwI6fxRk+3su9o590","tlshash":"0862e8fc42106a658184f16af9350d156a9e9794308ef2eeeb277b61cadd17cf113e0c","first_seen":"2026-03-21T21:47:51.006366Z","last_seen":"2026-03-21T21:47:51.006366Z","times_seen":1,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-motion-UFPSjczj.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.324Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-motion-UFPSjczj.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 121523\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-1dab3\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":121523,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"31c1e74e07164f8d0d0d13d66ac74015","sha1":"785c13ca0bfa473a1358108a52db154921f8fa64","sha256":"53db062b58f25fa72719101f3e05db761b0712da198094035295d0c58b756c5a","sha512":"059dd6be60ce008d19eec5d47d1736f1a74242499437b70c34e5c25e7ff4dfbd75c839490bea422ac5d1d56896d7f6419ddf948fe0889b1148e18ba3e3d000c1","ssdeep":"3072:5yEIcCQdCSpoI3Ziaaq6+aEWjTRImtjlbb8w4D/Kmh:6cCQdCSpopaaP+aE0RNjB8JDimh","tlshash":"31c308c572917162d3db85e9c0bf0741b73628943009c0acb63dadcb7d2154aa6bbb7e","first_seen":"2026-03-15T08:45:03.654791Z","last_seen":"2026-04-28T18:47:16.458724Z","times_seen":4,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-radix-Il3hGQzs.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-radix-Il3hGQzs.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 24842\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-610a\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24842,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (24841)","md5":"b40f44f8e9d54ba24ba76950e087d7e2","sha1":"95262238e93cf7eed138d22082c9af7654662cca","sha256":"48b62638306f8dfeea0120af63b4f1e38e10a5742860c9a4d7180c480f552c2d","sha512":"6da8eac018fce340d0250c714590092889dc53be7507888b3cba54cbf6e995316a32b6fe4a98799e5384ef99e4023001f30d61f7b4fe0be23b7cbf253299da06","ssdeep":"768:nIo3ZBTZlbaKaUcTQBypF9JcVP+3bYNVRGVxGyxLQOWDjbWWnUd:IsTuQBb+IAxGJzUd","tlshash":"b8b218d62042b970c7a884d6847fc52cbb371a28305e4490f17d9c6e2daa541e6b7ffe","first_seen":"2026-03-15T08:45:03.660034Z","last_seen":"2026-04-28T18:47:16.449291Z","times_seen":4,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-query-CeH3LFOn.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.449Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-query-CeH3LFOn.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 39678\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-9afe\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39678,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39677)","md5":"37bfd45eaeef354c1ba152a94281f471","sha1":"f7227b2b202729f1eec5e41e0cfa72775ba7776d","sha256":"1e7298e495979d1f8b6170dd94ea839588664cf2e370cc48e49dedb0faeae7dc","sha512":"c14684fed55f8cf0051180bee320f11536df0be3e457f19b80e4de4b48f9635975fb202c90a9c6b0b4d43bc4f5cac88d79fc36dca313f1bbddf19079fa41ca79","ssdeep":"768:wL5E3W/hGHp4eQhasJ2DloIvsGPx8By9GNODyflgJGeVn6B+ucxT18VJRuA+j93O:wVx2hdvoBa8Y793+8gl","tlshash":"8403b9d67146a2273ad18491dc3e4125e2346d04340a806cbafcade7f963dcef5bea35","first_seen":"2026-03-15T08:45:03.658237Z","last_seen":"2026-03-21T21:47:51.008392Z","times_seen":3,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-motion-UFPSjczj.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-motion-UFPSjczj.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 121523\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-1dab3\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":121523,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"31c1e74e07164f8d0d0d13d66ac74015","sha1":"785c13ca0bfa473a1358108a52db154921f8fa64","sha256":"53db062b58f25fa72719101f3e05db761b0712da198094035295d0c58b756c5a","sha512":"059dd6be60ce008d19eec5d47d1736f1a74242499437b70c34e5c25e7ff4dfbd75c839490bea422ac5d1d56896d7f6419ddf948fe0889b1148e18ba3e3d000c1","ssdeep":"3072:5yEIcCQdCSpoI3Ziaaq6+aEWjTRImtjlbb8w4D/Kmh:6cCQdCSpopaaP+aE0RNjB8JDimh","tlshash":"31c308c572917162d3db85e9c0bf0741b73628943009c0acb63dadcb7d2154aa6bbb7e","first_seen":"2026-03-15T08:45:03.654791Z","last_seen":"2026-04-28T18:47:16.458724Z","times_seen":4,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/manrope/v20/xn7gYHE41ni1AdIRggOxSuXd.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/manrope/v20/xn7gYHE41ni1AdIRggOxSuXd.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://web.safepal.guru\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 14500\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 15 Mar 2026 00:19:00 GMT\r\nexpires: Mon, 15 Mar 2027 00:19:00 GMT\r\ncache-control: public, max-age=31536000\r\nage: 595701\r\nlast-modified: Thu, 04 Sep 2025 17:09:13 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14500,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 14500, version 1.0","md5":"e58febde317b69ceb51690ea201850c9","sha1":"d8fc94bf7a39043a7759bd564a7e16b3ea080736","sha256":"c268b459a9329e59fecf39a17618efd44c71735532048d60b12aab76a8c14914","sha512":"af17f0a6913d974bd7d38a060549dacd158c667abb08f830d44d302c1a1cb4f8106eeeb772d2b4066be2c5a1e763d26042c707343770f5e84b0f5165cab9d96b","ssdeep":"384:4VvSHMmDtGjtHrBRvGjLWPSNRXZpyJ+kC18bZ:4VvSsmDt6LBROj1RXZ4J+318bZ","tlshash":"8a52b05ef04e86f0b51f2a7ece5c6a1153725e56134f2e50e967b0c8c75e82a1e27142","first_seen":"2025-06-05T11:45:07.756161Z","last_seen":"2026-08-14T06:33:03.013294Z","times_seen":3737,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":15,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-react-Cvri6UMh.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.312Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-react-Cvri6UMh.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 253019\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-3dc5b\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":253019,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (42454)","md5":"3bf71f321fb2742867c80d660c7d2a77","sha1":"44d7596a8ed071c0c064eea2eadd200dbfdf6a5d","sha256":"3e123e2104d5d46946d94dbe9be302c1efabd852df33d98372408e84d9ebb0be","sha512":"de53072a116624a4461da68c2e3c289c737309975a9f516b0815096425f2f9500ae48a7a85340fd63e0d66e7f2adcbc5e2f9155fe08a4aae8b8bd8f27f6591ea","ssdeep":"3072:t8sQmPMhfADyNRlOzhZi/2roVMMBwhSEFaByhKY/203w2prq7hjw8e/sbWLnSrl:KmPMckjO4BSMctLnyl","tlshash":"1b342ce832ad76666fb252a500af110772782c33240d8861f165fd9e36b444a51fbffe","first_seen":"2026-03-15T08:45:03.648626Z","last_seen":"2026-04-28T18:47:16.452328Z","times_seen":4,"resource_available":true,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-query-CeH3LFOn.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.314Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-query-CeH3LFOn.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 39678\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-9afe\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39678,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (39677)","md5":"37bfd45eaeef354c1ba152a94281f471","sha1":"f7227b2b202729f1eec5e41e0cfa72775ba7776d","sha256":"1e7298e495979d1f8b6170dd94ea839588664cf2e370cc48e49dedb0faeae7dc","sha512":"c14684fed55f8cf0051180bee320f11536df0be3e457f19b80e4de4b48f9635975fb202c90a9c6b0b4d43bc4f5cac88d79fc36dca313f1bbddf19079fa41ca79","ssdeep":"768:wL5E3W/hGHp4eQhasJ2DloIvsGPx8By9GNODyflgJGeVn6B+ucxT18VJRuA+j93O:wVx2hdvoBa8Y793+8gl","tlshash":"8403b9d67146a2273ad18491dc3e4125e2346d04340a806cbafcade7f963dcef5bea35","first_seen":"2026-03-15T08:45:03.658237Z","last_seen":"2026-03-21T21:47:51.008392Z","times_seen":3,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-react-Cvri6UMh.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.447Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-react-Cvri6UMh.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 253019\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-3dc5b\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":253019,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (42454)","md5":"3bf71f321fb2742867c80d660c7d2a77","sha1":"44d7596a8ed071c0c064eea2eadd200dbfdf6a5d","sha256":"3e123e2104d5d46946d94dbe9be302c1efabd852df33d98372408e84d9ebb0be","sha512":"de53072a116624a4461da68c2e3c289c737309975a9f516b0815096425f2f9500ae48a7a85340fd63e0d66e7f2adcbc5e2f9155fe08a4aae8b8bd8f27f6591ea","ssdeep":"3072:t8sQmPMhfADyNRlOzhZi/2roVMMBwhSEFaByhKY/203w2prq7hjw8e/sbWLnSrl:KmPMckjO4BSMctLnyl","tlshash":"1b342ce832ad76666fb252a500af110772782c33240d8861f165fd9e36b444a51fbffe","first_seen":"2026-03-15T08:45:03.648626Z","last_seen":"2026-04-28T18:47:16.452328Z","times_seen":4,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-twemoji-BrQQgBPK.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.456Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-twemoji-BrQQgBPK.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 22706\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-58b2\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22706,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (22701)","md5":"b327a5611dfb33e22fa950ef4adf892f","sha1":"ed30103a58803c40355c2f35e8045308426a765a","sha256":"b51943e1282a65892027008b35b98cba7f56e714547a3b33691767a4f3217ae3","sha512":"d8ff6054ef686854e758cf947d686942ec68e998fb86ec30dce4fbdac5e9584ac5ceb1f104fdf5ea942a37cf0e5af3f13f2db5cd2f1d8355382d022cdc333b7e","ssdeep":"384:rdTPvZpRZTbXU/3j//bEPhXgA5hqmwJldEcbJ36Use:rdTPR9XU/3j//YpXgAiblqcVqUse","tlshash":"2da2b38bb33a5e8f747e3bd78d968f4dd59a555321c0f078dbeaf6c129a00968274c80","first_seen":"2026-03-15T08:45:03.652779Z","last_seen":"2026-04-28T18:47:16.44839Z","times_seen":4,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/api/cabinet/branding/analytics","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.524Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /api/cabinet/branding/analytics HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/json\r\ncontent-length: 65\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"2749df54454ff27078d380cd29bd5e9a","sha1":"f96a493997dc0f4e9e5e8af37fc058c0b0f0b02a","sha256":"c8089d9e664c12c3a61a4166eebebe1ac7c387453c1ffa3db8bfd13e69524489","sha512":"96a14ab719b4ece2ee3095a46cfcbdb78ae807c70a36f2bb37215865c64173de63b9f1c47f21ea3c06abbf4dd1cdbf3574aa1e54abdc05461956169a61132740","ssdeep":"","tlshash":"f3a0024ab410c4d3c8daa0cf88c0e4820cd24500c0287d0cc94c0c2c31d80089b19494","first_seen":"2026-02-06T20:59:00.799369Z","last_seen":"2026-04-28T18:47:16.453267Z","times_seen":7,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/en-BTMBPQzI.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/en-BTMBPQzI.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 125286\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-1e966\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":125286,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (65489), with no line terminators","md5":"cfab601fa49eabf03ef0c2683d8ec8cb","sha1":"049f240b269e17a98a2efd020ab272a26995c022","sha256":"2bc38fdbd032f2c1bc518d6e14b10ea66bdb7b003786ae1f0848049612385bf0","sha512":"d19624290aa9ec43ffd28ce9d0b6f293aa9f689be15f87043e4033c735f491ea3dace8859ad585500a5a3aaa80d7b89cad43f0e5261c26bef8248122c0ac8afe","ssdeep":"3072:E7V+at7fh4yp0VSvhdJZap5I+bE4oBwxVmcQc4jXhw9U:EsM75dbapu4kwzmcQc4jXhw9U","tlshash":"2dc3070b49066eba0bc753eb7cd75f5636f902a791a084a0dccdc12d01e9bd8f22f659","first_seen":"2026-03-21T21:47:51.011333Z","last_seen":"2026-03-21T21:47:51.011333Z","times_seen":1,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":24,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://oauth.telegram.org/embed/safepal_guru_bot?origin=https%3A%2F%2Fweb.safepal.guru\u0026return_to=https%3A%2F%2Fweb.safepal.guru%2Flogin\u0026size=large\u0026userpic=true\u0026request_access=write\u0026radius=8","date":"2026-03-21T21:47:22.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Mon, 11 Aug 2025 13:36:48 GMT","end":"Sat, 12 Sep 2026 13:36:48 GMT"},"fingerprint":{"sha1":"85:08:98:2F:A3:60:90:21:E8:78:21:C8:A4:96:E1:A2:E6:9D:2C:64","sha256":"49:35:FF:BC:17:D1:E9:B3:15:37:E4:67:C2:3A:A0:69:6C:37:DC:52:3F:7C:02:D6:30:C4:6E:45:7C:CA:F0:D2"}}},"request":{"raw":"GET /fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 HTTP/1.1\r\nHost: telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://oauth.telegram.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.org/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0\r\ndate: Sat, 21 Mar 2026 21:47:22 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 11028\r\nlast-modified: Thu, 20 Oct 2022 11:05:33 GMT\r\netag: \"63512b7d-2b14\"\r\nexpires: Wed, 25 Mar 2026 21:47:22 GMT\r\ncache-control: max-age=345600\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11028,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 11028, version 1.0","md5":"1f6d3cf6d38f25d83d95f5a800b8cac3","sha1":"279f300ca2cbbdf9f5036ef2f438607fbf377daa","sha256":"796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f","sha512":"716305f4d2582683b64c61b5e2390983579ea0fb33c936dd3ea8362872176625fbcb6f5ad18d2abf85da82d14c33a9640dfc5749922cb2fc079ddf37864f361f","ssdeep":"192:4oijUxKA0B3BxJPeLrh00JWNhi5A5HWdZ6SfroKthzwbMcYfQKvwpFVX2T+:Nx4bexHAE6STltlwbMcovaET+","tlshash":"9032cf5eaa417172974b5791e296fbc0e627186438fb02fef85185bbc4045e437092be","first_seen":"2023-04-05T08:50:36Z","last_seen":"2026-08-14T01:18:36.665142Z","times_seen":75671,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.safepal.guru/assets/vendor-telegram-BBdFq5Ea.js","fqdn":"web.safepal.guru","domain":"safepal.guru","tld":"guru"},"ip":{"addr":"194.33.61.24","port":443,"asn":60781,"as":"LeaseWeb Netherlands B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.safepal.guru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Mar 2026 20:37:04 GMT","end":"Fri, 19 Jun 2026 20:37:03 GMT"},"fingerprint":{"sha1":"94:7C:45:9F:CD:01:E1:26:16:FF:2B:5C:14:61:2F:AF:AB:5D:79:87","sha256":"0B:90:BA:37:3F:F3:E1:AF:25:BC:3C:73:3E:11:9D:5A:C1:4A:06:8A:2C:76:3D:18:91:F3:69:8E:BE:02:A0:03"}}},"request":{"raw":"GET /assets/vendor-telegram-BBdFq5Ea.js HTTP/1.1\r\nHost: web.safepal.guru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/assets/index-CkrgauFY.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 53547\r\nlast-modified: Sat, 21 Mar 2026 21:00:58 GMT\r\netag: \"69bf070a-d12b\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53547,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27147)","md5":"e570d6b369eef16b6df1ef804afb30d5","sha1":"f5c0e2b0cafc47627b1a634fbe479e03c5ff051a","sha256":"4cc4a81ac2c9ab9bc0110de413bb169ea58f453d7dbd0ad532ff85d8f3c9b141","sha512":"1cb4bc0fafa738c85a1167baa828048bd32d9db53f412dc3911db0ae36cbc3e31c31e8cb4849d227e554b506e294a830241f15624589c582239487eba5fb8baa","ssdeep":"1536:+Rydx/SnYzCqaeeIAArggc5P009DANCf0RUF:+Ryd9yx/Acx009cNxRUF","tlshash":"96331bce32a6f03203ea14fa50bb4196f36626d0740dd6f0b17cddaa355a94a4237f6d","first_seen":"2026-03-21T21:47:51.003014Z","last_seen":"2026-03-21T21:47:51.003014Z","times_seen":1,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-21","alert":"Sinkholed","trigger":"web.safepal.guru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.org/js/telegram-widget.js?23","fqdn":"telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.safepal.guru/","date":"2026-03-21T21:47:21.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Mon, 11 Aug 2025 13:36:48 GMT","end":"Sat, 12 Sep 2026 13:36:48 GMT"},"fingerprint":{"sha1":"85:08:98:2F:A3:60:90:21:E8:78:21:C8:A4:96:E1:A2:E6:9D:2C:64","sha256":"49:35:FF:BC:17:D1:E9:B3:15:37:E4:67:C2:3A:A0:69:6C:37:DC:52:3F:7C:02:D6:30:C4:6E:45:7C:CA:F0:D2"}}},"request":{"raw":"GET /js/telegram-widget.js?23 HTTP/1.1\r\nHost: telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.safepal.guru/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0\r\ndate: Sat, 21 Mar 2026 21:47:21 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 03 Apr 2023 11:46:12 GMT\r\netag: W/\"642abc84-4ff5\"\r\nexpires: Wed, 25 Mar 2026 21:47:21 GMT\r\ncache-control: max-age=345600\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20469,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (423)","md5":"1ff8b98c72268de58837846f2056c65a","sha1":"e77fcc14f1efd17d319c9f82627e5789333b9dbe","sha256":"0f6cdd09b3bbebf50c4e1679aff6f021f5e183a4ba2dea3a0801394599ff6afd","sha512":"1a680a7e87f16520da934f4034cdc601ebef9c306c7f5e3ea165588f044142cadcf5eb06cefedc8ea7768ff63830586a2776351c7b9429f1e33b639adca5f1ed","ssdeep":"384:+vLsc8o/o9o7IFdWDoCzh3o4t6/7c8cBoYgNqPb:YLfwu7SU0CF3gLcHPb","tlshash":"2492819e1af72224a567713a4b5fa1093232e163700ddc503e6c5b90bf90a6767b0fdd","first_seen":"2023-04-05T01:44:44Z","last_seen":"2026-06-29T16:20:15.623033Z","times_seen":2919,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}