{"report_id":"744f8b7b-9723-4d21-b032-b58a2762ba8d","version":6,"status":"done","tags":[],"date":"2026-05-12T18:01:38Z","url":{"schema":"http","addr":"workoff.org","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"104.21.73.89","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"title":"WorkOff","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"workoff.org","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"104.21.73.89","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-16T18:01:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.tailwindcss.com","ip":{"addr":"172.67.68.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-07-20","domain_rank":117330,"first_seen":"2018-07-09T05:46:13Z","last_seen":"2026-05-11T06:49:28.089446Z","alert_count":0,"request_count":2,"received_data":815991,"sent_data":814,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.251.143.131","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-05-10T22:17:57.86744Z","alert_count":0,"request_count":3,"received_data":141637,"sent_data":1613,"comment":"","tags":null,"fingerprints":null},{"fqdn":"api.fontshare.com","ip":{"addr":"13.42.130.243","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-10-01","domain_rank":604295,"first_seen":"2021-03-02T20:36:57Z","last_seen":"2026-05-08T12:13:47.590081Z","alert_count":0,"request_count":1,"received_data":1653,"sent_data":452,"comment":"","tags":null,"fingerprints":[{"name":"Erlang","description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","website":"https://www.erlang.org","common_platform_enumeration":"cpe:2.3:a:erlang:erlang%2fotp:*:*:*:*:*:*:*:*","icon":"Erlang.png","categories":["Programming languages"]},{"name":"Cowboy","description":"Cowboy is a small, fast, modular HTTP server written in Erlang.","website":"https://github.com/ninenines/cowboy","common_platform_enumeration":"","icon":"Cowboy.png","categories":["Web servers"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.251.142.234","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-05-10T22:20:44.526759Z","alert_count":0,"request_count":1,"received_data":10625,"sent_data":577,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"216.58.201.232","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-05-10T22:25:41.533246Z","alert_count":0,"request_count":1,"received_data":478221,"sent_data":432,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-05-10T22:41:13.190184Z","alert_count":0,"request_count":1,"received_data":34552,"sent_data":450,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"workoff.org","ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-19","domain_rank":0,"first_seen":"2026-05-12T18:01:40.888248Z","last_seen":"2026-05-12T18:01:40.888248Z","alert_count":24,"request_count":24,"received_data":4911547,"sent_data":27801,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"FingerprintJS:3","description":"FingerprintJS is a browser fingerprinting library that queries browser attributes and computes a hashed visitor identifier from them.","website":"https://fingerprintjs.com","common_platform_enumeration":"","icon":"FingerprintJS.svg","categories":["JavaScript libraries","Browser fingerprinting"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"25349d9971543c3559e817df0dc070cb","sha1":"e8a901516729729b69522aa56268a5b59b58776f","sha256":"c5609e7d7f3d5e6d904bb3d6689ffb1596d01ae30ba904eb19b7cfff43a70b36","sha512":"7ea37d37d0a78200844a2cb7fdd9d0234d62111272aee39c92097beaaeebd1e604e813d76cea526a5fba0e4012ac9edaac9d67536bb6da87eb2c5916593e05a2","ssdeep":"","tlshash":"fc01c95b2c43b49633fa263cc327a66a27220703a8c2d405ba4dc4642f98a81289298e","size":677,"data":"","first_seen":"2026-05-12T18:01:45.086434Z","last_seen":"2026-05-12T18:05:02.01517Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"375436f436cc1022d7b4569a817c1a6b","sha1":"9359415cc419874654000870ca54523875c12c16","sha256":"99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae","sha512":"077cb9e67a028f8ffc6c9f19793c15e20379840da1a927e711a0ac4dcf15fe6e1a15cee75436df340c707b9e77118f3cd38ede493e060c592069f39bc6001a92","ssdeep":"384:chQYSwHRBcifEJzXhGUa4LdsF7wRuCfLVg5+pCqNFaiE8E0QIQfJW7us6RfGDUPX:cSMHRU7Lic9NwlJW5iffPREA75","tlshash":"c5e207d8b2c3b029227378b6497f6007b63abd15242d4843d57be4c17ca5e5a813bfb9","size":33780,"data":"","first_seen":"2023-07-07T04:22:54Z","last_seen":"2026-05-15T06:48:02.517191Z","times_seen":8267,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f17bb224e57e022296cf748249c88eae","sha1":"b87ac6c059f29a8825943b0644091008cf85e63e","sha256":"3c3594056beadf645e4af5c47537008c7004c75fe02e48795d0245f6e39e8ddb","sha512":"ee5d6cc54c82b5b57fd8b47e8dc53e1849295998245de2e4aa189687920aa7cd26de9580e9bb14ad2afebf4089c6d3f881cc0f36c28be477fc10f04bae4e1649","ssdeep":"","tlshash":"eec08c8c214b0d7046b72a014f2fa200b056321294d1a932391e63054f20e03d744914","size":180,"data":"","first_seen":"2026-05-12T18:01:45.089803Z","last_seen":"2026-05-12T18:05:02.01592Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/assets/scripts.v2.js?v=1775648986","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cac5ab8b36649ee83c84ce19aa530280","sha1":"757166b4b3c58e9f96e4e98a2ebb70bc71fd70b1","sha256":"7665c0df4c150b8585fe010341cdea3105016475f079537653ebd6de88f649fa","sha512":"8e4894d096a1d2e43af7440f856284083f327cc3627fa5f625da5b240caf9c7fdd89b9e52e09ebe4545055b0b12847b17c23bc791c6d9fdf1819a6f4dd040aa7","ssdeep":"384:horBESrkwHRvVMaAS7pNyfXmG1Hx1S2tTUeD01yam:irBVkQvwXtMgam","tlshash":"7972935931b3103546a7a2ff9bcb6748352820173406c4a93edd85681fe3e98e9b7bdc","size":17530,"data":"","first_seen":"2026-05-12T18:01:45.084017Z","last_seen":"2026-05-12T18:05:01.9896Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c03ba37e6ea3237a8e9a41896735f8a8","sha1":"4e89b346d8bfd7a4789162e8a119d9ca340e43e7","sha256":"256e5e00a16f5fdba2baf6ac8081fd8f7d4b95c09086dc651f0606948c290687","sha512":"81669dae4bd6ce6a6393d07f1e36a9766f0ab16173380fe34e00c49bc19cb8aad9ab5bc22472c8d2ec0f835d6310c54612fb712b964dbdce0470d4c74e1c8754","ssdeep":"","tlshash":"39e0c26a7486503a13b6596a23b6814b2527270bc45a86237a5fc5e66b24c56058644c","size":293,"data":"","first_seen":"2026-05-12T18:01:45.091394Z","last_seen":"2026-05-12T18:05:02.016587Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"23e1c61ccde1724c8f662624efe57c9d","sha1":"0697408edeca2328e42f54282faee3df23dfbc86","sha256":"f2394b1aecf444eab903db1bbaa9181dc16e4eff90f5b394cced71ef049f0afe","sha512":"8e258bc32bcf9596a48cbf07b9daacaf6f65aa7b84ae3d245f225638e816a5ff65536a552c89642d8c752aea05ff17965a1213683239ac76dec30c3a1a79e382","ssdeep":"96:WTv0PhZeWgcxuSGbms9VThYFa91B7obtHWJCSqokI:2vmEWgcxuSGbtdhY891BMt2JQDI","tlshash":"13a142583bd351a1b5a3637e0bef2008b435f11b256ec714782ee520bfa2528566cece","size":5070,"data":"","first_seen":"2026-05-12T18:01:45.093224Z","last_seen":"2026-05-12T18:05:02.01732Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-05-15T16:20:31.235969Z","times_seen":339934,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c23ebb5fcb738a16aa7866cf490913b3","sha1":"609b22834742b5b1c49ef6fd0335f71081ed965f","sha256":"acb5ad7fb664db4fd76dc7b2a353959ddf9fc4af2731fd29d0333c1402cf4ccd","sha512":"440d7458158bbf848dfd0538e557f6dceef98d19002cd989ebde36e9e41f4978531e7759fbf48cc8281bc0e1ec2d54a54841d318fdd5c0b2dba2ff4298252547","ssdeep":"96:81s16wYcFdU17hI1VrC7HzjbifabWNqszTrXlWY6yD2:as1qcFdUzI1VrC3q8szTrXlWY6yD2","tlshash":"3ee17258c0e715c85822757b8b7fb50a20f140373e0ade61b95e6e202fed51ca21eeed","size":7117,"data":"","first_seen":"2026-05-12T18:01:45.094842Z","last_seen":"2026-05-12T18:05:02.018092Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/assets/telemetry.js?v=2","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8d9987911b87b750c56c0eeee5685da","sha1":"0f8970e620abbb15214c20fb4a4a5600ea7a70f8","sha256":"0602386f6debd2ed7a54d6448cdc1382a88a1fa1ddd02150796a234adcb1d304","sha512":"2b809e079beb8bd3c897412d9e135fcb35660c0a4fdd3968afab6f689a672cb4ce16d68e57d7b590b27e196bcec9dcb9eb751dd0ef12458dcc3e4c3a5abefd30","ssdeep":"96:kj9K3AYoqjy8TTP5J+TD8I3rJ/UbLLOjhhpn+aMNvQGqeB2uY71sY3HYDL3b:M9K3AYoGpJqPrBe6jNn+aMe7eAuYBYnb","tlshash":"49a163e6687b34314a27a07e275f520676339053388aec427b9d49107f89a1c82b7fed","size":4978,"data":"","first_seen":"2026-05-12T18:01:45.05293Z","last_seen":"2026-05-12T18:05:02.002906Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"66aaea45bb4a5dc933cc7c0106328266","sha1":"5c8459bd43322e4a66a7481f854aa11afadc8f55","sha256":"a14e5bfd51bbd8960ffadb0eb342173e8a2e33ae049a20a8397019298d358b89","sha512":"751604024a3cda09617f80424b617b6fcae647aae357db1e6d9e27b7335f7d34109daf595712ed0c81d5d4f5d09223c0b2cf59325d5bb2d7c9548872508cc088","ssdeep":"","tlshash":"a581860977e32092b163727bc7eb11193d38a5671200ea00341e7a21ef76b9c72749fa","size":4086,"data":"","first_seen":"2026-05-12T18:01:45.097168Z","last_seen":"2026-05-12T18:05:02.019181Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"bfe6ab9b6e9fb1a39d49568460b7241b","sha1":"3819d61e5b817e1e96080e538661ee3c3df4576f","sha256":"fb1464582be30accf28f420f0d454717a544a25a7080329d45e09db160fc7e7e","sha512":"8e0d8cd28f4b68e5acffb0a83592da8aaa7e85541f8a13bd6f4fc4c41ee32bd9b6eca3f126ae064ab0c767c050e90532addd2eb6641a16182940a9400e23ab77","ssdeep":"","tlshash":"2bd0c26194340ebb407f49c563c359cc2b18d48fa4408057324c86492f57a9049e20fe","size":279,"data":"","first_seen":"2026-05-12T18:01:45.098461Z","last_seen":"2026-05-12T18:05:02.02001Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-88YW3Y127C","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"216.58.201.232","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b47b601de59c412e86982388456f3725","sha1":"c000644adffb3dca72068edd42c169191855cd7f","sha256":"2b2890b3276ef05b064c8379298e1583211db0eef3ba698bffac3364e64d41bb","sha512":"e8b7eaa6b20558883a83eb72b9600466dd69bb484b5f0e17da2a8ec0ddfc6035af2ee55defd24e5b5f8660e0a4140250e81fcdfd2091c2074d0d97c28b8102a7","ssdeep":"6144:vcElo1RCCROOCNMnmPwPvkzmnpFhvO+h2Uqopi9Ix:vWCCYNMnI+fqCpx","tlshash":"2ca4e7cdb3d674625396f478903f018ba57b29a2b44cc899f189cce42e7469a4237f7c","size":477617,"data":"","first_seen":"2026-05-12T18:01:45.074134Z","last_seen":"2026-05-12T18:05:02.001656Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"efd5d54735f10fbe75d6921e871f80f3","sha1":"e5796e3df81b90372f1ebe605a8750efc13b81d1","sha256":"53ff804d8dfee76ddbbb3edbbad5c5f86fe346055356c2cccb7d4077b8a3459f","sha512":"7db0395d2fedc3173fde30d6e8f31365296508859c2e7d20d22b8e7b55be22913a46846cdb52b3004d768ba81322125caa59e8bb73db3c6f44f091c5b792ed63","ssdeep":"384:5paGfbrw9BcjkXBU7XCHcDP5vsJzX2h76pnEUM06A0vpv+Bn:PjE8Dh0i2hEUM0/0p+B","tlshash":"fc82979bb8b710a15db7b17f4b9f8288763380275845dd103e1c42246fb9ea8867bfd4","size":18591,"data":"","first_seen":"2026-05-12T18:01:45.100414Z","last_seen":"2026-05-12T18:05:02.020727Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4a8db9b5ec2888cf76a0e8c98bd21fb8","sha1":"c666a83520aa90be1d7cc53915e776cf4e6e9fac","sha256":"c977642042028f9d346e82bc4e363bcd170dd09a015b68bcd157b47c65c0461b","sha512":"78cc3562c0f7226ee618d8e654d61287535cc20b900f0b0a1c12ca4e56253fc5074f3d131cbc0ec06ff7ddcc8d695780af6a09931953dd0b70415723dcd2d2bf","ssdeep":"192:Ev1Cv1QwynLrxeB8w4w4oVExqf01yHDuu1KwXTdonjZ0JvFIaF:sLO8lloVExqMMHDXPDSjq4aF","tlshash":"08e13f6f7feb1470499b557b179f978a387680031843c2243d9c86d94fe4e50a47abd8","size":7046,"data":"","first_seen":"2026-05-12T18:01:45.101633Z","last_seen":"2026-05-12T18:05:02.02146Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"6de29c1b4f7fc652df834059ec7054e7","sha1":"649fab42130c875868b97115b100968e6c67f00b","sha256":"bee92df8e124bdbb47a665dca95926d39b0a72246355ffc5ab2c4950bc5e108c","sha512":"247ea3b122fc141f31adbb47ee3c7bdae14fbe0e4f2817e9b78a034563477273d1cffec545f0a31ef7d1f6adc61f534ef9ced746e93f472b0bfbc9738323d232","ssdeep":"","tlshash":"3241ccee798b20c22adbb13e7a7f1159357a2327440ad412bc4dc0a45fe25ad6517fc8","size":2017,"data":"","first_seen":"2026-05-12T18:01:45.102819Z","last_seen":"2026-05-12T18:05:02.022126Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"562c2dc225b5372be1a91a614abc3251","sha1":"dfb850cdf0205b7b2a1db0951629ec59c494a45a","sha256":"7ed730195d9b77209378ac5f177cedfa6b2346c68f4c7de37bf69446a5edcbcd","sha512":"fdc6d6b0dd8ad49cfcf75da34d138d3ff626af3ee4f7f83e002673fcfd678674429616fbd4850c462b37361a9e22c09252a2b2bc8eac51ca0ab265a5c7502936","ssdeep":"","tlshash":"28f0828b3c6b2428989b69abf9d302883d214047340181a1355dd5455f31eb1b823acc","size":507,"data":"","first_seen":"2026-05-12T18:01:45.106131Z","last_seen":"2026-05-12T18:05:02.022957Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"172.67.68.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","size":407279,"data":"","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-05-15T16:22:09.918669Z","times_seen":36507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"0b4e725f1e6ba0e3b01026f83a355a4e","sha1":"773028ede4dc01d3a3cf1c9ab85c995d433f7cd2","sha256":"5311461cb7ed213148d02d7b47ff4bd7d8918ffdae14e3d6d890278579e6dc07","sha512":"80220b602b99b799d7c36d5da8ddd1c615ad2423ab231d591a12c9b73bd95409d0b0f199c9bb6b81d5750aee024baf26425ddcd534b9dba694cd8866219bd401","ssdeep":"","tlshash":"ac217b5b66b604ba8897675773d762483ca40083b840db157c5ec6d58f26881c5b33ad","size":1305,"data":"","first_seen":"2026-05-12T18:01:45.108865Z","last_seen":"2026-05-12T18:05:02.023763Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7b0c9e880e7b7f9cf16bc2d3f94342bd","sha1":"9c64833107e9dc7c0fb96d81c67e00fb048d2882","sha256":"71b27231d2ea9c619c52d8d93bf8405f4f564bf3ec3e47b4f3104b369db23393","sha512":"9101c952c900331c29c6c55c8021a4d1bc3c516645baba8306e3010997eed23456d05b5cd4a8c953399e73869964a44dda2ca47c73d77c1b1d06db8ad6e29801","ssdeep":"","tlshash":"b651337e786b157bb40340bb92b71819307e2063998ec134f85c7126cf4dbc5a97a5bc","size":3159,"data":"","first_seen":"2026-05-12T18:01:45.114318Z","last_seen":"2026-05-12T18:05:02.024577Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"41d05e16e98422500ee9ee9f3ffd7aef","sha1":"90cb4311254c74dcc30f7c63944f08a46f848fdc","sha256":"c36c08c0390376325ca06c69e95d2e417020d37db748886dbe47354d07db0df5","sha512":"76df6671f0554c7d8f7a0ba3a56ac50cc41be728b464154e8399672045520b2d8b2a5d7b671a4086046ebd95ac8b316a13b38ee5df895592d9d3fc96352587f5","ssdeep":"","tlshash":"b5e09b4e71e760e5a97bd2351bbf8908323eb1070402c0927f1c85587f95945a47b6e9","size":428,"data":"","first_seen":"2026-05-12T18:01:45.115465Z","last_seen":"2026-05-12T18:05:02.030933Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"workoff.org/new-home/images/bg22.webp","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:17.205Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/bg22.webp HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:17 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1456908\r\nlast-modified: Mon, 23 Feb 2026 00:27:27 GMT\r\npriority: u=4,i=?0\r\netag: \"699b9eef-163b0c\"\r\nexpires: Thu, 11 Jun 2026 18:01:17 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=teBpO%2BPDPTPO5cs5%2BCd5yyIxstiRj4NGOX%2Bs51D1q92aPZD7fp0JeDNAztqqZ%2FXDyvTNAiAJbK7rP9SoTUX7fHsUizU4icvf%2FtaveadwZcAnAlRRzBJ5wqk2Z7SaYA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53ea8d0756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1456908,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"51db85d298be18e07b3f9eec4472cf7c","sha1":"736167a7d553d5b64f18edaf819caa8b2f2e8b3e","sha256":"4410d65029425dd8c3c29707fa1d94a0d7e22ca78dd80f21ec2976d338244cdb","sha512":"d2e7bd4bbcbcde2825109a78bf6934b82aeaa59bc10b9a1bf9255a175c785db6fb12434f647ee489e2ba46e21924bf20e5d7347919741fc1773483b27dc282a5","ssdeep":"24576:wdESvVm08dSsGIDLYy7bzXE6x48hOl/KwClQa7:wdESvVm08dSMLYYzXE6x3o/KblQ+","tlshash":"b225335175cd4708df2e813b03041d8ad2b84d3096d1595bd8eaa5fa6a33fe1fa1e723","first_seen":"2026-05-12T18:01:45.016723Z","last_seen":"2026-05-12T18:05:01.991355Z","times_seen":2,"resource_available":false,"data":null}},"time_used":489,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":374,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/events","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:17.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"POST /events HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://workoff.org/\r\nContent-Type: application/json\r\nX-CSRF-TOKEN: tig7piSsAG8gWECt3HLm1Qgtkwz7iw8GfrLGuNYz\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 180\r\nOrigin: https://workoff.org\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":180,"data":"{\"event_type\":\"page_enter\",\"url\":\"https://workoff.org/\",\"referrer\":null,\"timezone_browser\":\"UTC\",\"payload\":{\"os\":\"Windows\",\"browser\":\"Firefox\",\"lang\":\"en-US\",\"screen\":\"1280x1024\"}}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Tue, 12 May 2026 18:01:17 GMT\r\nset-cookie: XSRF-TOKEN=eyJpdiI6Im5LQXJ4WWJpRWZ4Q3cvbStLbmxyeFE9PSIsInZhbHVlIjoicVoyZFNhdXBsQ0pINm8vcEMzenBOODliU21Yd2VtaHo3anBjSm5NZmxRMTV2VmhqMS9ubkRLV1JxZFpENXhRcWdLbHE2NXljaG85RDBIWDc0eEk1STFoMUFZckZuNnRQWHVHVnpqZ3dwYk8rVERIUEhQa2NTTDNHNFNmS2dma1QiLCJtYWMiOiIxNTg5YjUxYmRmODU5MmVlZDNkMjkyYjY4ZTExMzI0MzZhYTUwZjA2YzAwMGU0OGUyMjcxNDA5NWU0YTA5MzVhIiwidGFnIjoiIn0%3D; expires=Thu, 14-May-2026 06:01:17 GMT; Max-Age=129600; path=/; samesite=lax\ntaskhub_session=eyJpdiI6ImNqZTFEY0VyZzlnRjlUWUdQZDF1VEE9PSIsInZhbHVlIjoiZXZKVDcvYjcxY1p0a2ExYStBWlRqZWFXNDRhbWRtcFVXS0N2MEJ4VHdyTXgrQnAvMXBJNXNZOW9pSzZ4Y3B6dC9BK2FEN0VjU21Ma0o4bGd3MXhVNnZvbGc4eTl5aGU2ZlMvaC8rSWZPVm42RkErNW1MM1M5Zm9kVnpUVmd4SzIiLCJtYWMiOiIyZjhlYjViZTJkNTcwMmFmMGIxZjZkYzA1NTllMDMyZWNlOGE2MTdhZTM0NmNlNjRkYWM1MGFhNjQ2ODQzMTI5IiwidGFnIjoiIn0%3D; expires=Thu, 14-May-2026 06:01:17 GMT; Max-Age=129600; path=/; httponly; samesite=lax\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SSMe8fNl19Tep0m3yfEBOgPcPVBdOy7WbnZW5G7tlRRV1axnaHaMdONMJUkh7NUIi9ohnbYeRXKs%2FwaxJX%2BYol1dn7fwI4%2FXoYdVgsoNf%2F4fG56zD19%2BcCraU%2BsZ5Q%3D%3D\"}]}\r\ncf-ray: 9fab53ecdd4b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"82380d1e263b6093f3c7535690fcdd75","sha1":"022d91f218046ab2e61cac1eb13d6a718f75df2b","sha256":"4062edaf750fb8074e7e83e0c9028c94e32468a8b6f1614774328ef045150f93","sha512":"180ea3cf6e7a00cb12ecff7ce095b8cef1921621de681a64e5e53e3efc0cf6053e557205f2bdb9b9d5af4de3d54c79d1c9b1c474b83897590c647b1e92d9c93a","ssdeep":"","tlshash":"2a500003000c0030c00003000300ff30000300300000000c000c3000033000c0003c03","first_seen":"2023-04-05T15:24:10Z","last_seen":"2026-05-15T15:14:40.620915Z","times_seen":8968,"resource_available":true,"data":null}},"time_used":333,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/events","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:17.569Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"POST /events HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://workoff.org/\r\nContent-Type: application/json\r\nX-CSRF-TOKEN: tig7piSsAG8gWECt3HLm1Qgtkwz7iw8GfrLGuNYz\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 183\r\nOrigin: https://workoff.org\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":183,"data":"{\"event_type\":\"session_start\",\"url\":\"https://workoff.org/\",\"referrer\":null,\"timezone_browser\":\"UTC\",\"payload\":{\"os\":\"Windows\",\"browser\":\"Firefox\",\"lang\":\"en-US\",\"screen\":\"1280x1024\"}}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Tue, 12 May 2026 18:01:17 GMT\r\nset-cookie: XSRF-TOKEN=eyJpdiI6IkdMbmVEbWc1M055VzcxRXR6dmM1RGc9PSIsInZhbHVlIjoicXZEMk84b2RHUU9tMjNScFNnV0VhUVpudktqZGI5ZEcxKzBkMDhHTXVQK0FQQ00zWDZZTlEydlRQSHJvNmRwcHN0bEVRUTZKd3dpanI4QVRZNjFJcExIRmdSeU0wekNlemordXRQS2k1Y2NZTUEydnE5Q0FNNnV0MkVJRXhyWnYiLCJtYWMiOiI3YzBkYzg4NjkxZjdhYWQyMjkyYzNhZjg4M2E5MGQ3ZDE1ODcyYjBmY2VlM2I4ZDgzN2UwYmEyOTM4YzBhZDkzIiwidGFnIjoiIn0%3D; expires=Thu, 14-May-2026 06:01:17 GMT; Max-Age=129600; path=/; samesite=lax\ntaskhub_session=eyJpdiI6IlliQ0dBQXBZaDVFVFFoY2laVjZaS3c9PSIsInZhbHVlIjoiUnVFaE1aYjVieEZkZnViRU5XTFpYaHJOV1N3UjduR3R4QmlUeG9mM2hCb3dIdWIwYzFkUnFCY2dNOEt0OVVyMTN1VnE1QmlXOTFCQlladjdFU2s5UVArbFdET2pHSDhEdUlzSzNoYTdkaHdob055MlBaajI4UjFERVhNbW1qQWoiLCJtYWMiOiI2OTc0YzNkOTVlZWRhNGEyZGU4Zjc5MzZkYjQ2NmYxODAzYTIyOTIyYTA0NDBlMTEyNTE2NDgxY2JiYTE0MjcwIiwidGFnIjoiIn0%3D; expires=Thu, 14-May-2026 06:01:17 GMT; Max-Age=129600; path=/; httponly; samesite=lax\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XzZMMP5YKtO%2BVVo%2B2bYd55dg8ZI2KLJIwk7wFRoMSHQENYZ99HslnLgKUJrKM%2BS%2BlQCcMfYUW8mKPZN0VLTNldf9Neb09uJDQ%2FB7vS6WXyRFFy0LHf4tb1Ip7MNKIw%3D%3D\"}]}\r\ncf-ray: 9fab53ecdd4a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"82380d1e263b6093f3c7535690fcdd75","sha1":"022d91f218046ab2e61cac1eb13d6a718f75df2b","sha256":"4062edaf750fb8074e7e83e0c9028c94e32468a8b6f1614774328ef045150f93","sha512":"180ea3cf6e7a00cb12ecff7ce095b8cef1921621de681a64e5e53e3efc0cf6053e557205f2bdb9b9d5af4de3d54c79d1c9b1c474b83897590c647b1e92d9c93a","ssdeep":"","tlshash":"2a500003000c0030c00003000300ff30000300300000000c000c3000033000c0003c03","first_seen":"2023-04-05T15:24:10Z","last_seen":"2026-05-15T15:14:40.620915Z","times_seen":8968,"resource_available":true,"data":null}},"time_used":349,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":349,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/hero-im.webp","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.830Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/hero-im.webp HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/webp\r\ncontent-length: 201186\r\nlast-modified: Mon, 23 Feb 2026 00:26:48 GMT\r\npriority: u=4,i=?0\r\netag: \"699b9ec8-311e2\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TQbCXogeG3E9jlcB6j9va%2FPxADAnVVvhELL96UhyPE4FvijEFU4pPTV6F%2BIIwtJjmBpIS%2Bs%2Bz4MHEN5UYWVvU4%2F87SP%2BS8hATZ59ysifN%2BaJ7%2FdMwe9oC%2FCtudSArA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53e19c2256a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":201186,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"44be489c017af46634957e9d91cb6f9a","sha1":"8958afaecb3355476b0381d531e1b29b945f8a79","sha256":"31645ba9fe4293db42d4544e37bd748c0f0b369bb69d1ebc58b2376e451f5786","sha512":"7fa368de1fabca960d7573842e98f408ddd74ce40bb489f2d5228f274ba08026b29db4c388f2f7de0f46d859d2a6a71eb2a2fb15bc85ce6c8396d323f1a3d89e","ssdeep":"3072:pkLM1IlzeRVDEKZjUyZAx3qm7GW4VQdFAQ7m3EFyGcat44bt/qHgKlfDAkHyOYdS:TildyZON3g4FAU5cWbtQfDAkPvbnT","tlshash":"0b1412bb4024e224afd3a4a2b8f29401b41bf61ab456277fdde62c147d391dc13676ac","first_seen":"2026-05-12T18:01:45.02291Z","last_seen":"2026-05-12T18:05:01.990332Z","times_seen":2,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":203,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/l1.png","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.851Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/l1.png HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 2342\r\nlast-modified: Sun, 22 Feb 2026 10:41:07 GMT\r\npriority: u=4,i=?0\r\netag: \"699add43-926\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NHEiCcCMezRPG%2FjQVjICjNSROT2o3anrGhUShhKpKdcgJ5XgSlq5VH3v8qQrGsnVSSQFDVox6chgNY3CskNQUZxUFCD%2Fzx6IoC5BNMYY%2FczefOyoZkFmQjgjpPdBkw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53e1ac3956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2342,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 221 x 60, 8-bit/color RGBA, non-interlaced","md5":"d2c8ecec108fd41c8223a39cee21e660","sha1":"3a9b237b02268549b738022cd9d0689ebe80da70","sha256":"334799ef90c4771e03b6d1ce28d9ee6ef3b04dbc02d9664d8313c52d944f9300","sha512":"938b8c863e5e5605e17961d7a030a87321bdc393aaf3c9a3dd569e9418ef3bffb3c5447730106c4882d8a32584e8456a5796fc534db924dbe7d8b7a31edde2da","ssdeep":"","tlshash":"b6414bcc58fa26e60b4b16bfd61030c6c2ad316a92728dc49d251a6e8cc3940f2d3f73","first_seen":"2026-05-12T18:01:45.025928Z","last_seen":"2026-05-12T18:05:01.997738Z","times_seen":2,"resource_available":false,"data":null}},"time_used":127,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/3.4.17","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"172.67.68.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:16.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 21 Mar 2026 09:41:26 GMT","end":"Fri, 19 Jun 2026 10:41:19 GMT"},"fingerprint":{"sha1":"1C:D9:C0:8C:4D:FA:FF:5A:2C:CC:48:EB:7B:35:CF:FA:AB:7F:C0:61","sha256":"1E:81:97:52:8B:47:37:54:3B:62:1E:0B:E5:1D:D6:F7:F2:6D:CD:F7:D3:1F:8C:0E:78:14:26:9F:B9:87:EA:5C"}}},"request":{"raw":"GET /3.4.17 HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://workoff.org/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 12 May 2026 18:01:16 GMT\r\ncontent-type: text/javascript\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::bns84-1776405077625-04d875e1270b\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nage: 2203797\r\nlast-modified: Wed, 06 May 2026 02:10:42 GMT\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QBqkdk3C09PicinEhQVH7Yjlo4R%2FHQV1zJEMz0Zv6%2BdxwD%2FP75BRd8NBI4syP8guoyLLqWaa3Vy6N1GuS0nt7%2Frc3P8sNbdK8vfMSVYgRBxelsQhBVzPy8CZA%2BXQIYzsM82XBLI%3D\"}]}\r\ncf-ray: 9fab53e3bd245ebd-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":407279,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (52853)","md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-05-15T16:22:09.918669Z","times_seen":36507,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/dan.webp","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:17.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/dan.webp HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:17 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5410\r\nlast-modified: Mon, 23 Feb 2026 00:26:53 GMT\r\npriority: u=4,i=?0\r\netag: \"699b9ecd-1522\"\r\nexpires: Thu, 11 Jun 2026 18:01:17 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=obiZDBbW9qFUEEbnrWKW9MiH%2Fqn9mtXmzW6FIdRHms2YFjaBBEwuJm%2FcmwOH76X2t1N3c5vjosQEaY3r7SRC99wLDHwIR2T5vxs7nHRfHkoOkukRLFPVtMCtxsUv%2BA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53ea8d0856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5410,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b4b8727b9c8b04b4cb66011f5340d446","sha1":"75187a245de61b3fc2cb5c2150287d4b065507cc","sha256":"d266e750d3776c7e5e710d21a7f7679326545da1cc1057d2d3f211aab3d4688d","sha512":"dd1480af6c6dadedc9ff76f3dc0b3d9cc3c14650aa2f361ebdb468e91bdd484971aaa21b2bc7d084eb1e5b8eac95143605a6976131f2027a80c7109257aa9e47","ssdeep":"96:Zc1fdaP3YXKLM5GleHG7RDCGIjAiKLIVsq2ggOVsaGpXLMK0kDtuKV8F:ufdzKLteH2RWG+mIVsqD5t5kDtuKY","tlshash":"6cb18ef2921240b9aaf8cd0438e4a7ed70c17683703f09b0235d85626953f983119e89","first_seen":"2026-05-12T18:01:45.030688Z","last_seen":"2026-05-12T18:05:02.005679Z","times_seen":2,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/assets/styles.css?v=36","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /assets/styles.css?v=36 HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 08 May 2026 10:22:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\netag: W/\"69fdb971-4e34\"\r\nexpires: Tue, 12 May 2026 18:01:14 GMT\r\ncache-control: no-cache, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iSrEQNuZWs8oz%2BTZ7C8BWlWynAR%2BPQHkVb7%2FMLjdTuTL0wTbxLMyVQ1XzmFMPYJlkXIL5Zx22OUKAefYDgf8nLIJCHWnKDbefCWnEiXbjpw5%2BcrtQCHYKRR61llzRQ%3D%3D\"}]}\r\ncf-ray: 9fab53e19c2356a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20020,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"0528407310e4cf4bb9416764b37bc7e9","sha1":"20ef186c661c6634fde170b8c77fa38e0d00b67a","sha256":"cfc477584a2bb98fa20d2a366873160be342f8c3014215aee7127468453d60ec","sha512":"e35f08969725783cdb3cee658048d6071a5879fc35d74360bb3fb7d99af25da479f172769014173117577b1450e28ae88be3626b3fe0b5db12604099a32674dc","ssdeep":"192:fr3Q6/2hcYPKUdZCB4TmRJp/xW4KTGZFwORBhao/7d+xHN2S7Bh0tKT3igTw1VRn:LiFOk0qHxYaKjve76cy4Hu","tlshash":"4e9296a19fa30815701386886bfba36d727ca0139516dd7d7bcd72988fc33ec9261b48","first_seen":"2026-05-12T18:01:45.034091Z","last_seen":"2026-05-12T18:05:02.007811Z","times_seen":2,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/geist/v4/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.251.143.131","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:16.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Apr 2026 08:36:34 GMT","end":"Mon, 13 Jul 2026 08:36:33 GMT"},"fingerprint":{"sha1":"99:99:69:B2:FC:B4:4F:EA:18:FB:04:4C:0F:8D:3E:40:61:B5:31:00","sha256":"55:6F:9F:9F:5C:FF:31:03:79:C7:88:2B:89:0C:1A:2F:DE:0B:7B:1A:91:6E:BD:C8:7D:60:EF:5A:D9:C7:51:26"}}},"request":{"raw":"GET /s/geist/v4/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://workoff.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28412\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 05 May 2026 18:03:51 GMT\r\nexpires: Wed, 05 May 2027 18:03:51 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 10 Sep 2025 16:49:32 GMT\r\ncontent-type: font/woff2\r\nage: 604645\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":28412,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28412, version 1.0","md5":"a0f13f916a5805019879dd56b29bc098","sha1":"90af3a05ac9d34850f01f503e1a2582306d9245b","sha256":"04f13c87d9e172ebee6a520fe0d8cb187d1ed1f1eef505d47dd041467e36c6ec","sha512":"15993875861a0b439c76848f3bd7200a8296f917af470a53c0c058880090eb6ce325b2c12295d504b2b6fabe7a5647bfa4804c103b4c41bff4b1741bb27924db","ssdeep":"384:vOg2tlly1HTH0ZTk9hbQe3O4KGVTtRgKJMgJnynWeWkBuNyg3Bv0I5Y4hf/CGYEY:vLQlwH05kbQ+Ttvi+yskBuNFxRPHC2+","tlshash":"30d2e1a67a98b5976d61a4bb6150b00881cf7cb6230d03f21a24d561fd69fe603d373b","first_seen":"2025-09-11T19:57:45.123641Z","last_seen":"2026-05-13T22:46:32.766167Z","times_seen":1395,"resource_available":false,"data":null}},"time_used":265,"timings":{"blocked":121,"dns":1,"connect":8,"send":0,"wait":12,"receive":8,"ssl":110},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/assets/main.css?v=1778608875","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /assets/main.css?v=1778608875 HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 23 Feb 2026 18:12:59 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\netag: W/\"699c98ab-1a9a\"\r\nexpires: Tue, 12 May 2026 18:01:14 GMT\r\ncache-control: no-cache, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Yo8zrIyGPBbo%2BHDCdsMoaZINgdtjX7pRqSlXuh53M1ZGae2JelhBfr3RalbKuTuW%2Ffk%2BfGarlgxdwR%2BxmdiW1tlGEM9FWOgMYJblYbGI5qnJ7A2Rvzmlim%2BNi%2F1iWQ%3D%3D\"}]}\r\ncf-ray: 9fab53e18c1556a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6810,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"609208fb926e9785a1ddcc95f6ab83e7","sha1":"e6f91ea93fa9bc89fc86a7f393e20a339ca76e0e","sha256":"c6ada0ef7de59b7464ffe144c88e55f14be9de3495cc2c057b3b8cdba15b2324","sha512":"d0b5da20931eb1d5e10136ce8101532c0e7d7267fd0ae29654d0fd745350d181cec8831f2db2a9ce4f2e3fe5b552ed608b355ebb5528387af6d6edf37369ba8d","ssdeep":"192:KvoMx7u2lXoDvrXHEEqMXPM/QlGLKI2KOQqFu1R334YQs:KvI6cy4Hs","tlshash":"fae16352fad104583003961995abb7bc3e7da053a71add787b9c32b44fd73ed8221b84","first_seen":"2026-05-12T18:01:45.037328Z","last_seen":"2026-05-12T18:05:02.013225Z","times_seen":2,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":128,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/style_vw.css?v=1778608875","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/style_vw.css?v=1778608875 HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 07 May 2026 13:22:45 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\netag: W/\"69fc9225-c517\"\r\nexpires: Tue, 12 May 2026 18:01:14 GMT\r\ncache-control: no-cache, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=44dJJMg9Sdyp7Iqgr5GAez9KSiQ9UvH8TVz5RztcQh1u6EVRIWAeNVNYSkKPyVZyOAO%2FPgxds1iqbcovLIgmVL0Xo5qi6iseUlMuWh85ZncvxcecrhR9gtp6GL%2F2tw%3D%3D\"}]}\r\ncf-ray: 9fab53e19c2156a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50455,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"20cb9f6ca8531e051d150a4f8231808e","sha1":"34350cd06952be16f207b778551c1b009cb364f9","sha256":"21bca07e48e0b449c7a12cd63b06aae1ff712819a2b0b8417a6c2309ddc66f1e","sha512":"75210ead0eaa6280871f673e4e69713dfa2cdad19433c6368be000081110080960a243f72c81e7c87b165cd42c8f71480e89519aa2414ce9c3ea3de3565d05c7","ssdeep":"1536:LOuzk68WwTHwut6V2ZLEOcO+sn4JlnTmHu0sHUZ+u+:9k68WYHwut6V2ZLEOcO+eolTmO0sHUZc","tlshash":"ab33742957731498b02b9c583feb6288127cc407850bd968bf9e73548fc62fbd591bac","first_seen":"2026-05-12T18:01:45.039496Z","last_seen":"2026-05-12T18:05:01.996545Z","times_seen":2,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":137,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/logo.svg","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/logo.svg HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sat, 21 Feb 2026 22:46:54 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\netag: W/\"699a35de-9c0\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=npOeAYomnL7bKi8I%2Fe6OVgDi6omVVQxLV%2FDqtw%2FyqvCXcjyZxc5seJDtSPLFjSlVJl8GEY%2FygbRwsTiBBBZTLNfl67FelWUt1GGTRi54%2BapeRUiaQCDHNYTNBswBZQ%3D%3D\"}]}\r\ncf-ray: 9fab53e19c2c56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2496,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8e0fc71ded3dbd3734acd9cb2a1dd6e2","sha1":"b6c7cb3387881d0e61801bb33a8d5f9aea737868","sha256":"c1c3f5a1aa2bed2034203ed0db166aa4ccec17c49a7c9c3b5dfb5d207fcabebd","sha512":"ac2317d7337ecf08e673954104fad70d53d70969dffe069680a67b8445a4afc0ebbd661c87ec2a3403b68af1e134eac372010a59a8e95fd973081f78b772ca44","ssdeep":"","tlshash":"02514350a3e5d679f501a3985b89643458926ed23a01c09197f42e07f97509e0fb5ceb","first_seen":"2026-05-12T18:01:45.042889Z","last_seen":"2026-05-12T18:05:01.987767Z","times_seen":2,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/l2.png","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.853Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/l2.png HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 2473\r\nlast-modified: Sun, 22 Feb 2026 10:41:11 GMT\r\npriority: u=4,i=?0\r\netag: \"699add47-9a9\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FSXsPJND0t%2B4B%2BbIO9lggDjJ%2BM0sKwV6dPQqIStwI3yDJekkZiXDf5Gy2P1PtHFy9as95ubWh5pVtdV%2Bm8rbbm7xeB%2B6AxgOLEFNkef%2BbZfYBdJGvyznojz7cOsbzA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53e1ac3d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2473,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 227 x 60, 8-bit/color RGBA, non-interlaced","md5":"3681d4198eeaffd586884355376f82ac","sha1":"fd73c27f4daba9e568f5bc735784e98e91d58c36","sha256":"25e3c4c5251406d1cd98cd6971c01a7f15c9b29cc106c1ec660ca69dd75f79fe","sha512":"6126d64d7fd0034b10ca36421bf155a599a067012008f635fb2a34087608ae86ae76050e402ef6a33903f04aafa9df805af985cc57e8d255135eb8ded8792f1c","ssdeep":"","tlshash":"9c514ae33f0bce2e2b28753b592646823905dbfe401291097718c2d65df8c449c45ac2","first_seen":"2026-05-12T18:01:45.04458Z","last_seen":"2026-05-12T18:05:02.009432Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/l6.png","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/l6.png HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 3059\r\nlast-modified: Sun, 22 Feb 2026 10:41:33 GMT\r\npriority: u=4,i=?0\r\netag: \"699add5d-bf3\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jy4xLqdKccgIhTEIex7JQ4uEuFmKLBx689z9XpaXiGaynsX0qDIhBFedOjRgHK6OkNTLVSH2de5kKGrC01UMjiXTScKaJfqfeD80P%2FFyShZeamBQybXRfr2CfUWtsw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53e1cc5d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3059,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 254 x 60, 8-bit/color RGBA, non-interlaced","md5":"2dc6ab58f1478772ca065b99f8873d7e","sha1":"b35236c47c190a138ed31848b066f9bc0a5cb118","sha256":"028be7ed5a99ea39e3d6b17e82493994084ae36de142ea4086553709d3721960","sha512":"6bec7818cbc8a9166698c844bfc27e6373ad53c37a8445455aeaeab4c5de7fe321710cb86608309eca03f789228614ad46c5287bde228c7e69a65a8acc2a18c6","ssdeep":"","tlshash":"a9513bf5b2c414da26f743960606f175732380589333ea547d4cd1f83229e31caaa7c9","first_seen":"2026-05-12T18:01:45.045594Z","last_seen":"2026-05-12T18:05:01.999273Z","times_seen":2,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.fontshare.com/css?f[]=satoshi@400,700\u0026display=swap","fqdn":"api.fontshare.com","domain":"fontshare.com","tld":"com"},"ip":{"addr":"13.42.130.243","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.fontshare.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Thu, 29 Jan 2026 00:00:00 GMT","end":"Sat, 27 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"69:4C:09:79:67:B2:53:14:4C:98:6F:74:44:FF:48:93:87:A8:C7:74","sha256":"99:F8:8D:DA:9B:7E:5B:44:DC:C9:51:03:79:1F:D2:00:2F:49:3E:78:88:9E:96:B5:29:4A:C6:5A:87:18:DD:30"}}},"request":{"raw":"GET /css?f[]=satoshi@400,700\u0026display=swap HTTP/1.1\r\nHost: api.fontshare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 12 May 2026 18:01:16 GMT\r\ncontent-type: text/css\r\ncontent-length: 1178\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type, authorization, cookie\r\naccess-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS\r\naccess-control-allow-origin: https://api.fontshare.com\r\ncache-control: private, max-age=86400, stale-while-revalidate=604800\r\nserver: Cowboy\r\nx-request-id: GK7jWWo3S9JYd7MAAj8C\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Erlang","description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","website":"https://www.erlang.org","common_platform_enumeration":"cpe:2.3:a:erlang:erlang%2fotp:*:*:*:*:*:*:*:*","icon":"Erlang.png","categories":["Programming languages"]},{"name":"Cowboy","description":"Cowboy is a small, fast, modular HTTP server written in Erlang.","website":"https://github.com/ninenines/cowboy","common_platform_enumeration":"","icon":"Cowboy.png","categories":["Web servers"]}],"data":{"size":1178,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"bda97b08063462be1b6fc0c48565e5d2","sha1":"6f14782b804ee385ecbf1d8350cd958d6c63eaa6","sha256":"3dc05955a6503a15eb855b56352853b9f1b67c29f59b9dad022198ff0a4433a0","sha512":"d83b8a4e7f68f176ccb81a60571891fff6fa002bcb14b060eea37cb4549e0be9dc80718c0e55cc8226b0ffd3fa15ad456a59dfc0bbd25e6fe4659cb3fe6c4499","ssdeep":"","tlshash":"e621cb0179e524c56823280833eb1ded4e5d7813185ed97d3a1b47286efaf0a4796f2c","first_seen":"2025-04-07T12:04:58.417726Z","last_seen":"2026-05-12T18:05:02.00031Z","times_seen":14,"resource_available":false,"data":null}},"time_used":472,"timings":{"blocked":190,"dns":16,"connect":34,"send":0,"wait":29,"receive":2,"ssl":196},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/l5.png","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/l5.png HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 2621\r\nlast-modified: Sun, 22 Feb 2026 10:41:27 GMT\r\npriority: u=4,i=?0\r\netag: \"699add57-a3d\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eX6XI8TUyoh%2BFgrc13zgVH092h%2FUUccm5Jb1%2FupShwwKJ%2Bt8HAgVnwnldAaukzBMyptC7bzw0VHmbK%2FEX3AeUOu38TKFtbRdv6EuMzz9SFoqLqcPmqN1RBOzzcbawg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53e1cc5e56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2621,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 199 x 60, 8-bit/color RGBA, non-interlaced","md5":"373df1a97da4f4f1716e79f53a4b3432","sha1":"c8f96c19a76a6eecc2cd6d4b9a3ea157612fd0fe","sha256":"f7e7365e75f6f23df40010963d5fa2c33a86857676df52d9e04b348db9ad3c76","sha512":"b4e63b7f1ca9eaa1988c0528e39ad38f95ab38bfb27d2ded351dbad59c6d74de5c8321f8e33d32fa1a9ddc349ebbfdc0d89e55d08d97d3a119cb39c7d1fb1f50","ssdeep":"","tlshash":"5f513e82afc71a56681586550276e467a02cbe31abd6b446907c409f5043e0348ce197","first_seen":"2026-05-12T18:01:45.049149Z","last_seen":"2026-05-12T18:05:02.010256Z","times_seen":2,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/assets/telemetry.js?v=2","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /assets/telemetry.js?v=2 HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2026 16:03:00 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\netag: W/\"69eb9434-1372\"\r\nexpires: Tue, 12 May 2026 18:01:14 GMT\r\ncache-control: no-cache, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lWJPk63Ki7idgOn%2B6f2qc1PcvPcuLutul%2BOgyJmfKPNeLzWMHu3YrAJK2TCqeIpV8wTEpACf9zzxFr7oeA%2BucAR11IqKOsPJbO3dfLhkezDgeqQeUs4qXyo9ARkmgQ%3D%3D\"}]}\r\ncf-ray: 9fab53e1ec6256a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4978,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"e8d9987911b87b750c56c0eeee5685da","sha1":"0f8970e620abbb15214c20fb4a4a5600ea7a70f8","sha256":"0602386f6debd2ed7a54d6448cdc1382a88a1fa1ddd02150796a234adcb1d304","sha512":"2b809e079beb8bd3c897412d9e135fcb35660c0a4fdd3968afab6f689a672cb4ce16d68e57d7b590b27e196bcec9dcb9eb751dd0ef12458dcc3e4c3a5abefd30","ssdeep":"96:kj9K3AYoqjy8TTP5J+TD8I3rJ/UbLLOjhhpn+aMNvQGqeB2uY71sY3HYDL3b:M9K3AYoGpJqPrBe6jNn+aMe7eAuYBYnb","tlshash":"49a163e6687b34314a27a07e275f520676339053388aec427b9d49107f89a1c82b7fed","first_seen":"2026-05-12T18:01:45.05293Z","last_seen":"2026-05-12T18:05:02.002906Z","times_seen":2,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/l3.png","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.854Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/l3.png HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 2772\r\nlast-modified: Sun, 22 Feb 2026 10:41:17 GMT\r\npriority: u=4,i=?0\r\netag: \"699add4d-ad4\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qGAJ%2Fpu5zjTtrynMKI%2F%2FWMwuJY1J6tLY6AGrtSWT0matjKeTHsjM8KApHy9LonuzK7emv2Ubyc02u7n5qRnehXoUXmmlj4WUBy3NbVs8l9BfWi6vVYgUonAsWCzgdw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53e1cc5756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2772,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 232 x 60, 8-bit/color RGBA, non-interlaced","md5":"45d22492b3a2f9c4f839d57e84e87fa1","sha1":"0f483c587ef210e5e335d9996914fddef6df94db","sha256":"02ee1de4d31c8964efd9c7d563c985c76ae92adc8a9006a1f85718a66b7d5c94","sha512":"42466b78912754f041ecae32534f9251a84a6272b899be9438f2563ebcf292e7a5e68edbeda4b51afefe03ded162f50adfda0c5125689e1f7eed60e6b1fc7c0a","ssdeep":"","tlshash":"5b514c0b27530a54f45a72380a5a377fa477067727d255d4cdb798b23017b61287bdb0","first_seen":"2026-05-12T18:01:45.054681Z","last_seen":"2026-05-12T18:05:01.98879Z","times_seen":2,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/l4.png","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.855Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/l4.png HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 2588\r\nlast-modified: Sun, 22 Feb 2026 10:41:22 GMT\r\npriority: u=4,i=?0\r\netag: \"699add52-a1c\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qhYHEhL69PDEvW6MsFJ%2Fc2b3VBri6jNTM3qTpESfg%2FSwzUtQtDp2ggH7RG2ftaueRl9YHCQQXPS0wvZe4CW6qlWr0FpSmxbVXvNK5HA%2BgDHLR3u7Ks2yLKZCBhq65w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53e1cc5c56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2588,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 266 x 60, 8-bit/color RGBA, non-interlaced","md5":"30f513d37a8238b4b66e3fe29b2043e3","sha1":"eba1299102c68b2133b8ef7328b1db614b56ca61","sha256":"8fcb69f9b00ebf6b47ca00af268ee7ecc6eb5a26202bfeebe9531a9aa47578e0","sha512":"310754907ae5b1b59580c13ea737fe5794cce8acee51703c3c0db274f83698aa0a7340efd101e96e9a93f3ec90e05dc49f05757a5f9c9cd6110348d67c8fe8a9","ssdeep":"","tlshash":"11511c67e410aba6bfb0a59efc7192484db88f232b457bd5f954480111c2898e97b7d0","first_seen":"2026-05-12T18:01:45.056113Z","last_seen":"2026-05-12T18:05:02.008623Z","times_seen":2,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/img/logo-wo.png","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:18.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /img/logo-wo.png HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IkdMbmVEbWc1M055VzcxRXR6dmM1RGc9PSIsInZhbHVlIjoicXZEMk84b2RHUU9tMjNScFNnV0VhUVpudktqZGI5ZEcxKzBkMDhHTXVQK0FQQ00zWDZZTlEydlRQSHJvNmRwcHN0bEVRUTZKd3dpanI4QVRZNjFJcExIRmdSeU0wekNlemordXRQS2k1Y2NZTUEydnE5Q0FNNnV0MkVJRXhyWnYiLCJtYWMiOiI3YzBkYzg4NjkxZjdhYWQyMjkyYzNhZjg4M2E5MGQ3ZDE1ODcyYjBmY2VlM2I4ZDgzN2UwYmEyOTM4YzBhZDkzIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6IlliQ0dBQXBZaDVFVFFoY2laVjZaS3c9PSIsInZhbHVlIjoiUnVFaE1aYjVieEZkZnViRU5XTFpYaHJOV1N3UjduR3R4QmlUeG9mM2hCb3dIdWIwYzFkUnFCY2dNOEt0OVVyMTN1VnE1QmlXOTFCQlladjdFU2s5UVArbFdET2pHSDhEdUlzSzNoYTdkaHdob055MlBaajI4UjFERVhNbW1qQWoiLCJtYWMiOiI2OTc0YzNkOTVlZWRhNGEyZGU4Zjc5MzZkYjQ2NmYxODAzYTIyOTIyYTA0NDBlMTEyNTE2NDgxY2JiYTE0MjcwIiwidGFnIjoiIn0%3D; _ga_88YW3Y127C=GS2.1.s1778608877$o1$g0$t1778608877$j60$l0$h0; _ga=GA1.1.1507905365.1778608878\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 1499757\r\nlast-modified: Thu, 05 Feb 2026 19:03:49 GMT\r\npriority: u=6,i=?0\r\netag: \"6984e995-16e26d\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\nage: 2\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4y6yzOmamKKegUoSjb6mtWyfkB7oKzyDzTae1sl%2BlAuKdnxu%2BVOSmNSyJnYQDGjt5sFkgWwjIgleh8qx0df%2Br7YLS6G1C2FzdaZCOQ9EecXFF9O32oDxQl3TKuid5Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53effd6b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1499757,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1500 x 1500, 8-bit/color RGBA, non-interlaced","md5":"757f103330ef69f42fa18f4879870e2c","sha1":"e17de90d8794f39c2ee609db90900bb45115fae6","sha256":"4c3f912ee62cd05e8e971448107f082f9c94a3b2f95208b3ab93f84e81491ff8","sha512":"5c650081a9b11a2916a4c52032f46a3c7c0c548ffcde257b5ff1060d2c6730e5c2570153afad07516a40ca6d28a801dc57d647918c00aa018d36c4c7a346bdb4","ssdeep":"24576:3vt0pqUwFYamkWc0n2JiUyn/izQpGVZtSMfXCpYnf/ns/:3l0pqUWYFRHnpUyizIGVZtS5z/","tlshash":"d62533e0b37d96221d3811c3691f8530c426228ce667ddf30a69bf8567bb261bf6d835","first_seen":"2026-05-12T18:01:45.057586Z","last_seen":"2026-05-12T18:05:01.986657Z","times_seen":2,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"172.67.68.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 21 Mar 2026 09:41:26 GMT","end":"Fri, 19 Jun 2026 10:41:19 GMT"},"fingerprint":{"sha1":"1C:D9:C0:8C:4D:FA:FF:5A:2C:CC:48:EB:7B:35:CF:FA:AB:7F:C0:61","sha256":"1E:81:97:52:8B:47:37:54:3B:62:1E:0B:E5:1D:D6:F7:F2:6D:CD:F7:D3:1F:8C:0E:78:14:26:9F:B9:87:EA:5C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncache-control: max-age=14400\r\nlocation: /3.4.17\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::wpnkj-1778608545250-6b460005ff5e\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 330\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qwAD9DJ5BKYyKisZk36PtL8uNB5rhK5%2Bcy5O1b8BR7eMVzaYq7s2ROV4JL7Y8qqRLJokmXxsSnHnATplwSBt50UgYSb6pKs5ujd%2FM8oKJggkcaomJT2dfw9EAKpOp9M%2BaCAa4QQ%3D\"}]}\r\ncf-ray: 9fab53e1ddd15ebd-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":407279,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-05-15T16:20:34.691298Z","times_seen":15225314,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":5,"connect":1,"send":0,"wait":10,"receive":0,"ssl":48},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Geist:wght@100..900\u0026family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026family=Montserrat:ital,wght@0,100..900;1,100..900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.142.234","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Apr 2026 08:36:34 GMT","end":"Mon, 13 Jul 2026 08:36:33 GMT"},"fingerprint":{"sha1":"25:C3:78:A0:E1:97:BA:8A:CE:43:FA:9C:BF:89:EF:DD:A3:CD:9C:40","sha256":"C1:18:7F:C1:92:8E:D0:83:CA:E8:62:DB:BE:FE:89:B2:84:13:70:FA:0E:40:65:D2:B6:8C:09:37:73:46:4D:4B"}}},"request":{"raw":"GET /css2?family=Geist:wght@100..900\u0026family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026family=Montserrat:ital,wght@0,100..900;1,100..900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 12 May 2026 18:01:16 GMT\r\ndate: Tue, 12 May 2026 18:01:16 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9939,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"779bf30f8aba41d14615eef2f5a70c83","sha1":"3e4eb62fc1a646785f2d70cfdb98970cdfcb4c9d","sha256":"d387424c4a60be7718989779b99c1ffd19d2cc97c2a1e3c7fef58991e4c69c39","sha512":"eef19e883f55d5f730c7ada275158bd41f91679f784c5f266aa239780bf82bee09daeb09f77f15c41297aa3fbce9cd6e3f917ef9921fca2594ed25e6816d8ca2","ssdeep":"192:JfCuFyywfydyGy63gy/yFVyR73xpmj3U8fHiyYwyNFyuy3uySRk73vO6u8:JmtfcHjg8ciIShwCFnbL8B","tlshash":"c722ff91046be504ea431cc627cf7e329e8e62667085d5797ffe2cd9aceac22132475c","first_seen":"2026-05-12T18:01:45.064744Z","last_seen":"2026-05-12T18:05:02.007106Z","times_seen":2,"resource_available":false,"data":null}},"time_used":478,"timings":{"blocked":192,"dns":0,"connect":35,"send":0,"wait":33,"receive":0,"ssl":211},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.874Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Thu, 14 May 2026 18:01:15 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cNPL6Erk6edbxI8QhJCX8Ow8XebOoFqzc174va04udEh%2FfjdqWcpwdGTd01%2B91vEJ4zEHqRcp3ubaINss3tGQZoxLdAF53SLSgsNihW7rC1nu2KOhaVtoO1klAu8bg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncf-ray: 9fab53e1dc6056a2-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-05-15T16:20:31.235969Z","times_seen":339934,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcCo3FwrK3iLTcviYwYZ90A2N58.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.251.143.131","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:17.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Apr 2026 08:36:34 GMT","end":"Mon, 13 Jul 2026 08:36:33 GMT"},"fingerprint":{"sha1":"99:99:69:B2:FC:B4:4F:EA:18:FB:04:4C:0F:8D:3E:40:61:B5:31:00","sha256":"55:6F:9F:9F:5C:FF:31:03:79:C7:88:2B:89:0C:1A:2F:DE:0B:7B:1A:91:6E:BD:C8:7D:60:EF:5A:D9:C7:51:26"}}},"request":{"raw":"GET /s/inter/v20/UcCo3FwrK3iLTcviYwYZ90A2N58.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://workoff.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 72964\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 05 May 2026 18:34:35 GMT\r\nexpires: Wed, 05 May 2027 18:34:35 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 18:33:18 GMT\r\ncontent-type: font/woff2\r\nage: 602802\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":72964,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 72964, version 1.0","md5":"91247c94dcda6ff52b445d71d6bbfb81","sha1":"ad2f62363ed047b430b91f32afa31df51fcd7c5e","sha256":"6a3c3e024b31eeacbf1f19c3c7be78612d91c623186f64035a50038241dad4f9","sha512":"a12dcac84e9f9ae02df3aabe29d76994281cd1005edca471194605cfcd6a0456eec872fd28c63c72ae124804d0b47d8377048caae49c40b0a18b5d6be4d6213f","ssdeep":"768:zbw+rLBkMxbCkupj4Y69/Yr71+j9pWiKahMM6+AWEqXB0oGuNGku+QCcIKE205C7:zbw+iwuS/iZWeaO1zP1/9Esvf8fXnm1","tlshash":"8f6302244e3c50c2a54d33aa286940f6f6e79c75b2b79ba4a69c589cd410f329cdfdc4","first_seen":"2025-05-29T18:51:13.223047Z","last_seen":"2026-05-15T16:20:52.712408Z","times_seen":22953,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":14,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/assets/mobile.css?v=1778608875","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /assets/mobile.css?v=1778608875 HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 23 Feb 2026 18:12:59 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\netag: W/\"699c98ab-1b18\"\r\nexpires: Tue, 12 May 2026 18:01:15 GMT\r\ncache-control: no-cache, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c3%2FfLHiwh5mTlLtW4nZAch%2Fwyh6SguMQkbqITeHrdeHqjkTqnbTSEiushX6d6JSC0C4UAdlRs3Zoj1%2BzWdwarWPEibY1mWxUi%2BpQBRiOEDep8P6uaFIyc1wpOJQg%2BQ%3D%3D\"}]}\r\ncf-ray: 9fab53e18c1856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6936,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"f1d4067c5875b69e812eaaf2f5db9f3d","sha1":"56df6ea039e2e71d584e86e4337db7f00f7ef190","sha256":"36d9c1bb7cd7e0d42e935e32b9f7f58af4a9f9ff582d3e8fe7224ea9d545ffcd","sha512":"747343a4363c096b95e8729e79878304d4dbcd0d1012cfaa506ef69e24c4fa5dc73fe002d5a2d288d08d54f1471dda12b211d3003c84a8510b92171e95b8b378","ssdeep":"192:ocT0z9RAbEQEwf5oNxLJWm9j6pg7ca9XeDU5MHT9Ir79Y9PuFj:YtN98W","tlshash":"96e1429aabd715597523a4295fa7d722632d4043d10ecabc3fcc62084f9b2dc84a2784","first_seen":"2026-05-12T18:01:45.071994Z","last_seen":"2026-05-12T18:05:01.994296Z","times_seen":2,"resource_available":false,"data":null}},"time_used":654,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":654,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-88YW3Y127C","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"216.58.201.232","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Apr 2026 08:35:05 GMT","end":"Mon, 13 Jul 2026 08:35:04 GMT"},"fingerprint":{"sha1":"E7:E4:62:10:D0:4A:34:4C:52:81:20:8A:19:37:09:AC:CB:16:42:54","sha256":"08:43:11:5A:D2:42:9C:49:2D:21:51:4F:92:B8:9E:59:04:F2:2D:E8:0F:ED:E7:49:06:D8:6F:61:B9:41:A2:36"}}},"request":{"raw":"GET /gtag/js?id=G-88YW3Y127C HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 12 May 2026 18:01:16 GMT\r\nexpires: Tue, 12 May 2026 18:01:16 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 157891\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":477617,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6031)","md5":"b47b601de59c412e86982388456f3725","sha1":"c000644adffb3dca72068edd42c169191855cd7f","sha256":"2b2890b3276ef05b064c8379298e1583211db0eef3ba698bffac3364e64d41bb","sha512":"e8b7eaa6b20558883a83eb72b9600466dd69bb484b5f0e17da2a8ec0ddfc6035af2ee55defd24e5b5f8660e0a4140250e81fcdfd2091c2074d0d97c28b8102a7","ssdeep":"6144:vcElo1RCCROOCNMnmPwPvkzmnpFhvO+h2Uqopi9Ix:vWCCYNMnI+fqCpx","tlshash":"2ca4e7cdb3d674625396f478903f018ba57b29a2b44cc899f189cce42e7469a4237f7c","first_seen":"2026-05-12T18:01:45.074134Z","last_seen":"2026-05-12T18:05:02.001656Z","times_seen":2,"resource_available":true,"data":null}},"time_used":546,"timings":{"blocked":188,"dns":12,"connect":34,"send":0,"wait":39,"receive":69,"ssl":196},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/img/logo-wo.png","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.833Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /img/logo-wo.png HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 1499757\r\nlast-modified: Thu, 05 Feb 2026 19:03:49 GMT\r\npriority: u=4,i=?0\r\netag: \"6984e995-16e26d\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iKv70xsz5ZYgLGPr7QveVlhNdcZ69S5RGiEHHM9HrAz2cT%2Brujt6trFjh6niuyu75M6hJyxSh%2FbBzLCoUCUpZIpzXrJE3xtWwJGTG6nOqPYtx3dZx%2BCkStKrGhW%2Biw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53e19c2756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1499757,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1500 x 1500, 8-bit/color RGBA, non-interlaced","md5":"757f103330ef69f42fa18f4879870e2c","sha1":"e17de90d8794f39c2ee609db90900bb45115fae6","sha256":"4c3f912ee62cd05e8e971448107f082f9c94a3b2f95208b3ab93f84e81491ff8","sha512":"5c650081a9b11a2916a4c52032f46a3c7c0c548ffcde257b5ff1060d2c6730e5c2570153afad07516a40ca6d28a801dc57d647918c00aa018d36c4c7a346bdb4","ssdeep":"24576:3vt0pqUwFYamkWc0n2JiUyn/izQpGVZtSMfXCpYnf/ns/:3l0pqUWYFRHnpUyizIGVZtS5z/","tlshash":"d62533e0b37d96221d3811c3691f8530c426228ce667ddf30a69bf8567bb261bf6d835","first_seen":"2026-05-12T18:01:45.057586Z","last_seen":"2026-05-12T18:05:01.986657Z","times_seen":2,"resource_available":false,"data":null}},"time_used":501,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":382,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/new-home/images/l7.png","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.869Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /new-home/images/l7.png HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 3499\r\nlast-modified: Sun, 22 Feb 2026 10:41:37 GMT\r\npriority: u=4,i=?0\r\netag: \"699add61-dab\"\r\nexpires: Thu, 11 Jun 2026 18:01:15 GMT\r\ncache-control: public, max-age=2592000, immutable\r\nvary: Accept-Encoding\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AucgY0l64iiQ9NyUQ7%2BBDEkL7m8gTEIuSh094v8hGAWLV2tFr3cfFgNrgF56ugvGgGZwXhh5n0WqTysYYCIF4f%2FSzo6RZTLrQ9tJurJ7aaGVFTemvint1mK%2Fq3o6Rg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9fab53e1dc5f56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3499,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 244 x 60, 8-bit/color RGBA, non-interlaced","md5":"1b3c8ac098da0ade826ff39948f21a1d","sha1":"0930667cd2b12cd8e3a10c3bba218396e5f669f6","sha256":"92d7990b0c5ba970ce62ffba2646b26c71e564b57c51f606786252eea00ae269","sha512":"3c8e7fd8a45cb2dd88d2a9249af3d43723d18ed13af4e41af6fb09bd09ab4726770f3d1bc64e1bdd7b68331f1240b528ecb52d85ccd5678297ee0e6a78bd9d79","ssdeep":"","tlshash":"95715cd3a7f6a54f91ac9eaadf8c8199818f5406732266287c0ed1612a20f911398e5a","first_seen":"2026-05-12T18:01:45.078092Z","last_seen":"2026-05-12T18:05:02.00402Z","times_seen":2,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.251.143.131","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:16.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Apr 2026 08:36:34 GMT","end":"Mon, 13 Jul 2026 08:36:33 GMT"},"fingerprint":{"sha1":"99:99:69:B2:FC:B4:4F:EA:18:FB:04:4C:0F:8D:3E:40:61:B5:31:00","sha256":"55:6F:9F:9F:5C:FF:31:03:79:C7:88:2B:89:0C:1A:2F:DE:0B:7B:1A:91:6E:BD:C8:7D:60:EF:5A:D9:C7:51:26"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://workoff.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 05 May 2026 18:07:08 GMT\r\nexpires: Wed, 05 May 2027 18:07:08 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nage: 604448\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-05-15T16:20:31.236686Z","times_seen":427503,"resource_available":false,"data":null}},"time_used":244,"timings":{"blocked":111,"dns":2,"connect":46,"send":0,"wait":15,"receive":4,"ssl":42},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/events","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:18.328Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"POST /events HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://workoff.org/\r\nContent-Type: application/json\r\nX-CSRF-TOKEN: tig7piSsAG8gWECt3HLm1Qgtkwz7iw8GfrLGuNYz\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 189\r\nOrigin: https://workoff.org\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: XSRF-TOKEN=eyJpdiI6IkdMbmVEbWc1M055VzcxRXR6dmM1RGc9PSIsInZhbHVlIjoicXZEMk84b2RHUU9tMjNScFNnV0VhUVpudktqZGI5ZEcxKzBkMDhHTXVQK0FQQ00zWDZZTlEydlRQSHJvNmRwcHN0bEVRUTZKd3dpanI4QVRZNjFJcExIRmdSeU0wekNlemordXRQS2k1Y2NZTUEydnE5Q0FNNnV0MkVJRXhyWnYiLCJtYWMiOiI3YzBkYzg4NjkxZjdhYWQyMjkyYzNhZjg4M2E5MGQ3ZDE1ODcyYjBmY2VlM2I4ZDgzN2UwYmEyOTM4YzBhZDkzIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6IlliQ0dBQXBZaDVFVFFoY2laVjZaS3c9PSIsInZhbHVlIjoiUnVFaE1aYjVieEZkZnViRU5XTFpYaHJOV1N3UjduR3R4QmlUeG9mM2hCb3dIdWIwYzFkUnFCY2dNOEt0OVVyMTN1VnE1QmlXOTFCQlladjdFU2s5UVArbFdET2pHSDhEdUlzSzNoYTdkaHdob055MlBaajI4UjFERVhNbW1qQWoiLCJtYWMiOiI2OTc0YzNkOTVlZWRhNGEyZGU4Zjc5MzZkYjQ2NmYxODAzYTIyOTIyYTA0NDBlMTEyNTE2NDgxY2JiYTE0MjcwIiwidGFnIjoiIn0%3D; _ga_88YW3Y127C=GS2.1.s1778608877$o1$g0$t1778608877$j60$l0$h0; _ga=GA1.1.1507905365.1778608878\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":189,"data":"{\"event_type\":\"fingerprint_ready\",\"url\":\"https://workoff.org/\",\"timezone_browser\":\"UTC\",\"fingerprint_hash\":\"faed01b113cfb270c624ee1aa793ad6c\",\"payload\":{\"os\":\"Windows\",\"browser\":\"Firefox\"}}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Tue, 12 May 2026 18:01:18 GMT\r\nset-cookie: XSRF-TOKEN=eyJpdiI6ImhlNWFCb3VlN2JZNWcvL3NXZVdGYVE9PSIsInZhbHVlIjoidWVSaUxhMURIeFdTRDE1RDNSRnFTaUMxbnRhTitKQnVYbEsxZFJ3dlFaaitkR1NUZ1JuTjZ6NGNFVDZLT2JOcTZwNTNTaHo3N0daaUIzeGVIa2ZZb1MxNFhGcWN1R1VzRCtoQVZ1NnhmVEZmNFlMQ2dNcFRRbnpiRm0vQ1c2L00iLCJtYWMiOiJlMDUwYWZlOTk0NjYwOTg4OGI1YjA1ZmU5YTgyZjU1ODdmMDFkOWE3Y2FhZWM2MTE3ZDM5MDk2ZTAzNDNjYzhiIiwidGFnIjoiIn0%3D; expires=Thu, 14-May-2026 06:01:18 GMT; Max-Age=129600; path=/; samesite=lax\ntaskhub_session=eyJpdiI6IjRna2UrSG5xbjYrc3BwL3RmL3pGcVE9PSIsInZhbHVlIjoiMEZYUXVYelBoeWRTUjQvRERLTHlLbTdrbFdLcHcyVHZ2S2RDdUliMzVMT2dGOFc3emcvSUpqS3dGbEVwV3luYTA1WW1WcUwrODVFRkZtNG5VZkpwTDVVZXg3ZitjQ1ZzYjkrUEJ0TFRNeVFtellhNTVnQnN3UHdxNkdNckZOL1oiLCJtYWMiOiI0YTllMWM0ZGY0OGJlZTQxOTVjYzA2ZjQxYzI1MDVkMDY3NTljNGE3ZWYyMTliZTNkODBjOTkwOTYwNzFiZGVlIiwidGFnIjoiIn0%3D; expires=Thu, 14-May-2026 06:01:18 GMT; Max-Age=129600; path=/; httponly; samesite=lax\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AEmVp3GDtBErvA9Ht1VGW8nafeC9ATZIdSe5hyTfKhmeQK4ndLhdDy96gBhd%2FEk0VJV6Aw2rvbgCkGryI2yZFZ9uyWF%2F0RGPhDJOjQHI%2FW68rS2NY0ivKNAf32q8Pg%3D%3D\"}]}\r\ncf-ray: 9fab53f19d8556a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"82380d1e263b6093f3c7535690fcdd75","sha1":"022d91f218046ab2e61cac1eb13d6a718f75df2b","sha256":"4062edaf750fb8074e7e83e0c9028c94e32468a8b6f1614774328ef045150f93","sha512":"180ea3cf6e7a00cb12ecff7ce095b8cef1921621de681a64e5e53e3efc0cf6053e557205f2bdb9b9d5af4de3d54c79d1c9b1c474b83897590c647b1e92d9c93a","ssdeep":"","tlshash":"2a500003000c0030c00003000300ff30000300300000000c000c3000033000c0003c03","first_seen":"2023-04-05T15:24:10Z","last_seen":"2026-05-15T15:14:40.620915Z","times_seen":8968,"resource_available":true,"data":null}},"time_used":136,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-12T18:01:15.336Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\nset-cookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; expires=Thu, 14-May-2026 06:01:15 GMT; Max-Age=129600; path=/; samesite=lax\ntaskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D; expires=Thu, 14-May-2026 06:01:15 GMT; Max-Age=129600; path=/; httponly; samesite=lax\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i6ZrgzIKDynpbP9Cf5gsIztd0keGfabjcrfTyJxdt60OU9JOX1xaQ%2FOYQ1cIIFxSnMs9yXO1wVTmBaeb6d86tnkhO8xt8sE40a1E637HdIvdhQsPnWp3U7KzNpYRDw%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9fab53df5c5e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"FingerprintJS:3","description":"FingerprintJS is a browser fingerprinting library that queries browser attributes and computes a hashed visitor identifier from them.","website":"https://fingerprintjs.com","common_platform_enumeration":"","icon":"FingerprintJS.svg","categories":["JavaScript libraries","Browser fingerprinting"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]}],"data":{"size":96960,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1342)","md5":"f46b425c7795472b281bf2b099749cdb","sha1":"23171a95d70a3c201478607fc63ee338e7d60516","sha256":"d19500a59f00b81197d405fe6ab996c072d54953dd8c8c9b0d574b13e3f8126c","sha512":"76bdb339864332dfcc4d5d771fa15ca1617a6785a7832e9fd9b10dddca39554ca9d1b2211e02f9c60fd5065e85ee75cd44308185487fd6a9dc1b982eda67f007","ssdeep":"1536:KQiAOONofpk3Wsv485+x3rGWQSZWy1Yrf0x:s4ofpk3WuXWbGG31d","tlshash":"98932b65b5f700b2156391baabe7960e7db180139907c6003a6c42a45ff6ec9ce37adc","first_seen":"2026-05-12T18:01:45.081399Z","last_seen":"2026-05-12T18:01:45.081399Z","times_seen":1,"resource_available":true,"data":null}},"time_used":343,"timings":{"blocked":73,"dns":50,"connect":3,"send":0,"wait":197,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.875Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 3.4.2\r\nx-jsd-version-type: version\r\netag: W/\"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\nage: 7985\r\nx-served-by: cache-fra-eddf8230131-FRA, cache-hel1410023-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 14485\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33780,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33446)","md5":"375436f436cc1022d7b4569a817c1a6b","sha1":"9359415cc419874654000870ca54523875c12c16","sha256":"99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae","sha512":"077cb9e67a028f8ffc6c9f19793c15e20379840da1a927e711a0ac4dcf15fe6e1a15cee75436df340c707b9e77118f3cd38ede493e060c592069f39bc6001a92","ssdeep":"384:chQYSwHRBcifEJzXhGUa4LdsF7wRuCfLVg5+pCqNFaiE8E0QIQfJW7us6RfGDUPX:cSMHRU7Lic9NwlJW5iffPREA75","tlshash":"c5e207d8b2c3b029227378b6497f6007b63abd15242d4843d57be4c17ca5e5a813bfb9","first_seen":"2023-07-07T04:22:54Z","last_seen":"2026-05-15T06:48:02.517191Z","times_seen":8267,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":9,"dns":10,"connect":14,"send":0,"wait":14,"receive":2,"ssl":41},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workoff.org/assets/scripts.v2.js?v=1775648986","fqdn":"workoff.org","domain":"workoff.org","tld":"org"},"ip":{"addr":"172.67.189.84","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://workoff.org/","date":"2026-05-12T18:01:15.905Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workoff.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Apr 2026 14:52:24 GMT","end":"Sat, 18 Jul 2026 14:52:23 GMT"},"fingerprint":{"sha1":"1B:A8:16:03:59:74:F4:FD:19:6A:35:8E:41:4B:9A:91:7D:2F:7E:16","sha256":"66:8F:1E:74:2C:C4:50:09:82:63:1A:77:7E:83:79:53:4E:87:B6:43:1A:63:97:8C:C9:A1:83:A7:0C:7F:50:41"}}},"request":{"raw":"GET /assets/scripts.v2.js?v=1775648986 HTTP/1.1\r\nHost: workoff.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://workoff.org/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhGY1MyOEhLcmVKUjZHQ2pLa3FkcFE9PSIsInZhbHVlIjoiQm5pVmwzTmZNQVFsWExSY09pWWloNSs0RUhUYklaRUc4R0xCaElKdzVPbTdFZUNLL0prUW5CRHpKNWZwcXF4c2hkQ2VMcjlGWisxZVc5V3RQaVZGVis3anJPY2hVRjBHMTZQZnRTUk01UzN1RFU4ZUlrK00xaDBSSlZjU0srNnYiLCJtYWMiOiJmNWQ5NDAxNjU5NDRmZjlkYzAxNmFmYTAwZDQxNjc1NzliMDIzMGU0NjYwNGFhOGUzMjdjNDFmZmZlZDJmNzExIiwidGFnIjoiIn0%3D; taskhub_session=eyJpdiI6Im45SXEyaXhyS0tvMjV2SDNFcGpkNGc9PSIsInZhbHVlIjoiTklDZEtUR2ltSFViK1hxc3NMQUNCOFRIWDdkL1dxcE1abVovL0JKUnRqUkV6ZUJVaU1kQncvNENkdHF5Q1JJbWNpTEJUZE9yb1hSWk1FU2pPOFUzU2R0azNhdExLeDZqdkIrUEJmcTgyM3BrQzl6b0FnZEE4T0c5WlpOSmlJQjkiLCJtYWMiOiI0OGFmNDY4ZTBjMmI5NzM4OWQ1MGQ0NDc0ZWFhMTcyZTRhMTlkNDA1YzdmOTIxOTBhZjM0ZGE3NmU0ZTM3NmU5IiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 12 May 2026 18:01:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 08 Apr 2026 11:49:46 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\netag: W/\"69d640da-447a\"\r\nexpires: Tue, 12 May 2026 18:01:14 GMT\r\ncache-control: no-cache, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eGb%2Fd7Nk2fcaTzKMWQvQUUO4bDSNHd7GFOfs1C0nnqG4JMV165m9asfU37mHZxy8e8KxZ%2BO9OrWbbhmua34ig462zBoTNNQah7GN0XDxxWzGl%2FD97zq7w9QkemOAFA%3D%3D\"}]}\r\ncf-ray: 9fab53e1ec6156a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17530,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"cac5ab8b36649ee83c84ce19aa530280","sha1":"757166b4b3c58e9f96e4e98a2ebb70bc71fd70b1","sha256":"7665c0df4c150b8585fe010341cdea3105016475f079537653ebd6de88f649fa","sha512":"8e4894d096a1d2e43af7440f856284083f327cc3627fa5f625da5b240caf9c7fdd89b9e52e09ebe4545055b0b12847b17c23bc791c6d9fdf1819a6f4dd040aa7","ssdeep":"384:horBESrkwHRvVMaAS7pNyfXmG1Hx1S2tTUeD01yam:irBVkQvwXtMgam","tlshash":"7972935931b3103546a7a2ff9bcb6748352820173406c4a93edd85681fe3e98e9b7bdc","first_seen":"2026-05-12T18:01:45.084017Z","last_seen":"2026-05-12T18:05:01.9896Z","times_seen":2,"resource_available":true,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-12","alert":"Sinkholed","trigger":"workoff.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}