{"report_id":"77ae8dbd-343e-4514-839b-450e935f2e31","version":6,"status":"done","tags":[],"date":"2026-01-06T06:04:46Z","url":{"schema":"http","addr":"www.candfa.xyz/","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":0,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"final":{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"title":"TEMP MAIL - huunog@candfa.xyz","dom":{"size":21543,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (963)","md5":"75fa2ca69238c07e6986ba25cc8605dc","sha1":"a9e140f9eef6663342cdeecbe831a701fedd60b9","sha256":"d4e289e7e43431e6e3d2a781a2f2cb5e200d0e93f2c5b3f77dcd6771c118080e","sha512":"597963c8a81a92da55b161e1b58b01a27106403881548e93cd6160340d2759a5750a6f05676de639abe2383dec428f7b03d0bd3211ff552754304bfe8464a23a","ssdeep":"192:xIzF6WBbV5P3K44VuFJqPx+Z3yqwyeVjBkTk9obr4dFMFKFG1jCz6plzONRDJ71c:xIRP7wyeVjaTk9obX8u9SZZKz","tlshash":"43a2622411f1547a009bd0d1bae0bf0baeaae347d99b5685f35c47d12fc3caadc83658","dom_hash":"domhash28d45366187a5903db6bb6c03979d445","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"www.candfa.xyz/","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":0,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-10T06:04:46Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.candfa.xyz","ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"domain_registered":"2025-11-13","domain_rank":0,"first_seen":"2026-01-06T06:04:46.548267Z","last_seen":"2026-01-06T06:04:46.548267Z","alert_count":13,"request_count":13,"received_data":445692,"sent_data":22234,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP:8.3.28","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Alpine.js","description":"","website":"https://github.com/alpinejs/alpine","common_platform_enumeration":"","icon":"Alpine.js.png","categories":["JavaScript frameworks"]},{"name":"Livewire","description":"Livewire is a full-stack Laravel framework for building dynamic interfaces.","website":"https://laravel-livewire.com","common_platform_enumeration":"","icon":"Livewire.svg","categories":["Web frameworks","Miscellaneous"]},{"name":"Laravel","description":"Laravel is a free, open-source PHP web framework.","website":"https://laravel.com","common_platform_enumeration":"cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*","icon":"Laravel.svg","categories":["Web frameworks"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-01-04T22:21:06.427471Z","alert_count":0,"request_count":3,"received_data":156199,"sent_data":1602,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-04T22:17:15.216142Z","alert_count":0,"request_count":2,"received_data":5254,"sent_data":936,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.quilljs.com","ip":{"addr":"172.66.40.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-03-27","domain_rank":205879,"first_seen":"2014-11-10T08:38:17Z","last_seen":"2026-01-01T20:54:22.601844Z","alert_count":0,"request_count":1,"received_data":25538,"sent_data":437,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-04T22:14:09.841371Z","alert_count":0,"request_count":2,"received_data":17552,"sent_data":1072,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"e85cefe3ffd9688d897d0dfe65fce2e1","sha1":"22cea5c3bbd147ba1e457cbe55cbfb380ce3e1a3","sha256":"799c8358b5e9fcac36cd58d53aa237ccd52f8bb4746670987ca16fa6e82078e4","sha512":"d09b2d7f2eb92981c010c11fc387496b90a101bdf54f657bef50c3711579ec34187905dc222e24df1999b4d470f0b90a19131241f6a7f8fad9021c4b8e8929bc","ssdeep":"","tlshash":"64b092ec3ce9bc0582136032bac63804f5a03822002edc12522ce630a5668a27d3904c","size":119,"data":"","first_seen":"2024-08-19T19:13:51.109408Z","last_seen":"2026-05-17T02:48:29.204501Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"6e3bb71217fb91d1c30ecf4efac13f4a","sha1":"553665074e0c962b7fac522e9965b72e24adc0bf","sha256":"e608c39f87682fac261b7d88d90adc139d39ea02088e1adad79112e0b0c65b5b","sha512":"2db7994fa4e62bda722c1b2b1667337883c7b576e91da40b6feea33270893302639b437ab0ee8291b59649c77cebd611e602a58997c33c8d37eb5c0428c73365","ssdeep":"","tlshash":"ebb092fc3cec980182a334267ad63c40e2a0783a016edc03652cf631652a4e23d6c44c","size":127,"data":"","first_seen":"2023-07-11T12:18:59Z","last_seen":"2026-05-17T02:48:29.206139Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"3532c0406bce922d00ab8391c1250ebf","sha1":"a6e52d23f454b927c05610099522f7e4afddabd1","sha256":"f10113cfc28081c26b074c71597a548c22d4e918e1141f489f213180735a41b6","sha512":"18f30d142ab36f1fe674f149574f07d4fc2e325c21b1569b5fd9a63bc2455e7a5f38c5da711bd7425ca84ca4da24ec5992cd89be42b18603fd524926c9c31a1c","ssdeep":"","tlshash":"dab092ec7ce8a859921721367ac97814f0b03822003edc47926ce67079228f23c2c48c","size":125,"data":"","first_seen":"2023-04-16T04:13:46Z","last_seen":"2026-06-09T23:52:32.605796Z","times_seen":423,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"4fc595ea344c5ad025c56e4bc236c048","sha1":"26071e710c0fa52847fa4ed144d6533ee63caff3","sha256":"33f3a657e6e34d2096baf55d18c911d7b74bf017fd02c3203f716ade8e8a8a18","sha512":"a4e05d22e5953849d48b55b49948ac034c7bb8e07359bcb2aa0ed272a024ef7284089f11f6e3d32c11d6e1b997f073d1ea073d0bd00be4d74d7a48d3c20ae0fe","ssdeep":"","tlshash":"d7b092fc7ced980082632522bac63c00e2a07826103edc02622cf670692b4e23d2c48c","size":124,"data":"","first_seen":"2023-04-16T04:13:46Z","last_seen":"2026-06-09T23:52:32.607467Z","times_seen":534,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"c1ea8d85a7e57080b4220f8da61488a1","sha1":"fe279a6d834cd95ab1b891f16a9a0e058ba8a8a5","sha256":"70eef56c78e1dc4110bb8a0f49e55036f3548d34c794dbb8af89c8da092ad9bb","sha512":"49ff23f76630d1856d34e144e5a824e2f90676a64c753121a32f108634aa0c1c8e44866ef8278f2099b83e4da6f41e063f554a9fc1e8fd4e650608bad0cd97ab","ssdeep":"","tlshash":"d9f0f06e5ac6fab4b972b0d6e74f730828f631c608835020c43c82567ca447bc2a58db","size":539,"data":"","first_seen":"2026-01-06T06:04:51.01597Z","last_seen":"2026-01-06T06:04:51.01597Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/livewire/livewire.js?id=90730a3b0e7144480175","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"dfeedac491be74aad041dfb839520d71","sha1":"98027368c29ef04587084aed2cbefd5c63c0b84d","sha256":"9352f0a33abaffc3392bc6340621411d499488b76515da0d3b99b3bfa91a6118","sha512":"87de40d373457b6021563ea99a23f2ace8dd1bf041f88be828ff929cb6a8ebe247aa823c814b8a0d6f45806041dea280c3bd2ad7c38be70ceef421dab7c36f89","ssdeep":"1536:bFWbBs025VQpotIfUoeR9g6qptWuPkbEFVnBqlsEGuIHIYMx0suDbk/5UK0t6fZT:5KyLBtuU4DptVZ82uIHIYhvt6FEOyuT","tlshash":"11f33a99b6c1f1b209c77164643f3a0fb2762054589d9090fa79cec07eba948522bf7f","size":159350,"data":"","first_seen":"2023-03-12T19:07:48Z","last_seen":"2026-05-17T02:48:29.176019Z","times_seen":36,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"9edd62c008239646c5676d42ba915b14","sha1":"7ecabd08db3a3247f0129ee2dc24b5b278036337","sha256":"ee21a32719a5754554b70f99ef5ad10702c0024bba6519fa12053e3aaddd44ae","sha512":"5f61b4d2a087f20b339c9b1ff09a5c14c8bc24561a8ca37dcb506ae07397e545b6775042c6c5198fb445b8394a9d3fe1bdfbc487414bf2edbab214cdbddcc604","ssdeep":"","tlshash":"8fe07d3416b374f142a2e0403fd763c120a1100f7de0d50d7f0c458d4f48a60f990754","size":370,"data":"","first_seen":"2026-01-06T06:04:51.016877Z","last_seen":"2026-01-06T06:04:51.016877Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"6e3bb71217fb91d1c30ecf4efac13f4a","sha1":"553665074e0c962b7fac522e9965b72e24adc0bf","sha256":"e608c39f87682fac261b7d88d90adc139d39ea02088e1adad79112e0b0c65b5b","sha512":"2db7994fa4e62bda722c1b2b1667337883c7b576e91da40b6feea33270893302639b437ab0ee8291b59649c77cebd611e602a58997c33c8d37eb5c0428c73365","ssdeep":"","tlshash":"ebb092fc3cec980182a334267ad63c40e2a0783a016edc03652cf631652a4e23d6c44c","size":127,"data":"","first_seen":"2023-07-11T12:18:59Z","last_seen":"2026-05-17T02:48:29.206139Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"939b42e37b4c9b0626b2b9bcfcedf6df","sha1":"a90ec38168dc712df901a96738d6050ae2fa991f","sha256":"98403a9ba41c9701039f58f847a75089c7f07cbe70f8d57fb06e08d336bf908a","sha512":"a6f1489f4dbbf7736c8800fbebc39b0ca0e9b587c046de29391d87c0c4e2bb08b1b6aa7360213afb26be099828e8fc40030999700d70f20fa208c33afc2d5797","ssdeep":"","tlshash":"ecb092fd3dec9804836b24267ac63c40e2a0782a026edc02613cf731652a4e23d2c44c","size":126,"data":"","first_seen":"2023-07-11T12:18:59Z","last_seen":"2026-05-17T02:48:29.214956Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"4fc595ea344c5ad025c56e4bc236c048","sha1":"26071e710c0fa52847fa4ed144d6533ee63caff3","sha256":"33f3a657e6e34d2096baf55d18c911d7b74bf017fd02c3203f716ade8e8a8a18","sha512":"a4e05d22e5953849d48b55b49948ac034c7bb8e07359bcb2aa0ed272a024ef7284089f11f6e3d32c11d6e1b997f073d1ea073d0bd00be4d74d7a48d3c20ae0fe","ssdeep":"","tlshash":"d7b092fc7ced980082632522bac63c00e2a07826103edc02622cf670692b4e23d2c48c","size":124,"data":"","first_seen":"2023-04-16T04:13:46Z","last_seen":"2026-06-09T23:52:32.607467Z","times_seen":534,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"6e3bb71217fb91d1c30ecf4efac13f4a","sha1":"553665074e0c962b7fac522e9965b72e24adc0bf","sha256":"e608c39f87682fac261b7d88d90adc139d39ea02088e1adad79112e0b0c65b5b","sha512":"2db7994fa4e62bda722c1b2b1667337883c7b576e91da40b6feea33270893302639b437ab0ee8291b59649c77cebd611e602a58997c33c8d37eb5c0428c73365","ssdeep":"","tlshash":"ebb092fc3cec980182a334267ad63c40e2a0783a016edc03652cf631652a4e23d6c44c","size":127,"data":"","first_seen":"2023-07-11T12:18:59Z","last_seen":"2026-05-17T02:48:29.206139Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"176e369567b90703c1fa4650d6a37983","sha1":"b2f4ae980e96aae3e8896220ed7cf2de3047b963","sha256":"ad12fc0898f62fc9d01634f9f65816e0cd215cd2fc96104de53fc0e9833e01e5","sha512":"be84ec4164bec13d5a3476ce6ee7b1ed44ce807beb8922f7a5855911b8c3cdf1e125a1c66b4935b73273a5f10bac58c732e763efdf99e205bdb5c7647069bb54","ssdeep":"","tlshash":"0bf0591f22e348381da399ab76afd7c93921c4030055d9093f6c85443f81fa8d370b94","size":625,"data":"","first_seen":"2025-08-22T06:00:11.93284Z","last_seen":"2026-05-16T21:33:12.559238Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"2da0ea67e13ad07beef29f1c47041cc9","sha1":"8f2602fb9fbde913b3a137bb475a97706e466d16","sha256":"b63e2f04e1c13b4da7a3c17e7bbf21dfba0f7c6b66e3145935ba2209c9f33b1d","sha512":"8b8533a99c9d268d28019eb40b0a3f91234be3ae70867ae1af5ae8308846e085806defe6cb9c7894b649e3d9bbac4513c0b0f786935f4aecbb018ccc566b7280","ssdeep":"","tlshash":"6a1146b212722c6444cf82765d35c785bc60a06bd14b5486b57c4a083f82d11d2973fa","size":996,"data":"","first_seen":"2026-01-06T06:04:51.019624Z","last_seen":"2026-01-06T06:04:51.019624Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"939b42e37b4c9b0626b2b9bcfcedf6df","sha1":"a90ec38168dc712df901a96738d6050ae2fa991f","sha256":"98403a9ba41c9701039f58f847a75089c7f07cbe70f8d57fb06e08d336bf908a","sha512":"a6f1489f4dbbf7736c8800fbebc39b0ca0e9b587c046de29391d87c0c4e2bb08b1b6aa7360213afb26be099828e8fc40030999700d70f20fa208c33afc2d5797","ssdeep":"","tlshash":"ecb092fd3dec9804836b24267ac63c40e2a0782a026edc02613cf731652a4e23d2c44c","size":126,"data":"","first_seen":"2023-07-11T12:18:59Z","last_seen":"2026-05-17T02:48:29.214956Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"b368727f69c6d939ef637e2f28820c50","sha1":"14899e44c84f58fb0351c51f3508b7786fb553ba","sha256":"715b7096703635f7cad3d100e6b691fdb45b09cd344f3064ef17f67e6299742c","sha512":"eaad252d6a93a9ea2d3cd358145d866a6809e680bf15ecbc3309dc05522c498a51a22b4a27d656b4e26fcf4428bceda51e574f8617554e586350c73bba69a34e","ssdeep":"","tlshash":"b4b092fd3cec9818826328237ac63c00e2b07826012edc03a12cf6b4652a4e2bf2c45c","size":128,"data":"","first_seen":"2024-08-19T19:13:51.099378Z","last_seen":"2026-05-17T02:48:29.209297Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"b368727f69c6d939ef637e2f28820c50","sha1":"14899e44c84f58fb0351c51f3508b7786fb553ba","sha256":"715b7096703635f7cad3d100e6b691fdb45b09cd344f3064ef17f67e6299742c","sha512":"eaad252d6a93a9ea2d3cd358145d866a6809e680bf15ecbc3309dc05522c498a51a22b4a27d656b4e26fcf4428bceda51e574f8617554e586350c73bba69a34e","ssdeep":"","tlshash":"b4b092fd3cec9818826328237ac63c00e2b07826012edc03a12cf6b4652a4e2bf2c45c","size":128,"data":"","first_seen":"2024-08-19T19:13:51.099378Z","last_seen":"2026-05-17T02:48:29.209297Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"4fc595ea344c5ad025c56e4bc236c048","sha1":"26071e710c0fa52847fa4ed144d6533ee63caff3","sha256":"33f3a657e6e34d2096baf55d18c911d7b74bf017fd02c3203f716ade8e8a8a18","sha512":"a4e05d22e5953849d48b55b49948ac034c7bb8e07359bcb2aa0ed272a024ef7284089f11f6e3d32c11d6e1b997f073d1ea073d0bd00be4d74d7a48d3c20ae0fe","ssdeep":"","tlshash":"d7b092fc7ced980082632522bac63c00e2a07826103edc02622cf670692b4e23d2c48c","size":124,"data":"","first_seen":"2023-04-16T04:13:46Z","last_seen":"2026-06-09T23:52:32.607467Z","times_seen":534,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"939b42e37b4c9b0626b2b9bcfcedf6df","sha1":"a90ec38168dc712df901a96738d6050ae2fa991f","sha256":"98403a9ba41c9701039f58f847a75089c7f07cbe70f8d57fb06e08d336bf908a","sha512":"a6f1489f4dbbf7736c8800fbebc39b0ca0e9b587c046de29391d87c0c4e2bb08b1b6aa7360213afb26be099828e8fc40030999700d70f20fa208c33afc2d5797","ssdeep":"","tlshash":"ecb092fd3dec9804836b24267ac63c40e2a0782a026edc02613cf731652a4e23d2c44c","size":126,"data":"","first_seen":"2023-07-11T12:18:59Z","last_seen":"2026-05-17T02:48:29.214956Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"3532c0406bce922d00ab8391c1250ebf","sha1":"a6e52d23f454b927c05610099522f7e4afddabd1","sha256":"f10113cfc28081c26b074c71597a548c22d4e918e1141f489f213180735a41b6","sha512":"18f30d142ab36f1fe674f149574f07d4fc2e325c21b1569b5fd9a63bc2455e7a5f38c5da711bd7425ca84ca4da24ec5992cd89be42b18603fd524926c9c31a1c","ssdeep":"","tlshash":"dab092ec7ce8a859921721367ac97814f0b03822003edc47926ce67079228f23c2c48c","size":125,"data":"","first_seen":"2023-04-16T04:13:46Z","last_seen":"2026-06-09T23:52:32.605796Z","times_seen":423,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"3532c0406bce922d00ab8391c1250ebf","sha1":"a6e52d23f454b927c05610099522f7e4afddabd1","sha256":"f10113cfc28081c26b074c71597a548c22d4e918e1141f489f213180735a41b6","sha512":"18f30d142ab36f1fe674f149574f07d4fc2e325c21b1569b5fd9a63bc2455e7a5f38c5da711bd7425ca84ca4da24ec5992cd89be42b18603fd524926c9c31a1c","ssdeep":"","tlshash":"dab092ec7ce8a859921721367ac97814f0b03822003edc47926ce67079228f23c2c48c","size":125,"data":"","first_seen":"2023-04-16T04:13:46Z","last_seen":"2026-06-09T23:52:32.605796Z","times_seen":423,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/js/app.js","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"4994274113a5390ff8878204c2f57b04","sha1":"4d2736ce5cd4d6a71a1afcb4fdcde3b371c43a5f","sha256":"0b1a003f27003e7d54667c7388be9e340e78303c6b88871a93e38224b16cc577","sha512":"c4f23ad1b92cf827b1647c6c387626a6dbe4e2411c22b1074647c40dadc84e766e15e575a726b73a97404d6ba2fbdb9d3f6feeda702d84489c4b660529536b27","ssdeep":"1536:hImrq1EzBVr3APBjClFErsnDK0mF9bx5DNddGFaK9Gzh7QtFHnG/zuAzHxN2mUG:SeLrUOrkugzhstFHG/aEHN","tlshash":"3dc3c4d9b692f03143a720b500bf410bf23ead54784e8584f264e8d97d79a4ea1b7f39","size":127733,"data":"","first_seen":"2023-08-07T01:04:59Z","last_seen":"2026-05-17T02:48:29.194014Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"4fc595ea344c5ad025c56e4bc236c048","sha1":"26071e710c0fa52847fa4ed144d6533ee63caff3","sha256":"33f3a657e6e34d2096baf55d18c911d7b74bf017fd02c3203f716ade8e8a8a18","sha512":"a4e05d22e5953849d48b55b49948ac034c7bb8e07359bcb2aa0ed272a024ef7284089f11f6e3d32c11d6e1b997f073d1ea073d0bd00be4d74d7a48d3c20ae0fe","ssdeep":"","tlshash":"d7b092fc7ced980082632522bac63c00e2a07826103edc02622cf670692b4e23d2c48c","size":124,"data":"","first_seen":"2023-04-16T04:13:46Z","last_seen":"2026-06-09T23:52:32.607467Z","times_seen":534,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/vendor/Shortcode/Shortcode.js","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"13a9c793fb268b343c26ae915c4991a9","sha1":"a5a5f3401c62062d8ecd9d4484262d199b05d70f","sha256":"84746a83b7652252afda5a0e2b47c6a1c501d5705e4a191a7f668c3b8e44d662","sha512":"994f8ca414c68caf8101a6edcccfdf2a894aa2711e7830de186e937aa5312c830f7494f7dcf60d27b393ffce6980fdd63b1e29bd8f813ed08ee8e465973f1e63","ssdeep":"96:+YD+c1G8PrQ5I+u1nJl0ESlz3vVzRLjXyE7gNd7N9zSl8H3rdIdIRSpU:9D+c1GOQ5nanYESlzVztjXngNd7N9zsC","tlshash":"58a111997efb1165d12330794adf1084ba35700b281d8d64fa4c97f45fd1439a1eeeb8","size":4947,"data":"","first_seen":"2023-03-07T17:56:27Z","last_seen":"2026-06-09T06:06:52.662061Z","times_seen":49,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/storage/js/jspopunder.js","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":false,"md5":"a8535c6f279a283fea671a0e607b5cb5","sha1":"fd0a1fdd48444d707d7c287f9cb090d83f50bc32","sha256":"28c908c7ffcf899d7e7daff9fe769fef004537d0d7252822e060204682d98e24","sha512":"0ca91c74f9ffe603cbd983e755e4d212f4a7e887711552f66e8900ce5cec9b43ceabe9f6d53dfbac11487f719f19aaf8313a97d048d586339efcf6156838f821","ssdeep":"","tlshash":"feb0123219214379829f098f32f8ebb9fff91550b091146481bccf1ca67ac82c517be1","size":115,"data":"","first_seen":"2023-08-07T01:04:59Z","last_seen":"2026-05-17T02:48:29.186335Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"8c5bd5ce9d4f991ee3ff5f0971132e21","sha1":"03e2862aa1fbd35886145beea92dffb3c2491989","sha256":"d3a28ee44838f4eb421959e6a75978068c9a7ef74b97c573c57814e85976b591","sha512":"bb04e4828a7ade305da08c90df322bd18fab880fc1f98cf6d88c81417e924d335a571790f05c88fb791d81d59e3d7537639d989b5afe348c5fed35b2771d44b1","ssdeep":"","tlshash":"44b048ed3ce8a8299213202a6ac57804e0a03866002e9c06923cf67065228a23d2848c","size":127,"data":"","first_seen":"2023-07-11T12:18:59Z","last_seen":"2026-05-17T02:48:29.221335Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"4fc595ea344c5ad025c56e4bc236c048","sha1":"26071e710c0fa52847fa4ed144d6533ee63caff3","sha256":"33f3a657e6e34d2096baf55d18c911d7b74bf017fd02c3203f716ade8e8a8a18","sha512":"a4e05d22e5953849d48b55b49948ac034c7bb8e07359bcb2aa0ed272a024ef7284089f11f6e3d32c11d6e1b997f073d1ea073d0bd00be4d74d7a48d3c20ae0fe","ssdeep":"","tlshash":"d7b092fc7ced980082632522bac63c00e2a07826103edc02622cf670692b4e23d2c48c","size":124,"data":"","first_seen":"2023-04-16T04:13:46Z","last_seen":"2026-06-09T23:52:32.607467Z","times_seen":534,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"introduction_type":"Function","is_inline":false,"md5":"b368727f69c6d939ef637e2f28820c50","sha1":"14899e44c84f58fb0351c51f3508b7786fb553ba","sha256":"715b7096703635f7cad3d100e6b691fdb45b09cd344f3064ef17f67e6299742c","sha512":"eaad252d6a93a9ea2d3cd358145d866a6809e680bf15ecbc3309dc05522c498a51a22b4a27d656b4e26fcf4428bceda51e574f8617554e586350c73bba69a34e","ssdeep":"","tlshash":"b4b092fd3cec9818826328237ac63c00e2b07826012edc03a12cf6b4652a4e2bf2c45c","size":128,"data":"","first_seen":"2024-08-19T19:13:51.099378Z","last_seen":"2026-05-17T02:48:29.209297Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.candfa.xyz/storage/js/jspopunder.js","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /storage/js/jspopunder.js HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/mailbox\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Mon, 05 Jan 2026 18:47:04 GMT\r\naccept-ranges: bytes\r\ncontent-length: 115\r\ndate: Tue, 06 Jan 2026 06:04:24 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":115,"size_decoded":0,"mime_type":"text/javascript","magic":"ASCII text, with no line terminators","md5":"a8535c6f279a283fea671a0e607b5cb5","sha1":"fd0a1fdd48444d707d7c287f9cb090d83f50bc32","sha256":"28c908c7ffcf899d7e7daff9fe769fef004537d0d7252822e060204682d98e24","sha512":"0ca91c74f9ffe603cbd983e755e4d212f4a7e887711552f66e8900ce5cec9b43ceabe9f6d53dfbac11487f719f19aaf8313a97d048d586339efcf6156838f821","ssdeep":"","tlshash":"feb0123219214379829f098f32f8ebb9fff91550b091146481bccf1ca67ac82c517be1","first_seen":"2023-08-07T01:04:59Z","last_seen":"2026-05-17T02:48:29.186335Z","times_seen":16,"resource_available":true,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/images/favicon.png","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:28.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /images/favicon.png HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/mailbox\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 13 Jan 2026 06:04:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 15 Jun 2023 19:29:46 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3181\r\ndate: Tue, 06 Jan 2026 06:04:28 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3181,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"f016f32b4f79ecaa4f3de0894e013e9a","sha1":"4c6bd631c0d9bf51987b3a38826b83de125cac8e","sha256":"e48038dd093f81fbf4aca9aaabc1d0df443541ef959dc3961429d8c7e5b36862","sha512":"03b2335b962b79b4ca3b827c7c5c97fd5be9a6b80b6ee8fe3bbd174f666f96156a1abe162958186b07f36ce6eef3de9e8acfea154e7b819733985ed1b2fe195c","ssdeep":"","tlshash":"61613c2a4451d6814e0f99b5b799e453fa6620459c238641eecbf2dbb3562e830b1278","first_seen":"2024-03-20T15:45:34Z","last_seen":"2026-05-17T02:48:29.180165Z","times_seen":24,"resource_available":false,"data":null}},"time_used":4004,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":205,"receive":3799,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/webfonts/fa-regular-400.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:29.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 20:49:06 GMT","end":"Fri, 13 Feb 2026 21:49:04 GMT"},"fingerprint":{"sha1":"9A:71:C8:6F:E2:4B:9A:91:7D:C8:4A:1D:79:98:2F:97:C1:85:D8:79","sha256":"4E:C5:BB:7A:81:A0:D9:00:73:8D:D5:57:59:3D:A0:C3:D3:BE:62:18:4E:6F:6D:98:DA:F0:90:94:5E:E0:0B:63"}}},"request":{"raw":"GET /ajax/libs/font-awesome/5.15.1/webfonts/fa-regular-400.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.candfa.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 06:04:29 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 13548\r\ncf-ray: 9b9904acc9305ebd-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\netag: \"5f7b5b5f-34ec\"\r\nlast-modified: Mon, 05 Oct 2020 17:43:59 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1498170\r\nexpires: Sun, 27 Dec 2026 06:04:29 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=iG%2BzrGal7rxzy7xYZaLjGWw4mI3ejmS2LMg%2BCFQBWuuxdCPvjOiL7mvoFxJTtxs32%2FbAskKq6garASJv7w0Gsbj4JO2bEcxiAE7%2F%2BcEmvh02L%2BWPqtgZOl27XhKfBPh%2BzEnu14pj\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13548,"size_decoded":0,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 13548, version 331.-31392","md5":"4a74738e7728e93c4394b8604081da62","sha1":"fb9648469530a05fa9aac80e47d4d6960472a242","sha256":"ce20ed8a323117c8a718ff1ddc6dabb997373b575a8e896f2bf02b846c082c9d","sha512":"cc1f2ea5a6321ad04ffbc43022184785acd7db636109b841694403261850744b47cb5f2b60fe4f72d717668880392f3ea477c013a90e61c66aa68fb60704790c","ssdeep":"192:MOw0hBKT6co4S2NIyI7e7biB9nnNn2AY28rvYI2k0EQTW50IBNd+N/KwWBuWAgm8:M/CgMNnN6jj4k0EQ6PNdE/KwzW2du","tlshash":"8452c1b68fa74c9cd2d33d140b5e5294f6175a8512baa22396cc82ac008bf745cdac87","first_seen":"2023-04-06T10:15:59Z","last_seen":"2026-06-09T23:35:29.173887Z","times_seen":9660,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/webfonts/fa-solid-900.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:29.576Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 20:49:06 GMT","end":"Fri, 13 Feb 2026 21:49:04 GMT"},"fingerprint":{"sha1":"9A:71:C8:6F:E2:4B:9A:91:7D:C8:4A:1D:79:98:2F:97:C1:85:D8:79","sha256":"4E:C5:BB:7A:81:A0:D9:00:73:8D:D5:57:59:3D:A0:C3:D3:BE:62:18:4E:6F:6D:98:DA:F0:90:94:5E:E0:0B:63"}}},"request":{"raw":"GET /ajax/libs/font-awesome/5.15.1/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.candfa.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 06:04:29 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 80300\r\ncf-ray: 9b9904acd93d5ebd-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\netag: \"5f7b5b5f-139ac\"\r\nlast-modified: Mon, 05 Oct 2020 17:43:59 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1738871\r\nexpires: Sun, 27 Dec 2026 06:04:29 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=wTK8nEHj0uFtxUZ%2Fc%2BmMiiQnAW3L0bYfUY6jXzp0ul3qbUQbOnIXLGPGlRJROQMHxlOb96jjY9geeAt9KuykIeHmuRsoqSpEPrkrzb0xRYDKuiPFdQBm1WQ36R99g5hxMM%2FEX%2BNG\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80300,"size_decoded":0,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 80300, version 331.-31392","md5":"8e1ed89b6ccb8ce41faf5cb672677105","sha1":"9b592048b9062b00f0b2dd782d70a95b7dc69b83","sha256":"6b555920e358f8a25a422988b448615c33bcccb4f932e8331cebfc8e2a737fc7","sha512":"e2f6b4574cb1541dff6852d0af44faae80286110e8451841eade4b53ebdf31150602640fe1bdfff41459ea4ae884d14d115fbc93b30d199c87b88f5d07e4cd72","ssdeep":"1536:Tek2SzK4WGTQH1GlyGLj3SUwtyIWeOo4XyydPl2mN4fsxDFsbaLsND1Vv08:ak2gTQVGLL7IyDelE7dPZ35FeND19","tlshash":"d3730272fd7b05541fe8e3ad39390568bb881acc35c949f2058afc95e0ab67a7684d03","first_seen":"2023-04-05T05:13:35Z","last_seen":"2026-06-09T23:35:29.233255Z","times_seen":27990,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/livewire/message/frontend.app","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:29.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"POST /livewire/message/frontend.app HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html, application/xhtml+xml\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.candfa.xyz/mailbox\r\nContent-Type: application/json\r\nX-Livewire: true\r\nX-CSRF-TOKEN: Ar1GfrCFba3jE18s5uC9PuzgZbYs66EGrqcb8Gd3\r\nContent-Length: 576\r\nOrigin: https://www.candfa.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":576,"data":"{\"fingerprint\":{\"id\":\"DJamtgCpJHw7z83iVgUF\",\"name\":\"frontend.app\",\"locale\":\"en\",\"path\":\"mailbox\",\"method\":\"GET\",\"v\":\"acj\"},\"serverMemo\":{\"children\":[],\"errors\":[],\"htmlHash\":\"98f2c0da\",\"data\":{\"messages\":[],\"deleted\":[],\"error\":\"\",\"email\":\"huunog@candfa.xyz\",\"initial\":false,\"overflow\":false},\"dataMeta\":[],\"checksum\":\"2106d23bd393fcd6b60d4577737b90a7eccac07c7cf5433da2eb72faf38fa37b\"},\"updates\":[{\"type\":\"fireEvent\",\"payload\":{\"id\":\"e8rfj\",\"event\":\"syncEmail\",\"params\":[\"huunog@candfa.xyz\"]}},{\"type\":\"fireEvent\",\"payload\":{\"id\":\"h94o\",\"event\":\"fetchMessages\",\"params\":[]}}]}"}},"response":{"raw":"HTTP/3 200 OK\r\nx-powered-by: PHP/8.3.28\r\ncache-control: max-age=0, must-revalidate, no-cache, no-store, private\r\ncontent-type: application/json\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\nset-cookie: XSRF-TOKEN=eyJpdiI6Ik4yYTlyTlZMRFN5SVRRWFkwTThBYnc9PSIsInZhbHVlIjoibUloak9yRmxNR2JmeGMzdjIzN0gwTkpITkhPZTltMHlJZVVVMHZrRXlQMVRxNjBrOWFYbzk4eVZIaUlMSFNCdkViSGMyTVFqb2FWWnNSazJQVCtMU0dJc2E4ekEweElRWndaZitDcWdMNkYvQnJGZFZwRWZVL0RJT2h1OHd4NkEiLCJtYWMiOiJlNjk1NTkxOWYyZmYwNGExMjliYmE5MzdjNWU3N2IzYTIzNDFkYmM4NmU2M2NlYjJkNTgyZTJmYWY4NWUxNzQzIiwidGFnIjoiIn0%3D; expires=Tue, 06-Jan-2026 08:04:29 GMT; Max-Age=7200; path=/; samesite=lax; secure\n_session=eyJpdiI6Imo3TFZqMW5kOHMvczJSZWtnRiswRVE9PSIsInZhbHVlIjoiZUFXQWhXckVvM09VS0J3Uk5NWHU1T29CZmxFRDZ1bGZURDJuTDh2dVVZTS9KZXcvQ2ZKbUg5WGxYK09YdHJFTFR6V3FBdEUzMEhPSVNFN1RmTURURnhpOFRncUVvdTlIS3pxUzlDeU1vdVZER3VHRkJTQTg2TEVvS0VGdGxOUm0iLCJtYWMiOiJjMjY2ZjljYThjZWRiY2QzYWY4NDUwYTZhOTJkNGE4ZDkxOWQ5YmU3MjQwZmE4ZWFiMmQwYTUxYjgxZjE0OGY5IiwidGFnIjoiIn0%3D; expires=Tue, 06-Jan-2026 08:04:29 GMT; Max-Age=7200; path=/; httponly; samesite=lax; secure\r\ncontent-length: 603\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 06 Jan 2026 06:04:29 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.28","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1215,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"f1a4fbc1294589a3238491c0ca35d1ca","sha1":"9faa416937e46b4fbcce79c4c38c002d26627cb1","sha256":"1d0dffbb5dbcf699747578a9f7b834ed720b475044dda73aeb6352ce7da51d79","sha512":"3785c45ae5ca674a721bb10502f3c8f7120eedfbeacae80206c47f3056451b864d52666c19ed5e6349f9047de23b5922ae55a84ba999174684d7d6960b90e801","ssdeep":"","tlshash":"8a21122171db8b75078b9a9920297def3d04b6978d7bd441b6dd450683526b0cc53172","first_seen":"2026-01-06T06:04:50.99473Z","last_seen":"2026-01-06T06:04:50.99473Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1122,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T06:04:23.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nx-powered-by: PHP/8.3.28\r\ncache-control: no-cache, no-store, must-revalidate, max-age=0\r\nlocation: https://www.candfa.xyz/mailbox\r\ncontent-type: text/html; charset=UTF-8\r\nset-cookie: XSRF-TOKEN=eyJpdiI6IjlJWk53c210cGhGTHlWczk2TmR5MEE9PSIsInZhbHVlIjoiWkNkZUE2cFA1MkNZblJQL1dJYjVOUW5EQ1YvN3N0YWxON3dpMzVRUloxVXZobjhDd05DSkJnNWJrdk1wN2F3SVlnY1BwNlRIODdWM25xZ2krMHpjcE5JUnBlU1ZJK2s4WGYxa0M4OGpNR3cySFFpalFibnBQaWlLUE1ybE9ybUUiLCJtYWMiOiIyNGZiM2IxMzlhZDgzNzRiZTQ1NWUxNGFiNmY5ZmJmODM2MThkOWIxOWMwMjM3ZjQ1N2I3YTgyMjBmY2M1NWY0IiwidGFnIjoiIn0%3D; expires=Tue, 06-Jan-2026 08:04:23 GMT; Max-Age=7200; path=/; samesite=lax; secure\n_session=eyJpdiI6InFoVmVKS2hMRE9PUTByUXdBZytjeUE9PSIsInZhbHVlIjoiYnVOWW5sMWFSRk8vMU5EVENIa3lyaitTbkVobWt1OFN4OTlITGdLdi94TjREcmdXTlR2UEROek1IUXBLb1g2N0draS84T2JYYjVIMkFxZnlGR1BVY0sxRFdDWFRxL09JRXVsVldLcmZibnpBVTJDK1MvTHRZV0RPRjg4c3E3anAiLCJtYWMiOiIxZmYxN2EyOGNhODFhY2IyZWRmM2FhN2EzMTJiZDNlODRhYjdhNTFlMTc2ZjMxNGIxZDJhOTViNzIwNzhiODFlIiwidGFnIjoiIn0%3D; expires=Tue, 06-Jan-2026 08:04:23 GMT; Max-Age=7200; path=/; httponly; samesite=lax; secure\nemail=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; expires=Thu, 05-Feb-2026 16:04:23 GMT; Max-Age=2628000; path=/; httponly; samesite=lax; secure\nemails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9; expires=Thu, 05-Feb-2026 16:04:23 GMT; Max-Age=2628000; path=/; httponly; samesite=lax; secure\r\ncontent-length: 164\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 06 Jan 2026 06:04:23 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"PHP:8.3.28","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":23247,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-09T23:14:11.29978Z","times_seen":16281720,"resource_available":true,"data":null}},"time_used":2357,"timings":{"blocked":995,"dns":377,"connect":431,"send":0,"wait":367,"receive":0,"ssl":185},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/js/app.js","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /js/app.js HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/mailbox\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 15 Jun 2023 19:29:46 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 42019\r\ndate: Tue, 06 Jan 2026 06:04:24 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":127733,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65279)","md5":"4994274113a5390ff8878204c2f57b04","sha1":"4d2736ce5cd4d6a71a1afcb4fdcde3b371c43a5f","sha256":"0b1a003f27003e7d54667c7388be9e340e78303c6b88871a93e38224b16cc577","sha512":"c4f23ad1b92cf827b1647c6c387626a6dbe4e2411c22b1074647c40dadc84e766e15e575a726b73a97404d6ba2fbdb9d3f6feeda702d84489c4b660529536b27","ssdeep":"1536:hImrq1EzBVr3APBjClFErsnDK0mF9bx5DNddGFaK9Gzh7QtFHnG/zuAzHxN2mUG:SeLrUOrkugzhstFHG/aEHN","tlshash":"3dc3c4d9b692f03143a720b500bf410bf23ead54784e8584f264e8d97d79a4ea1b7f39","first_seen":"2023-08-07T01:04:59Z","last_seen":"2026-05-17T02:48:29.194014Z","times_seen":8,"resource_available":true,"data":null}},"time_used":1166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":427,"receive":739,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Poppins:wght@400;600\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:54:11 GMT","end":"Wed, 25 Feb 2026 15:54:10 GMT"},"fingerprint":{"sha1":"43:D3:3F:93:6C:4F:F7:67:58:9D:D5:48:20:4C:74:A2:69:DB:13:9F","sha256":"8C:DB:D2:85:E1:AB:12:7B:1D:5A:65:A7:EC:22:67:6F:B3:A6:65:01:28:29:FA:D2:3B:01:8D:10:7E:4D:09:52"}}},"request":{"raw":"GET /css2?family=Poppins:wght@400;600\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 06 Jan 2026 06:04:25 GMT\r\ndate: Tue, 06 Jan 2026 06:04:25 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2390,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"99732590118df209cfff721d0d4bbb19","sha1":"6ae6323f3fcd8085a9bb38292b65972b92f1881a","sha256":"7d306f38fb5378f3a004776b9c2436cb31e864dfe47674b4f8334673ae5a2bb9","sha512":"c84f3706d491bf8ee62c595caba3533a9078dd5e474ea291b8d683d50eed716f19379ceb6007ac78ad50a53f64faa65f776310029514b363a4f9126c5aa3f1a5","ssdeep":"","tlshash":"ae419bd1087be114ab831cc123ce7d37ee1e9255b810e5786bfd0c98adabc654362b2d","first_seen":"2025-09-17T06:17:11.832934Z","last_seen":"2026-06-09T17:28:07.598142Z","times_seen":4113,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":88,"dns":1,"connect":17,"send":0,"wait":33,"receive":0,"ssl":83},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/images/sample.jpg","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.156Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /images/sample.jpg HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/mailbox\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 13 Jan 2026 06:04:24 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 15 Jun 2023 19:29:46 GMT\r\naccept-ranges: bytes\r\ncontent-length: 35195\r\ndate: Tue, 06 Jan 2026 06:04:24 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":35195,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 543x481, components 3","md5":"efec5f8acbcc3b4db39f5e1ce3931f55","sha1":"7eecdd78c213d69a67ee7abfd84bf7891d7c1455","sha256":"34cb8c7e6c2f90b005ce74b0f851f3b84ca019b3c1c38f2b6c1252271ee6b175","sha512":"59f24386e8aebd083ddd672fa15b8ca1cbb3db71002bc9239eac2f885b1a99b2c979d33bc8a798655ad1a9a5e0948088c766b58a9ffa7ef79ad564246b0ba848","ssdeep":"768:jdUzFWymW5dTFC/xzF28uGQ7gg+nvGN8Roqqu8YQOENn4:jsAyJ7FmkQQ9KojnOEK","tlshash":"4df2bf5df68026cca8a600ae0ebd6a5cd558c0f517f2e0de3eac8cf9c6f135b9950199","first_seen":"2024-08-19T19:13:51.066465Z","last_seen":"2026-05-16T21:33:12.538142Z","times_seen":8,"resource_available":false,"data":null}},"time_used":2294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":694,"receive":1600,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/livewire/livewire.js?id=90730a3b0e7144480175","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.158Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /livewire/livewire.js?id=90730a3b0e7144480175 HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/mailbox\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 15 Jun 2023 19:29:46 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 40126\r\ndate: Tue, 06 Jan 2026 06:04:24 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":159350,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (54461)","md5":"dfeedac491be74aad041dfb839520d71","sha1":"98027368c29ef04587084aed2cbefd5c63c0b84d","sha256":"9352f0a33abaffc3392bc6340621411d499488b76515da0d3b99b3bfa91a6118","sha512":"87de40d373457b6021563ea99a23f2ace8dd1bf041f88be828ff929cb6a8ebe247aa823c814b8a0d6f45806041dea280c3bd2ad7c38be70ceef421dab7c36f89","ssdeep":"1536:bFWbBs025VQpotIfUoeR9g6qptWuPkbEFVnBqlsEGuIHIYMx0suDbk/5UK0t6fZT:5KyLBtuU4DptVZ82uIHIYhvt6FEOyuT","tlshash":"11f33a99b6c1f1b209c77164643f3a0fb2762054589d9090fa79cec07eba948522bf7f","first_seen":"2023-03-12T19:07:48Z","last_seen":"2026-05-17T02:48:29.176019Z","times_seen":36,"resource_available":true,"data":null}},"time_used":4329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1068,"receive":3261,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/livewire/message/frontend.actions","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:29.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"POST /livewire/message/frontend.actions HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html, application/xhtml+xml\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.candfa.xyz/mailbox\r\nContent-Type: application/json\r\nX-Livewire: true\r\nX-CSRF-TOKEN: Ar1GfrCFba3jE18s5uC9PuzgZbYs66EGrqcb8Gd3\r\nContent-Length: 539\r\nOrigin: https://www.candfa.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":539,"data":"{\"fingerprint\":{\"id\":\"Qjok6u8EGqEiidCARwTC\",\"name\":\"frontend.actions\",\"locale\":\"en\",\"path\":\"mailbox\",\"method\":\"GET\",\"v\":\"acj\"},\"serverMemo\":{\"children\":[],\"errors\":[],\"htmlHash\":\"a713f459\",\"data\":{\"in_app\":false,\"user\":null,\"domain\":null,\"domains\":[\"candfa.xyz\"],\"email\":\"huunog@candfa.xyz\",\"emails\":[\"huunog@candfa.xyz\"],\"captcha\":null},\"dataMeta\":[],\"checksum\":\"6f3a6f7ae0fb3392769b8a7ec809cc7d28737eb401c80f7edb6e4568242d6dd5\"},\"updates\":[{\"type\":\"fireEvent\",\"payload\":{\"id\":\"smh6\",\"event\":\"syncEmail\",\"params\":[\"huunog@candfa.xyz\"]}}]}"}},"response":{"raw":"HTTP/3 200 OK\r\nx-powered-by: PHP/8.3.28\r\ncache-control: max-age=0, must-revalidate, no-cache, no-store, private\r\ncontent-type: application/json\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\nset-cookie: XSRF-TOKEN=eyJpdiI6InFheXFCSDBsUWlLQXJaM2ZoT0N2S0E9PSIsInZhbHVlIjoiODQzYlVQUWViZFA1VGF0eS9KSXkwM214QlVSZUxkMVMyS3ZUTzNjdUJsRXIvOEZTZHZETWJ5V1ZCR1NKNm8ycURYZ2RwcElBejRVMTZLS3ZkYWxGQzVkNkNWZVoyc013UHBYMEVhN2JEZzZneGlpUmNtOW1YN1l2TDBHcCtpd1giLCJtYWMiOiJiYmU3NjYxZjljZTQzNmQ4MTZjNDA2Mjk2ZGVkZTZmYTcyMjNiNGVjODg2YjVkZDQzNzE0OGM3YjYxYjk3NWYzIiwidGFnIjoiIn0%3D; expires=Tue, 06-Jan-2026 08:04:29 GMT; Max-Age=7200; path=/; samesite=lax; secure\n_session=eyJpdiI6IndqUkE4T3kxOVFqdDVLV2VWdUN4NVE9PSIsInZhbHVlIjoic2drYS82OE5pbVR2WmFta00rNUxTdCtZdzBGL2xPTytrMWJFaDdFYXZQSnl3a1lxeUw3UFBBTWhCSkpjSGpTdGRmNmdDbHpZbVZNT2NnWlBlQTVQL0ljMGR2QWJ0c2J3cmZWcUFKbDd4TkxGU29ZTzBKV2Foa3lFUEdodHo4cUwiLCJtYWMiOiJkZDc2NGNiOGNjYmNhOGE5YTQ4YjlkZjQ3MGI5M2IzNGQ2NDU3YTc0OTY4YzVhODM2OTEyNTYxNDkzNzM5YTYzIiwidGFnIjoiIn0%3D; expires=Tue, 06-Jan-2026 08:04:29 GMT; Max-Age=7200; path=/; httponly; samesite=lax; secure\r\ncontent-length: 110\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 06 Jan 2026 06:04:29 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.28","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":129,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"600d3699b8c12842a027e81667e49a89","sha1":"793e695572e554bc1d12d0bd97a3f6d47e930f9d","sha256":"a518a5ce06c8af90978ec2254beea5f569fd39ae218b4f830f4cdc7ee6143b17","sha512":"96aedb9ff19e4dec80d79ac5118ee8d080816bd95115f66414bc7db8aa9cc8ffe36539ab2ecbeb1d190e5e97554edcbf26ae43330cf12d28e0730ec4da059f5d","ssdeep":"","tlshash":"74b09b5124651db856dc7409c85a3b46591f44df21100c3103d51e134efb9b538c5913","first_seen":"2026-01-06T06:04:51.003557Z","last_seen":"2026-01-06T06:04:51.003557Z","times_seen":1,"resource_available":false,"data":null}},"time_used":396,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":395,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/mailbox","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T06:04:24.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /mailbox HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: XSRF-TOKEN=eyJpdiI6IjlJWk53c210cGhGTHlWczk2TmR5MEE9PSIsInZhbHVlIjoiWkNkZUE2cFA1MkNZblJQL1dJYjVOUW5EQ1YvN3N0YWxON3dpMzVRUloxVXZobjhDd05DSkJnNWJrdk1wN2F3SVlnY1BwNlRIODdWM25xZ2krMHpjcE5JUnBlU1ZJK2s4WGYxa0M4OGpNR3cySFFpalFibnBQaWlLUE1ybE9ybUUiLCJtYWMiOiIyNGZiM2IxMzlhZDgzNzRiZTQ1NWUxNGFiNmY5ZmJmODM2MThkOWIxOWMwMjM3ZjQ1N2I3YTgyMjBmY2M1NWY0IiwidGFnIjoiIn0%3D; _session=eyJpdiI6InFoVmVKS2hMRE9PUTByUXdBZytjeUE9PSIsInZhbHVlIjoiYnVOWW5sMWFSRk8vMU5EVENIa3lyaitTbkVobWt1OFN4OTlITGdLdi94TjREcmdXTlR2UEROek1IUXBLb1g2N0draS84T2JYYjVIMkFxZnlGR1BVY0sxRFdDWFRxL09JRXVsVldLcmZibnpBVTJDK1MvTHRZV0RPRjg4c3E3anAiLCJtYWMiOiIxZmYxN2EyOGNhODFhY2IyZWRmM2FhN2EzMTJiZDNlODRhYjdhNTFlMTc2ZjMxNGIxZDJhOTViNzIwNzhiODFlIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-powered-by: PHP/8.3.28\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: max-age=0, must-revalidate, no-cache, no-store, private\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\nset-cookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; expires=Tue, 06-Jan-2026 08:04:24 GMT; Max-Age=7200; path=/; samesite=lax; secure\n_session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; expires=Tue, 06-Jan-2026 08:04:24 GMT; Max-Age=7200; path=/; httponly; samesite=lax; secure\r\ncontent-length: 5221\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 06 Jan 2026 06:04:24 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alpine.js","description":"","website":"https://github.com/alpinejs/alpine","common_platform_enumeration":"","icon":"Alpine.js.png","categories":["JavaScript frameworks"]},{"name":"Livewire","description":"Livewire is a full-stack Laravel framework for building dynamic interfaces.","website":"https://laravel-livewire.com","common_platform_enumeration":"","icon":"Livewire.svg","categories":["Web frameworks","Miscellaneous"]},{"name":"Laravel","description":"Laravel is a free, open-source PHP web framework.","website":"https://laravel.com","common_platform_enumeration":"cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*","icon":"Laravel.svg","categories":["Web frameworks"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP:8.3.28","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":23247,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (963)","md5":"129a26572894f4de9956bd4a1ccb2f9d","sha1":"f75f2e5d166c6959fc8a19eee78ae07bf283e357","sha256":"e83e978b537267d7a1afe123b39912307546b1b2d7c18dd4eda6fde997c56ba9","sha512":"5df9f768ca036f6eb99e1048da775010a9dc31ea79a0c7caf5fff4bfc36ee7a5e636e5992c6be25b7a90eadc66ef8795c6250ff02de918bddef119ebcc210356","ssdeep":"192:n5zF2WBbV5P3K44VuFJqPCBF3ywwyeVHQw7gRTkMoyQPrpdF+FKFG1dw3kJAT8Mv:n5RrvwyeVH7kTkMoVdzTjC11SNC4","tlshash":"7ea2532451f2447a009fa0d1f6a0bf0a9eabe743d99757d5b25c42d12fc3caadc83598","first_seen":"2026-01-06T06:04:51.004844Z","last_seen":"2026-01-06T06:04:51.004844Z","times_seen":1,"resource_available":false,"data":null}},"time_used":371,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":370,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.quilljs.com/1.3.6/quill.snow.css","fqdn":"cdn.quilljs.com","domain":"quilljs.com","tld":"com"},"ip":{"addr":"172.66.40.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.143Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.quilljs.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 05 Dec 2025 02:43:03 GMT","end":"Thu, 05 Mar 2026 03:42:54 GMT"},"fingerprint":{"sha1":"DF:69:3E:28:F1:FE:E9:70:15:3C:EB:B2:FF:3F:BD:D5:A9:2F:7E:AD","sha256":"E0:C0:E3:2C:1A:86:72:1E:13:97:D5:A7:62:0D:7C:17:96:7A:FA:63:4D:55:A6:C4:F6:64:D3:62:39:A9:49:D9"}}},"request":{"raw":"GET /1.3.6/quill.snow.css HTTP/1.1\r\nHost: cdn.quilljs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 06:04:25 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 3688\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Mn%2F9wiV%2FV0dg6aVEw9asif336vdTyi1Fmtx6Me%2FeowlqdChRPqel8Qoa8mXm8nZld9YWCu%2FfbyJcOK7cduWBbdJSpbFHf3EOfzpUzg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=604800\r\ncontent-encoding: br\r\netag: \"9b536bda67650c506df72197baec4c01\"\r\nlast-modified: Mon, 22 Apr 2024 16:07:39 UTC\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nage: 271673\r\ncf-ray: 9b9904915a5d5696-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24743,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"9b536bda67650c506df72197baec4c01","sha1":"aadcbf9d0983e99646f076f27b5409ad48176332","sha256":"892e299431955e9ae388ae257f72024ee76af2d52a7a97a868f70fbe50f16144","sha512":"3d534c764c3ed946f131a174dd94f19110b248197942f6604903ced2fb88a582336f987e435f32f00fd6fcde15a68f047ab1e88b60d366d6bf531add28f1b474","ssdeep":"768:vXZh8GMCIQW+3P3/YgJhgoi6sEJRJByKn8WI7FFrFhFrFJ0SFWpr5mGibPz7QoYJ:vXT85CIQW+3P3/YgJhgoi6sEJRJByKnl","tlshash":"dfb21f4dedab1dbf412660bd900112d07fce6753d0ebaab9d4e16d8e25ec094c36a39c","first_seen":"2023-04-06T20:59:50Z","last_seen":"2026-06-09T00:29:46.788023Z","times_seen":847,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":30,"dns":20,"connect":3,"send":0,"wait":9,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 20:49:06 GMT","end":"Fri, 13 Feb 2026 21:49:04 GMT"},"fingerprint":{"sha1":"9A:71:C8:6F:E2:4B:9A:91:7D:C8:4A:1D:79:98:2F:97:C1:85:D8:79","sha256":"4E:C5:BB:7A:81:A0:D9:00:73:8D:D5:57:59:3D:A0:C3:D3:BE:62:18:4E:6F:6D:98:DA:F0:90:94:5E:E0:0B:63"}}},"request":{"raw":"GET /ajax/libs/font-awesome/5.15.1/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.candfa.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 06:04:25 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 10491\r\ncf-ray: 9b990491389f5ebd-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"5f7b5b5f-e7d0\"\r\nlast-modified: Mon, 05 Oct 2020 17:43:59 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1511466\r\nexpires: Sun, 27 Dec 2026 06:04:25 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=j3AGbnjlbKUeAeA6Mc2jaR5e%2BzkbpP2RZaut4rIGcIJNtKJtfhcFyF4NM4W7sCoYV8qENv5M822KFGHMuBqpHNIe55yIhnxX5ULn5f8uk41XYI1xHvyzzqnK98dzH0w2ueTvjWDp\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":59344,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (59158)","md5":"b227b1617a1763c8bc056772f05482b4","sha1":"c508528feb9fd540454f838653cd4863b290df2e","sha256":"af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325","sha512":"fb8cc22bd93ea8d1544795fe70a2fd10847e64e86d225a0d97d188292e7b57533236c62961c52b51e41cf6f35fcec59f576f0868b2f78bde8ff6c74dc9e46cb0","ssdeep":"768:OEh31IPiyXNq4YxBowbgJlkwF//zMQyYJYX9Bft6VSzl:OE0PxXE4YXJgndFTfy9lt5B","tlshash":"c743fbb8e54c01c9b731c44bef82b2bc61b6f73de5914d95f00e691c2ad26a811c5fba","first_seen":"2023-04-05T05:13:35Z","last_seen":"2026-06-09T22:52:51.723652Z","times_seen":11252,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":11,"dns":1,"connect":3,"send":0,"wait":12,"receive":1,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/css/common.css","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.148Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /css/common.css HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/mailbox\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 13 Jan 2026 06:04:24 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 15 Jun 2023 19:29:46 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 516\r\ndate: Tue, 06 Jan 2026 06:04:24 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1286,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1285)","md5":"10138ddf451a0ffcaf9a7c052d99b641","sha1":"81abf73414527a283b2fcd074cedcd8f0b2bca0c","sha256":"a47b5874419e20c90acfaad7a8dae72434007657a4dd4827a2ec8b02ff18dbf4","sha512":"c30478954d861298d8c247117c2550880ed57f3591773f5ee4a191353190db0e4fe3d83559fe86ca617ba9f1fa452246c55e2200497bfb7d1c9a5ef3b3a43f98","ssdeep":"","tlshash":"f42145abf99254180466d93bb8c16f541a36b00ca7e915bafa501cb88fe93374225758","first_seen":"2023-08-07T01:04:59Z","last_seen":"2026-05-17T02:48:29.190598Z","times_seen":7,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/vendor/Shortcode/Shortcode.js","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /vendor/Shortcode/Shortcode.js HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/mailbox\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 15 Jun 2023 19:29:46 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1609\r\ndate: Tue, 06 Jan 2026 06:04:24 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4947,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"13a9c793fb268b343c26ae915c4991a9","sha1":"a5a5f3401c62062d8ecd9d4484262d199b05d70f","sha256":"84746a83b7652252afda5a0e2b47c6a1c501d5705e4a191a7f668c3b8e44d662","sha512":"994f8ca414c68caf8101a6edcccfdf2a894aa2711e7830de186e937aa5312c830f7494f7dcf60d27b393ffce6980fdd63b1e29bd8f813ed08ee8e465973f1e63","ssdeep":"96:+YD+c1G8PrQ5I+u1nJl0ESlz3vVzRLjXyE7gNd7N9zSl8H3rdIdIRSpU:9D+c1GOQ5nanYESlzVztjXngNd7N9zsC","tlshash":"58a111997efb1165d12330794adf1084ba35700b281d8d64fa4c97f45fd1439a1eeeb8","first_seen":"2023-03-07T17:56:27Z","last_seen":"2026-06-09T06:06:52.662061Z","times_seen":49,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Kadwa:wght@400;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:54:11 GMT","end":"Wed, 25 Feb 2026 15:54:10 GMT"},"fingerprint":{"sha1":"43:D3:3F:93:6C:4F:F7:67:58:9D:D5:48:20:4C:74:A2:69:DB:13:9F","sha256":"8C:DB:D2:85:E1:AB:12:7B:1D:5A:65:A7:EC:22:67:6F:B3:A6:65:01:28:29:FA:D2:3B:01:8D:10:7E:4D:09:52"}}},"request":{"raw":"GET /css2?family=Kadwa:wght@400;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 06 Jan 2026 06:04:25 GMT\r\ndate: Tue, 06 Jan 2026 06:04:25 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1492,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"ee403cd314c60ddc9d88202a4fbbc040","sha1":"9da26c46664de2809a27c02958e56db0043977aa","sha256":"3a75b557a2dd752ab92729f393d8dfce3c07c83235cfa351b6ce55e5206ccc85","sha512":"954b679cead0873d0c6c5a1e3744cac397166cae1988d42c3d3a9979e360d62ec2ab440d7cd772e81ea18791db02f30fa79757e28e39016bd05464e97eefaa63","ssdeep":"","tlshash":"4731cdd508276900eb93acd163de7e36df4e12156441da79cbfe08c8ecaac2253a5b1d","first_seen":"2025-10-10T04:30:46.430846Z","last_seen":"2026-06-03T22:52:42.696519Z","times_seen":35,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":157,"dns":0,"connect":16,"send":0,"wait":34,"receive":0,"ssl":148},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiEyp8kv8JHgFVrJJfecg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:54:11 GMT","end":"Wed, 25 Feb 2026 15:54:10 GMT"},"fingerprint":{"sha1":"21:10:1E:48:79:6B:E7:49:AB:BB:0E:38:86:C8:4D:74:7B:42:EE:BB","sha256":"0A:58:99:06:D8:BC:1C:BD:3E:CE:EF:7D:D6:D2:50:2D:1E:DE:8F:87:97:56:72:B9:3F:21:88:AC:79:3A:75:03"}}},"request":{"raw":"GET /s/poppins/v24/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.candfa.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 7884\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 31 Dec 2025 00:02:31 GMT\r\nexpires: Thu, 31 Dec 2026 00:02:31 GMT\r\ncache-control: public, max-age=31536000\r\nage: 540114\r\nlast-modified: Mon, 15 Sep 2025 16:34:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7884,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7884, version 1.0","md5":"9212f6f9860f9fc6c69b02fedf6db8c3","sha1":"ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b","sha256":"7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f","sha512":"67317495f4b53e20a9f31c034e456e6c37f387dffb2c092caa5159bc441cfcadd02749ffe5bbed1d580d5300a59e48a767ef2c6d9978b474f84c1a2cd095c126","ssdeep":"192:xLFDbKO9E3rS3JWBRO/J601FSS5ZUbik3Zy2f0:pd9J5W501otlI","tlshash":"c3f1ae4eb3f2cd1be40982e53a0fc90b1c578272681fd772d067a22517893bc8db2c81","first_seen":"2023-04-05T15:35:34Z","last_seen":"2026-06-09T22:52:59.799563Z","times_seen":354042,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":96,"dns":1,"connect":27,"send":0,"wait":27,"receive":1,"ssl":66},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/css/vendor.css","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /css/vendor.css HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/mailbox\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 13 Jan 2026 06:04:24 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 15 Jun 2023 19:29:46 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 8111\r\ndate: Tue, 06 Jan 2026 06:04:24 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":49357,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (49356)","md5":"a8ae6fbb0cb70050feaa64cebc04fe1a","sha1":"4371542d8cd53e0cb19eedfc925c0fe1c93aba15","sha256":"1940bd2177ad6d842b79044884faedac0ea45b10ec7fcb8a66300562666691b2","sha512":"f6673bf6c26b883b77fb489be8b67bebf117cbe79ef55fc8c8af56f70794730541e2b06f77300d3342690bdc90e2458c09623b5d21b6b9143e3a058f13bd2d63","ssdeep":"384:Oz7qrwjQkBKkys/yHqtE/pelxvM+NN0xZ4yGIJH6:5wxKHqztNN0xO","tlshash":"9e23a31eab21103f6c27c5fae599e9ed911ab1c5ee3622e7bc422510cbc57f71c63118","first_seen":"2025-05-15T03:50:37.212192Z","last_seen":"2026-01-06T06:04:51.009924Z","times_seen":3,"resource_available":false,"data":null}},"time_used":664,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":419,"receive":245,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.candfa.xyz/images/logo.png","fqdn":"www.candfa.xyz","domain":"candfa.xyz","tld":"xyz"},"ip":{"addr":"103.251.44.194","port":443,"asn":131775,"as":"PT. Jupiter Jala Arta","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.candfa.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Dec 2025 04:06:22 GMT","end":"Wed, 18 Mar 2026 04:06:21 GMT"},"fingerprint":{"sha1":"C3:04:47:70:F3:5A:CF:46:D2:0A:F8:A3:4F:37:22:29:64:E3:85:AD","sha256":"9F:8B:70:A4:25:9A:0E:49:AE:A1:86:53:3A:43:51:58:38:0C:A2:EE:4B:18:9E:3D:79:5D:54:F3:43:DD:03:E6"}}},"request":{"raw":"GET /images/logo.png HTTP/1.1\r\nHost: www.candfa.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.candfa.xyz/mailbox\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhBN1VuMDNldnlxRVhidzNjVXNjcHc9PSIsInZhbHVlIjoiS0NScXlUTUF0V040MHJuZGttbGZkT0o1RFFKS2RZNUR0NTJzY216U2t2clVES2RYMnJHTnNVMnVhbXk5QTA1endMSVlHbndNdXA3TFZlNUpFd296ZlN5UUlFcnJKeldGanM5ajBqbnNVSkJEU2tLaXQwaDJFSjhoL1FSWFhuZW0iLCJtYWMiOiI1MjJkNTEyMWEzZDZmNzc1ZGVjMjcyNzI5MmZhNmFjOTA4ZDNhZDFmYzExMWUxOTdhYzc3NzMxM2VhZmQ1OTc5IiwidGFnIjoiIn0%3D; _session=eyJpdiI6ImVwb3g2NzFiY0JXMUJPc1pHdHFablE9PSIsInZhbHVlIjoia0ZFS0h6eFluVkEweVkyZWxmZmFTTkNUL2RGNVJ3Vi9yTjJyZFN2eFdWL1VML2tROFlmN0VYbmt1eUptMU5PUEpvQm5vK3lIa0FEa1RndEZQVEVYcm5lTExjVGxnRTdCS243ODRNTCsvNHFZVnhVaGFzcmU2MkRUVHJCbFRrN3ciLCJtYWMiOiJiYTBjOGIxODk2ZGJlZWQ4MzUzODlhOTM2ZmY3OTJiMWE1YjBjY2M1YWIwNWI1NjIzYTQ2YzQ1ZTI3YjZiOGMzIiwidGFnIjoiIn0%3D; email=eyJpdiI6IlF0N3pTTTFXOHh1R0xWaXVKU3BLOEE9PSIsInZhbHVlIjoiTlcrWkI0KzFZRlZhdFk2aG5zQTNBdFcvZTNZOWc2cnB4Y3ZzYWI5bzl5M1RoUXZmSTBPSDdGaVEyRXVBZUNFa0tJZXhUbFgrRDNjWWF6b3FuSWg4TWc9PSIsIm1hYyI6Ijc1N2EyMDBkMzE0ZWU4ZGM3ZTJhMTIxZWM5YjVlYWI2NDUzMTc0YmNlOGI5ZTFhNDk4YjBmYTZlZTA3MDBjZGYiLCJ0YWciOiIifQ%3D%3D; emails=eyJpdiI6Ik5wVjZhRzl4RTlIdUlPWlJlZkxsNmc9PSIsInZhbHVlIjoiNG9CTlpWN1AwNC9PVUU2alEzQXQ2UHVqeCtnL1NJWFJlMURIR2ltKzRHNE5RUmRXK3VobjV0TnZUZG9mV3c1Yml1RWZERzViQjRJTG1XNUlwVXVkQ2IzcVdOUUEwZVRRdGNQakphYjZnMlk9IiwibWFjIjoiYzJjYmFkNGRlNjA0OGM3MmI0NDBlZmM4NjRlZDBjNDAxZDU4ZDQ0ZTkzY2Y3MjUyYzYzNGM0OTkwMjFlYWQ4NiIsInRhZyI6IiJ9\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 13 Jan 2026 06:04:24 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 15 Jun 2023 19:29:46 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8264\r\ndate: Tue, 06 Jan 2026 06:04:24 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8264,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 465 x 100, 8-bit/color RGBA, non-interlaced","md5":"42905fe0a6c9993cdc7de74207af75bd","sha1":"eb59f0e95cb5a9960c5755ac387b7d43f2607b4a","sha256":"5b7ce2e686b5d3b0f185470ffadd78a7ea87486444be8fdb3e6b2ccb0924180d","sha512":"80b1732b7a9376936e7b20238d585b27a0fd004e5c8416ba3dc15a87eb9f8d5b4cdad510d2621ed5086703c12c50fa6c12d33524b8ace103199e9033a19d21fe","ssdeep":"192:n++FA/duRWTE8BCgxNldhJpRKSMhCws4oN/DuJoBi6kNyUOiOQci:n++q/d4D8BCMbJRMhCws44aJci6MOiOY","tlshash":"d602af8ee6c74d2291c360f10df181b94d649f41dc49ef0958ceec96262f23a95d8fe2","first_seen":"2024-08-19T19:13:51.072151Z","last_seen":"2026-05-16T21:33:12.528729Z","times_seen":12,"resource_available":false,"data":null}},"time_used":1587,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":671,"receive":916,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"www.candfa.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.candfa.xyz/mailbox","date":"2026-01-06T06:04:25.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:54:11 GMT","end":"Wed, 25 Feb 2026 15:54:10 GMT"},"fingerprint":{"sha1":"21:10:1E:48:79:6B:E7:49:AB:BB:0E:38:86:C8:4D:74:7B:42:EE:BB","sha256":"0A:58:99:06:D8:BC:1C:BD:3E:CE:EF:7D:D6:D2:50:2D:1E:DE:8F:87:97:56:72:B9:3F:21:88:AC:79:3A:75:03"}}},"request":{"raw":"GET /s/poppins/v24/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://www.candfa.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 8000\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 31 Dec 2025 00:05:02 GMT\r\nexpires: Thu, 31 Dec 2026 00:05:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 539963\r\nlast-modified: Mon, 15 Sep 2025 16:33:57 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8000,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 8000, version 1.0","md5":"72993dddf88a63e8f226656f7de88e57","sha1":"179f97ec0275f09603a8db94d4380eb584d81cd5","sha256":"f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149","sha512":"7c20165f9d22a86341e841fd58526209017dcde2afe2d0d2a89fe853d95dc69f658d25cf798c71f452dab09843fc808c1ae87a60b1284134163abf5a1d93e50a","ssdeep":"192:GDonmfrEdXT8WrxzRXwyQo3zGEOM7Y2hOMgWnsfYSjv4ENFGwrlKJ:8onPxTzjgyQSzLPXOTIYHJAJ","tlshash":"08f1b0ffa92456c4df692475a5044f27623652b4dd35cb2f496f3e12d2d74224bcc4c1","first_seen":"2023-04-05T18:53:14Z","last_seen":"2026-06-09T23:08:11.636948Z","times_seen":255245,"resource_available":false,"data":null}},"time_used":230,"timings":{"blocked":100,"dns":1,"connect":27,"send":0,"wait":27,"receive":3,"ssl":69},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}