{"report_id":"792e14d3-d49d-429c-bf74-e901cca17d2e","version":6,"status":"done","tags":[],"date":"2026-02-22T09:36:18Z","url":{"schema":"http","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"104.21.40.41","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"title":"Assistir One Piece Dublado - Episódio 58 - Goyabu","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"104.21.40.41","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-29T09:36:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":2,"urlquery":0,"analyzer":2}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-22T09:35:54Z","timestamp":1771752954,"ip_dst":{"addr":"193.200.65.5","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"ip_src":{"addr":"Client IP","port":44750,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2026-02-22T09:35:54.811703+0000\",\"flow_id\":152938651242051,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.38\",\"src_port\":44750,\"dest_ip\":\"193.200.65.5\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"cc.cloudad.icu\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3363,\"start\":\"2026-02-22T09:35:54.773699+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-22T09:35:54Z","timestamp":1771752954,"ip_dst":{"addr":"Client IP","port":44750,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"193.200.65.5","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"severity":"medium","alert":"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.icu)","source":"{\"timestamp\":\"2026-02-22T09:35:54.830585+0000\",\"flow_id\":152938651242051,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"193.200.65.5\",\"src_port\":443,\"dest_ip\":\"172.18.0.38\",\"dest_port\":44750,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026890,\"rev\":3,\"signature\":\"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.icu)\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"updated_at\":[\"2020_09_16\"]}},\"tls\":{\"subject\":\"CN=cc.cloudad.icu\",\"issuerdn\":\"C=US, O=Let's Encrypt, CN=R12\",\"serial\":\"05:8E:F0:80:0D:95:8F:28:00:C1:70:C8:7F:77:DD:FB:1C:67\",\"fingerprint\":\"22:67:ab:37:bb:af:d9:d6:84:97:a3:dd:2b:15:c5:87:d5:5d:51:2e\",\"sni\":\"cc.cloudad.icu\",\"version\":\"TLS 1.2\",\"notbefore\":\"2026-02-08T21:20:04\",\"notafter\":\"2026-05-09T21:20:03\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":7,\"pkts_toclient\":6,\"bytes_toserver\":1080,\"bytes_toclient\":3429,\"start\":\"2026-02-22T09:35:54.773699+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-21","alert":"Sinkholed","trigger":"e7cod.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"sync.vqserve.com","ip":{"addr":"77.223.121.118","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"domain_registered":"2024-09-01","domain_rank":520405,"first_seen":"2024-10-25T14:11:40Z","last_seen":"2026-02-16T11:46:14.526921Z","alert_count":0,"request_count":4,"received_data":2303,"sent_data":1902,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.29.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"logger.21wiz.com","ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-02-13","domain_rank":579220,"first_seen":"2024-10-08T10:01:42Z","last_seen":"2026-02-20T12:02:00.573314Z","alert_count":0,"request_count":9,"received_data":5030,"sent_data":5739,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"a.utraff.com","ip":{"addr":"213.171.19.196","port":443,"asn":56694,"as":"LLC Smart Ape","country":"Russia","country_code":"RU"},"domain_registered":"2016-09-27","domain_rank":179342,"first_seen":"2019-02-27T10:01:37Z","last_seen":"2026-02-18T22:38:34.034997Z","alert_count":0,"request_count":1,"received_data":658,"sent_data":400,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"code.21wiz.com","ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"domain_registered":"2024-02-13","domain_rank":536982,"first_seen":"2024-04-08T16:13:14Z","last_seen":"2026-02-14T22:40:13.064588Z","alert_count":0,"request_count":45,"received_data":408157,"sent_data":33666,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"mc.acint.net","ip":{"addr":"193.3.184.27","port":443,"asn":50214,"as":"QWARTA LLC","country":"Russia","country_code":"RU"},"domain_registered":"2014-02-06","domain_rank":245226,"first_seen":"2024-01-29T15:31:01Z","last_seen":"2026-02-19T13:41:43.031785Z","alert_count":0,"request_count":3,"received_data":1802,"sent_data":1558,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"21wiz.com","ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-02-13","domain_rank":17129,"first_seen":"2021-02-01T12:26:32Z","last_seen":"2026-02-20T12:01:59.544434Z","alert_count":0,"request_count":2,"received_data":135191,"sent_data":931,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"us.shb-sync.com","ip":{"addr":"8.2.110.33","port":443,"asn":46636,"as":"NATCOWEB","country":"United States","country_code":"US"},"domain_registered":"2020-02-04","domain_rank":24991,"first_seen":"2020-02-14T10:57:20Z","last_seen":"2026-02-20T12:02:00.836966Z","alert_count":0,"request_count":2,"received_data":1022,"sent_data":1351,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"e7cod.com","ip":{"addr":"139.45.197.233","port":443,"asn":9002,"as":"RETN Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2021-09-07","domain_rank":0,"first_seen":"2025-12-09T19:09:56.779126Z","last_seen":"2026-02-20T11:14:31.130907Z","alert_count":3,"request_count":3,"received_data":122181,"sent_data":2295,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"my.rtmark.net","ip":{"addr":"104.18.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-10-29","domain_rank":43911,"first_seen":"2015-02-04T09:54:57Z","last_seen":"2026-02-18T15:09:10.496678Z","alert_count":0,"request_count":1,"received_data":832,"sent_data":465,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"goyabu.io","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-11-29","domain_rank":0,"first_seen":"2025-12-11T01:54:36.748181Z","last_seen":"2026-02-20T12:02:00.934651Z","alert_count":13,"request_count":13,"received_data":810378,"sent_data":6310,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"WordPress:6.3.7","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Yoast SEO:22.0","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"WP Rocket","description":"WP Rocket is a caching and performance optimisation plugin to improve the loading speed of WordPress websites.","website":"https://wp-rocket.me","common_platform_enumeration":"","icon":"WP Rocket.png","categories":["Caching","WordPress plugins"]}]},{"fqdn":"exchange.buzzoola.com","ip":{"addr":"45.138.161.82","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"domain_registered":"2010-08-11","domain_rank":80108,"first_seen":"2014-10-17T15:20:27Z","last_seen":"2026-02-20T10:13:47.666936Z","alert_count":0,"request_count":2,"received_data":850,"sent_data":1219,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"dm-eu.hybrid.ai","ip":{"addr":"37.230.131.16","port":443,"asn":200197,"as":"Hybrid Adtech Sp.z.o.o.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2017-12-19","domain_rank":74067,"first_seen":"2021-01-25T11:48:59Z","last_seen":"2026-02-16T11:46:14.527228Z","alert_count":0,"request_count":2,"received_data":800,"sent_data":1036,"comment":"","tags":null,"fingerprints":null},{"fqdn":"static.21wiz.com","ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-02-13","domain_rank":660425,"first_seen":"2024-04-08T16:13:16Z","last_seen":"2026-02-20T12:01:59.511316Z","alert_count":0,"request_count":3,"received_data":349297,"sent_data":1310,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cpscvonbgxn.com","ip":{"addr":"139.45.197.101","port":443,"asn":9002,"as":"RETN Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-02-21","domain_rank":0,"first_seen":"2026-02-22T09:36:20.353088Z","last_seen":"2026-02-22T09:36:20.353088Z","alert_count":0,"request_count":2,"received_data":1223,"sent_data":943,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"s.uuidksinc.net","ip":{"addr":"31.220.27.155","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2015-05-05","domain_rank":47808,"first_seen":"2015-07-20T12:00:35Z","last_seen":"2026-02-20T12:02:00.456783Z","alert_count":0,"request_count":2,"received_data":1016,"sent_data":994,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.23.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"ad-eu-bid.veonadx.com","ip":{"addr":"88.211.224.220","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"domain_registered":"2023-08-28","domain_rank":741110,"first_seen":"2025-06-05T05:41:25.333395Z","last_seen":"2026-02-20T12:02:00.608122Z","alert_count":0,"request_count":3,"received_data":911,"sent_data":1549,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.27.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"172.217.19.232","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-02-15T22:20:44.607116Z","alert_count":0,"request_count":1,"received_data":455546,"sent_data":430,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cc.cloudad.icu","ip":{"addr":"193.200.65.5","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"domain_registered":"2023-04-21","domain_rank":2800943,"first_seen":"2023-04-24T13:11:26Z","last_seen":"2026-02-20T12:01:59.583068Z","alert_count":0,"request_count":1,"received_data":416,"sent_data":488,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"code.moviead55.ru","ip":{"addr":"87.242.110.166","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"domain_registered":"2017-02-15","domain_rank":423163,"first_seen":"2017-02-18T04:38:39Z","last_seen":"2026-02-15T16:30:26.087708Z","alert_count":0,"request_count":1,"received_data":721,"sent_data":426,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ce71388c2d441cfb9ef0985bc4e5bb71","sha1":"1e74c490ed76f671eb45ab0b45c9c9f5b9b89f0f","sha256":"efb5a648656ae8f944fbf74e5644126464160ab50197a288c8b587e74edd575a","sha512":"8ccd39ea8643980590cf71014ceee6bb774de11bc87aa162d3b1e48b0f6c392399186fabf147e0cbe9990950cf75e5517d78a357b01e6afbdb00472909db3a1d","ssdeep":"","tlshash":"89f0bef14158513f2ae2190a5412b2a63d7300baf3067080d46d9c605274ba9862afaa","size":476,"data":"","first_seen":"2023-03-07T01:02:50Z","last_seen":"2026-04-04T22:48:50.036918Z","times_seen":33660,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"18ef6e7a663c8d60a01f02892493c303","sha1":"b972a2b9731b444d44017bdfbee79bdd75df7fbf","sha256":"19eeaad2365940c3ae25cbf752504685a010bc6b83240e3f5643a050fe43d65d","sha512":"4050d8e382cc36bf57e13de972dcb3f52654f2fd4e36210340d0ccdcbcb2f99261bfe5193f01d2012eee8c1eb1e8af49529f0e1e9af45f50bc89f29f6fabb291","ssdeep":"96:pbCf4hHM7cFagGESBAxxmOrG0CrwoGAmxmOrG0PLurxoFRAEvi:pueHJL8AxmOrGLrw7xmOrGaLAxYRA2i","tlshash":"9da16341162a4e7b59f76d5b5acf7241223f80f289498883c910df19a2f0e0fdb77d9a","size":4630,"data":"","first_seen":"2026-02-22T09:36:24.942784Z","last_seen":"2026-02-22T09:36:24.942784Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"44d090b147bfe8f124a90f88cd8a6386","sha1":"d54ff49ab243cc87f3668dfcf0bdd0944c09bea9","sha256":"44a2c5fe54a4ad990f260f0f48d4e46ed30274fbc8b81a1a7b7170356b44e13c","sha512":"ac17ef498325fc2d14106cd1eacecc1e7bec942cef76f5bd2c4dadc6f471f03829c23b15511ea34a1fa33b516a670b0cd2f581b15aba3599f67da66eef42fc0c","ssdeep":"","tlshash":"4fa022cfa202080802202a203ea230c03802000b80220000ba0cb80a0f00b830008b80","size":71,"data":"","first_seen":"2023-07-28T23:45:35Z","last_seen":"2026-04-04T12:24:21.483767Z","times_seen":493,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5210e0b80aa929c6f55dd49f99bae0c8","sha1":"fe0e715c230bfe7079de3124eaa5b1c3eaf2d4b2","sha256":"00bd608a083105a0ec3181e439f2975c911aae30c6c2a8e476a10ea9b49bae98","sha512":"318f848aaba781efed4b47a5f70d70345903bc7324c09fce0d1a5a3fe7c5547ab67b7b0352e25d391e8c28e509729fbcab050029abde9f87fb663c50d7ee0c2c","ssdeep":"384:DBoZg/90FRKMrfkaF9kps3cWevSBJXYxP/UiSBm8lHwSbM2nCB:h/9ZMrd9vcxSBJIxP/UiSB/lHwSbM2CB","tlshash":"c962b97d333655b12aa282aa9329a351733111ff7603842c793cece3550deda3939e79","size":14554,"data":"","first_seen":"2026-02-12T11:37:25.408871Z","last_seen":"2026-04-04T22:48:50.040148Z","times_seen":1601,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1e1676af090031fc32ff7779a958607a","sha1":"cc34d5ec752ad7771d11bfbf3467adcfee490723","sha256":"d11727d96924596c42e9496a3dc26b2d029090d896bfd7482ebb0f06ad11b575","sha512":"e07675cc73d93bd6dd31c10cf61765b4e694d9b7ed08b1727373341b7c9f6ec02f4b7bece66ccf7b6beae98167cb79298c8f1679eafb44d67f9d6063e6318f76","ssdeep":"","tlshash":"7141bc594ae3006665bf211d579e32003573c4f36a04e9b0bb0c5f48efe402f96b8ec8","size":2142,"data":"","first_seen":"2026-02-22T09:36:24.945082Z","last_seen":"2026-02-22T09:36:24.945082Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#341","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ec09f1a885d8c17028dcbf31d8f9c1c","sha1":"68e3f711d62d94295bc3db29f0bbaa5cfc4b624e","sha256":"98e7fa5bc825d548474d0ad3402166e508f61ef3f9e93a6c98e237ce10faaf1d","sha512":"4202831cb7546e3062dd3f9b22ad99313f54b5db19d1b1d3e8b78c7be187ebf025af5052e10cd00a29685911fbfee52c444673f41569d8fba8a177608017a62d","ssdeep":"","tlshash":"ce9002a421489ad29211ab05492e1a24647187d5d4c000e751156e1431009078b800d4","size":53,"data":"","first_seen":"2024-11-20T14:19:46.639129Z","last_seen":"2026-04-04T12:24:21.482667Z","times_seen":328,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4a4d4f31fe26bf828a4dfca68e4f9ab8","sha1":"da4c0ce1edb43f9191d7941b6cf0befe6153e5f3","sha256":"46c5809541b041b015defd6effb0242cbfb9fc931f7b9c4c7ffbbcb933d18526","sha512":"b978530e8e6314e6bab950c7b9e76753fcc37c9a4d893da7166af5be418c4389053a0164d8084babda46136404dd05f335128d07e1234919b313080439af3bdf","ssdeep":"","tlshash":"1c41fd6a99af143964b240ae8bdf7201343240139c04fa20fe4c76582f9d31fa671bda","size":2373,"data":"","first_seen":"2026-02-22T09:36:24.946412Z","last_seen":"2026-02-22T09:36:24.946412Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#234","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ec09f1a885d8c17028dcbf31d8f9c1c","sha1":"68e3f711d62d94295bc3db29f0bbaa5cfc4b624e","sha256":"98e7fa5bc825d548474d0ad3402166e508f61ef3f9e93a6c98e237ce10faaf1d","sha512":"4202831cb7546e3062dd3f9b22ad99313f54b5db19d1b1d3e8b78c7be187ebf025af5052e10cd00a29685911fbfee52c444673f41569d8fba8a177608017a62d","ssdeep":"","tlshash":"ce9002a421489ad29211ab05492e1a24647187d5d4c000e751156e1431009078b800d4","size":53,"data":"","first_seen":"2024-11-20T14:19:46.639129Z","last_seen":"2026-04-04T12:24:21.482667Z","times_seen":328,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5e398e3ce6b4b5871cf708d1bfe3e32c","sha1":"48eb56ab6ad4f7e7993bb57ac8f521275881bef1","sha256":"7a8a6cd61a9528bfa4542dfd60eada4200f58938997fcb6a4d6d1cadc4b52f12","sha512":"adf6e9322102ba43c76fce16e501affcf3ad1e515e3c8f3e639dd21887927c17b43f9162b4c63d581954fea5572c34957dd6c7abe1da158e7433bd27e8b572e7","ssdeep":"384:FTlKWDZF01RVP0Tl+Lk/X+ojdC76ssbiQLFPnN:FTlK+ZKHVPOl+LuuojdS6bJPnN","tlshash":"167293f98a873ed51d7ee1027b76492c1312749b462a8adb721d3e8c770d4ad3404ebb","size":17557,"data":"","first_seen":"2025-04-08T00:49:11.610292Z","last_seen":"2026-04-04T12:24:21.488387Z","times_seen":222,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pl.21wiz.com/frndnp.php?ver=1\u0026autoplay=1\u0026v=e379f03305e679091e67a2347ff53d50\u0026cb=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026fclose=false\u0026jh=cpzse3jqgeazq4m4f3ts65e\u0026sth=qp4gn7djcczdrcmzpf7nha5xpw\u0026sub_id=ap\u0026fmt_id=1\u0026testad=no\u0026nomon=1\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026cdiv=51\u0026frnd=true\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026country=NO\u0026spy=yes\u0026tls=no\u0026instant=yes","fqdn":"pl.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f858826d75b4e747b71af05aefb26a55","sha1":"99e801852ccaa97672d7d1b9c0449d31f0854ceb","sha256":"f93dacd3a25509555448f1dcbc2400c58710f59faea26bda4b6f407fc89553b9","sha512":"c954aabaf7e93877cf9b13081f735058dde5a91a727827dc2f64deac522a56572f4be9cdc5d568c4ab9da9c48e5a47618efe8dd75175fc7824b0dacc57b0d538","ssdeep":"768:/AIhabkIdyhAsZuNzTXSRVMwyFDx2TkKTpvuWB9k4OB3Fh6gnXJ:/AZqhuNoVMnFFmrVvuWB9k4a1h6YXJ","tlshash":"d7f25db96c8f3d599f290406c5ec08dd15ac2b4cb4e6628bd717c2fd978a96060c6cfe","size":36131,"data":"","first_seen":"2026-02-22T09:36:24.947845Z","last_seen":"2026-02-22T09:36:24.947845Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/protect_trackmaster.js?v1771433036440","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb4fae25998d53cf247b07034fa9c060","sha1":"5667781f9c9b65932d4df75c420127bdd63a3870","sha256":"665fd700bf527b2a91c111c99d724fb35110c41ea3bff499fe5f2d144f60a8ce","sha512":"4f31a911f0f45f443ffd292da517053881eb2fcb825198a4a5ef8fbc6f685c1c16710df9bf074ad286ac466518c162254c278b324b1b757263618ebf38e1c603","ssdeep":"","tlshash":"0c11afdce8d0f371573051d8d8129508f0ad966650e2a6d0a25d8db2421bd854df2a59","size":871,"data":"","first_seen":"2025-07-17T11:51:43.334496Z","last_seen":"2026-04-04T17:11:20.470319Z","times_seen":186,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/bmap?v=e379f03305e679091e67a2347ff53d50\u0026sub_id=ap\u0026fmt_id=4\u0026pl_key=banner\u0026testad=no\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026tanc=\u0026ancs=\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026frnd=yes\u0026rel=true\u0026rnd=1771752966784\u0026cnt=1","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"3a86014a2087c7fedad56a56944a261a","sha1":"78bce555aec4df9fc312a84105494733a6f3e955","sha256":"7a234d1b6102510325bc6a41ccacef75c865cdae2aa7176f3713cee2a2e1381d","sha512":"2f63cd3a22a3e2f5fa354d3485a5fe1c4d1c1e4c94a54471cec16e9c2142f752e94e6a309a9650e92f60470d51731182345ece9961b41d4db4d0a394ffd83fd1","ssdeep":"1536:I1tIbWgT/QeIjcuYdfCTbsn9uf03632whpoGRbBdQJA8fH2Ab4:4SbWYW3owB4U","tlshash":"967319c91290f2b568a951f7b93b71e9d3247876210d159ef0089e70b6ec67ffb2c428","size":76486,"data":"","first_seen":"2026-02-22T09:36:24.932681Z","last_seen":"2026-02-22T09:36:24.932681Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/pbjs/prebid.js?v1736246449447","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"6bf2da0e4e169f0debd73d1a232d8e74","sha1":"902bc0aa12a9da02a06d98dafd2f38ea5e49d634","sha256":"62adef81de5a6eb83ad2b5f2aa26c06a328eb7a11546c47ccc045d8d92b4dcf1","sha512":"5870d51719e3c940a2ff2a985dc02447b29c4caf4fd8591e2eacb7e08987d94a61fadc9c13cdb401ce3945f1f818c4dbbbfd513716b27111198b483f157a3e6f","ssdeep":"","tlshash":"761110a665fe25270bdb1c4dd40f137ef648621139dd8251c01ca2fe94a7ca3c3e6985","size":1000,"data":"","first_seen":"2026-02-14T22:40:41.028779Z","last_seen":"2026-02-22T09:36:24.94909Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"39cf9a137f63b6dac8358abf31b05b58","sha1":"7f77a515baa158b7f9f6598a0f7e86772b71e1f6","sha256":"3319d80ebeed1278ff372ca3f6764f9fb0669f0b04dc6c12b2d4600d281ba89c","sha512":"ee0cc6bff88b1a23efea73d227b328dfc63fc64109eab0d065b5e61f650b57aa4229f51cb686661c4ead492878e5f586e5892bec11ab9a1f89c0de10614b6d81","ssdeep":"","tlshash":"4a9002542594204d88361194256729481060007013048984a012ec74887a8250a1555c","size":46,"data":"","first_seen":"2025-12-11T01:54:40.496704Z","last_seen":"2026-02-22T09:36:24.949933Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"21wiz.com/s.js?v=e379f03305e679091e67a2347ff53d50","fqdn":"21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ab39ffeed8028aea9efb03a894b768cc","sha1":"2ed0d3d41411827f50d292d9a79d93313d645d62","sha256":"4d8904b5807d24fe1b294eb70c433c299f683ac79b3402cea0642e2ef3a4a1d1","sha512":"2fedfb7c73d66f978080339bfbc4c907a6151779be9e6fe6b0c2d38aa6a801b078ac231903d7d0656dfe6e94191c4d48dc91373a796402d36bf31926897911ca","ssdeep":"96:56bCf4hHM7EwF+/KvTpGgqCvTpGWDHWcZ72RnyQPJ:4ueH+3GGGWDHWc92RyQh","tlshash":"2891a56e5f2e0d52ab77a08b0c8fc44db76f907915f500e3f540f1ab679aa62168261c","size":4235,"data":"","first_seen":"2026-02-22T09:36:24.925481Z","last_seen":"2026-02-22T09:36:24.925481Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/protect_trackmaster.js?v1771433036440","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb4fae25998d53cf247b07034fa9c060","sha1":"5667781f9c9b65932d4df75c420127bdd63a3870","sha256":"665fd700bf527b2a91c111c99d724fb35110c41ea3bff499fe5f2d144f60a8ce","sha512":"4f31a911f0f45f443ffd292da517053881eb2fcb825198a4a5ef8fbc6f685c1c16710df9bf074ad286ac466518c162254c278b324b1b757263618ebf38e1c603","ssdeep":"","tlshash":"0c11afdce8d0f371573051d8d8129508f0ad966650e2a6d0a25d8db2421bd854df2a59","size":871,"data":"","first_seen":"2025-07-17T11:51:43.334496Z","last_seen":"2026-04-04T17:11:20.470319Z","times_seen":186,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"948872e3788e4936512e1b6a4c4ee04f","sha1":"da1b1cca50562096ab2cad14419217b6ed19a452","sha256":"254d358297afbffd34a0cb61a43de74d6bdd3c4bdd159637956f4a9b9b67930c","sha512":"d4cbc300745908761d8ebe5224428074ae08df7f05f19dc50791d76591184c418a204087bda8c03c8d7e47b29e6c4de0fa67eb1d0b20b4bbc27ae50d0608bb8d","ssdeep":"","tlshash":"08110092c4a32061f54942b51fcbf4a86ab02133f749e18832bcc2055f9dc89d3d359d","size":1000,"data":"","first_seen":"2026-02-14T22:40:20.221556Z","last_seen":"2026-02-22T09:36:24.950408Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4ebb1b864f1046a0569f86996a613dc7","sha1":"5c2413074f9f9d33594963de5a5d903daf5213cd","sha256":"f93356271e115a44b2e8c8ec672ffdb7bd2b33ad4000cf037d668707755cbdcd","sha512":"7f0841f789a4557e3a68ac86954d86fdbcebc477dfac07136816b9e37020bc0c23bc9135ab09060fb99d86fb85fb4aa1a4d764dbe305e8d8d851d6d3975c8946","ssdeep":"384:+v0a/K7iYFRdYte20Qen9tO69aI8tAUeNDaUGRQ2t4PpBahqoo+KXnS7YhfGMOIf:+K72epQ80GaIoQPzahq/AMOY","tlshash":"5ac2e5a7321eb91a8719626150ef2ec5a2cc48c4718f1b7ce724e53634d753485ebef8","size":28004,"data":"","first_seen":"2025-03-01T05:30:37.859653Z","last_seen":"2026-04-04T12:24:21.491353Z","times_seen":45,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"e7cod.com/5/8033056","fqdn":"e7cod.com","domain":"e7cod.com","tld":"com"},"ip":{"addr":"139.45.197.233","port":443,"asn":9002,"as":"RETN Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"a32f43f29762dc28dd011c5e6012e68a","sha1":"00f4403ac8a9b9ea0da79893a7741c603b3f3af2","sha256":"392cb36bc7e19d13ed3124d35f69e512f43bac62b5322e240fe70b83a92575bb","sha512":"5380b9fcc201926ab1fefb57e8fed01670648f1e8611b379c7f2799d662ccfd614ab2af910a1d75f0c726da2a00132f9d18bb434259d4d70c322532962929d0a","ssdeep":"1536:XLBJ4Znp4eTSNrC675V6mYZP2rH9kZrYx4ODiUakktqha5qLwutBiJgq1oB44a83:VJuvWH75V0/ZrYx4ODMZUgUbi5E5f3","tlshash":"1bc32b6073d1781652bfb12c0c2ac52d655a4ed0084d8afbd2e9a876e4a531cc3bbff5","size":119331,"data":"","first_seen":"2026-02-22T09:36:24.940703Z","last_seen":"2026-02-22T09:36:24.940703Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/bn?key=e379f03305e679091e67a2347ff53d50\u0026cp.adsource=adg_cr_1\u0026vt=100\u0026w=300\u0026h=250\u0026pw=480\u0026ph=305\u0026cp.referer=https%3A%2F%2Fgoyabu.io%2F40488\u0026fid=ff7d391a779056277\u0026cp.tanc=\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"0221d18399847ee2ca57558827edc435","sha1":"114efcc0db4edfb44ccbbf84b29e1c8b20c869e5","sha256":"f2370fcbd478eedd866d64f39853eae7b5998afd9d109971b1ff16a50b916d9d","sha512":"781003e600ec8c6bfc97c6c3c9e4361d48be00b675e59d2375dfb8f1a298da14c63207adc62d0a7b07598801ca6116930ceb0d25efdcd2721290e77d6879981f","ssdeep":"384:wu8WuDhNdUCRYYMZEaOzxDrz+uMUwTqk9DwK1D1TwqipZE19mpKVn1iqYlc:18WuxJRMEaOSQwJVAIVnClc","tlshash":"dea2d466ce4f2c5987a086472bde2ad54c0c1bcda8d218cd964be3cdd28f63614c8dde","size":22060,"data":"","first_seen":"2026-02-22T09:36:24.951387Z","last_seen":"2026-02-22T09:36:24.951387Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eventHandler","is_inline":false,"md5":"64e2a283ddd7bc57d974132cb01debe0","sha1":"1ce046d19167ed8daadf25133cdbbe24bcbb314a","sha256":"89339fc2ce7dc267b9b030a1e039654548d2312207461f2a80ffb4019dda4320","sha512":"6f312c3461353188717a50f742b286647f516ae28cc2fda5a1dac8d934a5b9523c72b9350443c0a5934286a367e85fd7bbafde86a06040e92c72764ac00eb85e","ssdeep":"","tlshash":"4370002aa2000000008200a32000c020222a82ce02f022880a2002b282008882022030","size":23,"data":"","first_seen":"2023-10-25T07:56:47Z","last_seen":"2026-03-28T01:20:12.977905Z","times_seen":39,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/mstream2.js?ver=13196771243","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ba9ba11d0cb003dc53a4e043c157e90","sha1":"688a5b883b559bcd08866d401b1df12031d33c50","sha256":"83d83355f53f328ec023335d6606fb30c14c17ba114599e82ad5f694247978f6","sha512":"41747365aa4911c53c219a9156dc94f504b1a2f712a4b227e619a38f25dd3d740ba51770618aa49a5af1c004a4f07e1b7cf2e75366b656259285c61486ee4131","ssdeep":"3072:isttTVisVPmLoIOzB/PhCC4Jd4FlQs02HNUjg5rq3ZrU5C:ime+Xl3puKlT0MUjprUE","tlshash":"e0f36b761ac264712ba0c2d950780250de3e5a0e708347bcbd6cced7a859953b1bebfc","size":172689,"data":"","first_seen":"2026-02-20T12:02:07.192459Z","last_seen":"2026-02-24T08:18:14.718648Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#435","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ec09f1a885d8c17028dcbf31d8f9c1c","sha1":"68e3f711d62d94295bc3db29f0bbaa5cfc4b624e","sha256":"98e7fa5bc825d548474d0ad3402166e508f61ef3f9e93a6c98e237ce10faaf1d","sha512":"4202831cb7546e3062dd3f9b22ad99313f54b5db19d1b1d3e8b78c7be187ebf025af5052e10cd00a29685911fbfee52c444673f41569d8fba8a177608017a62d","ssdeep":"","tlshash":"ce9002a421489ad29211ab05492e1a24647187d5d4c000e751156e1431009078b800d4","size":53,"data":"","first_seen":"2024-11-20T14:19:46.639129Z","last_seen":"2026-04-04T12:24:21.482667Z","times_seen":328,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"745c8f66033f619012b43d81528da634","sha1":"818c0543292d143622bf18e48dd16cd25848c158","sha256":"134967c11452cd04ef0932e59fd8bf493d405c1a933b4a073388bff5dccabad0","sha512":"3c711cf1d87228aa60f0f22152c43975c3eff65a7564a91a6d1d5cecffaa42ec4ee3098d6e6aaec41adfc914146c7f7f681dccb3016fa4468f6f6416dbba4ffc","ssdeep":"","tlshash":"d9f0d4d137890c51400452f5af20d937efce5c08541ac919e14cd5d5f40de50e08f535","size":465,"data":"","first_seen":"2025-12-11T01:54:40.486001Z","last_seen":"2026-04-04T12:24:21.496143Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;charset=utf-8;base64,ZnVuY3Rpb24gXzB4NjUyOShfMHgyZDk0NzMsXzB4NGZmOTYxKXtjb25zdCBfMHgxOTJhN2U9XzB4MmVjMCgpO3JldHVybiBfMHg2NTI5PWZ1bmN0aW9uKF8weDU2OGE5ZSxfMHgyNjgzNmQpe18weDU2OGE5ZT1fMHg1NjhhOWUtKDB4MzI3Ky0weDc1OCsweDcqMHhkZSk7bGV0IF8weGVmMDIxOT1fMHgxOTJhN2VbXzB4NTY4YTllXTtyZXR1cm4gXzB4ZWYwMjE5O30sXzB4NjUyOShfMHgyZDk0NzMsXzB4NGZmOTYxKTt9KGZ1bmN0aW9uKF8weDM1ZThiYSxfMHg0NjZiMGIpe2Z1bmN0aW9uIF8weDVhMjU3NihfMHgxNjgyNTksXzB4MWQ5NDllLF8weDJlZjZhOCxfMHg2NDlkOTgpe3JldHVybiBfMHg2NTI5KF8weDFkOTQ5ZS0weDNjOCxfMHgxNjgyNTkpO31mdW5jdGlvbiBfMHgyY2JmOGQoXzB4NDJjMzM2LF8weDNmOGU1MyxfMHg0MmM4OTMsXzB4Mjk4ODkyKXtyZXR1cm4gXzB4NjUyOShfMHg0MmM4OTMtIC0weDI2NSxfMHgzZjhlNTMpO31jb25zdCBfMHgxMzk5MGI9XzB4MzVlOGJhKCk7d2hpbGUoISFbXSl7dHJ5e2NvbnN0IF8weDM2YmJiZD0tcGFyc2VJbnQoXzB4MmNiZjhkKC0weDczLC0weDkxLC0weDc3LC0weDk1KSkvKC0weDE4ZDEqLTB4MSstMHg2MTEqMHgxKzB4MTJiZiotMHgxKSoocGFyc2VJbnQoXzB4NWEyNTc2KDB4NWM4LDB4NWJiLDB4NWI2LDB4NWNmKSkvKDB4MTcqLTB4OSsweDNmMSoweDErLTB4MzIwKSkrcGFyc2VJbnQoXzB4NWEyNTc2KDB4NWM2LDB4NWQ3LDB4NWU3LDB4NWRkKSkvKDB4MWUzOCstMHgyMmNhKzB4NDk1KStwYXJzZUludChfMHgyY2JmOGQoLTB4NjYsLTB4NGIsLTB4NjMsLTB4NWUpKS8oLTB4ZjArMHgxODVlKy0weDE0ZCoweDEyKSooLXBhcnNlSW50KF8weDVhMjU3NigweDVkYywweDVkMCwweDViMSwweDVlNCkpLygweDE0YiotMHgxNistMHgxOTU5KzB4YyoweDQ3YykpK3BhcnNlSW50KF8weDJjYmY4ZCgtMHg3NywtMHg4OCwtMHg2ZCwtMHg2NikpLygweDIqLTB4MTBlNCstMHgyMzM1KjB4MSsweDMqMHgxNzAxKSooLXBhcnNlSW50KF8weDVhMjU3NigweDVjYywweDVjZCwweDVjZSwweDViZSkpLygtMHgxKjB4ZmE5KzB4ODkqLTB4YisweDE1OTMpKStwYXJzZUludChfMHg1YTI1NzYoMHg1YTcsMHg1YmUsMHg1YmEsMHg1ZDMpKS8oMHgxOGIzKzB4OTQ5Ki0weDMrMHgzMzApKigtcGFyc2VJbnQoXzB4NWEyNTc2KDB4NWI5LDB4NWMxLDB4NTlmLDB4NWRiKSkvKC0weDdhNistMHgxNjkqMHg2KzB4MTAyNSkpKy1wYXJzZUludChfMHgyY2JmOGQoLTB4NGIsLTB4NmMsLTB4NTMsLTB4NWEpKS8oLTB4MSotMHg2MmIrMHg3MzUrMHgyKi0weDZhYikrLXBhcnNlSW50KF8weDJjYmY4ZCgtMHgzZiwtMHgzNSwtMHg0ZCwtMHg2OSkpLygtMHgxKi0weDEwZCstMHgxMmE3KzB4MTFhNSoweDEpKigtcGFyc2VJbnQoXzB4MmNiZjhkKC0weDRiLC0weDI3LC0weDQyLC0weDRjKSkvKDB4M2EqMHg4YistMHgxYWRhKjB4MSstMHg0OTgpKTtpZihfMHgzNmJiYmQ9PT1fMHg0NjZiMGIpYnJlYWs7ZWxzZSBfMHgxMzk5MGJbJ3B1c2gnXShfMHgxMzk5MGJbJ3NoaWZ0J10oKSk7fWNhdGNoKF8weDEwY2FjNSl7XzB4MTM5OTBiWydwdXNoJ10oXzB4MTM5OTBiWydzaGlmdCddKCkpO319fShfMHgyZWMwLC0weDIxYmIrLTB4MWFiMTUqMHgzKy0weDI2YTcqLTB4M2IpLCgoYXN5bmMoKT0+e2NvbnN0IF8weDIyOGVjNz17J0puZ1dOJzpmdW5jdGlvbihfMHg1NmI0NDMsXzB4ZmJiYjBiLF8weDRlZjg1Mil7cmV0dXJuIF8weDU2YjQ0MyhfMHhmYmJiMGIsXzB4NGVmODUyKTt9LCdyd1RrSSc6ZnVuY3Rpb24oXzB4NTdkNTE5LF8weDE0NzhmNil7cmV0dXJuIF8weDU3ZDUxOShfMHgxNDc4ZjYpO30sJ3BNT2xLJzpmdW5jdGlvbihfMHg0YmU2NjUsXzB4NTViOWZhKXtyZXR1cm4gXzB4NGJlNjY1PT09XzB4NTViOWZhO30sJ0dDS09HJzpfMHg1YmY1ZGIoMHg0MzAsMHg0MmYsMHg0NGYsMHg0NDMpLCdDY3lqRic6XzB4NGRmYTk3KDB4NGIzLDB4NGJlLDB4NGE5LDB4NGI4KSwna1daa1YnOidtc2wnLCdWVHFjaic6ZnVuY3Rpb24oXzB4NDVhYWVjLF8weDI1ZjczYSl7cmV0dXJuIF8weDQ1YWFlYz09PV8weDI1ZjczYTt9LCdheHZ6bSc6ZnVuY3Rpb24oXzB4MWQ0YzRiLF8weDExOGNjOSl7cmV0dXJuIF8weDFkNGM0Yj09PV8weDExOGNjOTt9LCdrREl3dic6XzB4NWJmNWRiKDB4NDQ2LDB4NDZjLDB4NDZhLDB4NDU2KSwnckdJSG0nOmZ1bmN0aW9uKF8weGI2NjUyLF8weDU3NTIwNSl7cmV0dXJuIF8weGI2NjUyPT09XzB4NTc1MjA1O30sJ3NiS3JUJzpmdW5jdGlvbihfMHg0ZDA4ZjksXzB4Mzg1NzMzKXtyZXR1cm4gXzB4NGQwOGY5IT09XzB4Mzg1NzMzO30sJ1B1UmZ1JzpfMHg1YmY1ZGIoMHg0MzQsMHg0NDksMHg0NGUsMHg0NDYpLCdoS2hBVSc6XzB4NGRmYTk3KDB4NGNlLDB4NGU3LDB4NGIxLDB4NGM2KSwnb1lCWFUnOmZ1bmN0aW9uKF8weDI2ODk1YyxfMHgyMDgzZjkpe3JldHVybiBfMHgyNjg5NWM9PV8weDIwODNmOTt9LCdvb05KRSc6ZnVuY3Rpb24oXzB4MmY5MGMwLF8weDIyM2E2OCl7cmV0dXJuIF8weDJmOTBjMCE9XzB4MjIzYTY4O30sJ2pvUnNlJzondW5kZWZpbmVkJywncExLUGMnOl8weDViZjVkYigweDQ2YiwweDQ5MywweDQ3MywweDQ3OCksJ09oS25iJzpmdW5jdGlvbihfMHg0ZDk3ZjIsXzB4NGJlNDZhKXtyZXR1cm4gXzB4NGQ5N2YyKF8weDRiZTQ2YSk7fSwnc09kTWQnOl8weDRkZmE5NygweDRkYiwweDRmOCwweDRjNywweDRlNSksJ3R4cFl2JzpmdW5jdGlvbihfMHgzYWQ3NDgsXzB4YmQ1MzBiKXtyZXR1cm4gXzB4M2FkNzQ4PT09XzB4YmQ1MzBiO30sJ25xemZJJzonT2hFZFEnLCd5T0l1Vic6ZnVuY3Rpb24oXzB4Mjc5YWQxLF8weDM5ZmQxOSxfMHg1YzYzMGQpe3JldHVybiBfMHgyNzlhZDEoXzB4MzlmZDE5LF8weDVjNjMwZCk7fSwnaVpTclEnOidnaEZNSycsJ09OeEdzJzpfMHg1YmY1ZGIoMHg0NjUsMHg0NjYsMHg0NWUsMHg0NzApLCdrTlhPeSc6ZnVuY3Rpb24oXzB4NmIxY2NiLF8weDM5NDMwZil7cmV0dXJuIF8weDZiMWNjYiE9PV8weDM5NDMwZjt9LCdScVFUQyc6J2xSU1ptJywnTHp6a2onOidWcnlWSScsJ1BsT1lwJzpmdW5jdGlvbihfMHgyMDUxMTApe3JldHVybiBfMHgyMDUxMTAoKTt9fTtpZihfMHgyMjhlYzdbXzB4NWJmNWRiKDB4NDM1LDB4NDQ0LDB4NDQwLDB4NDRhKV0odHlwZW9mIHdpbmRvd1tfMHg0ZGZhOTcoMHg0ZDUsMHg0ZjAsMHg0ZWEsMHg0Y2YpXSxfMHgyMjhlYzdbXzB4NGRmYTk3KDB4NTAxLDB4NGNmLDB4NGNlLDB4NGUyKV0pKXJldHVybjt3aW5kb3dbXzB4NWJmNWRiKDB4NDQzLDB4NDVjLDB4NDM5LDB4NDU4KV09ISFbXTtsZXQgXzB4NTU4MTE5LF8weDE4Y2U0NT0hW107ZnVuY3Rpb24gXzB4NWJmNWRiKF8weDMxZGRiOSxfMHhlODc4MWMsXzB4NTA5NGFjLF8weDhhMzM3Nyl7cmV0dXJuIF8weDY1MjkoXzB4OGEzMzc3LTB4MjViLF8weGU4NzgxYyk7fWZ1bmN0aW9uIF8weDRkZmE5NyhfMHgxYWNlYjIsXzB4MjZkYzAzLF8weDVhMDU0MixfMHgyOTg0YzUpe3JldHVybiBfMHg2NTI5KF8weDI5ODRjNS0weDJkMixfMHgxYWNlYjIpO31sZXQgXzB4NTBkMjNhPShfMHg0MGY0ZGEsXzB4Mjc2YjY1KT0+e18weDIyOGVjN1sncndUa0knXShjbGVhclRpbWVvdXQsXzB4NTU4MTE5KSx3aW5kb3dbJ2lzcCddPV8weDQwZjRkYTtpZih3aW5kb3dbXzB4MzM5OWNhKDB4MTgsLTB4MTYsMHhhLDB4ZSkrJ2dlJ10pe2lmKF8weDIyOGVjN1sncE1PbEsnXShfMHgyMjhlYzdbJ0dDS09HJ10sXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNjMsLTB4MTViLC0weDE1MiwtMHgxN2EpXSkpXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNzEsLTB4MTViLC0weDE4ZiwtMHgxNWUpXShfMHg1ZjRjZWMsMHg1MioweDRkKzB4MjI3ZSoweDErMHgzKi0weDEzYjgsXzB4M2UwY2UwKTtlbHNle2NvbnN0IF8weDM1MmZhOD1fMHgyMjhlYzdbXzB4YTgzMWUwKC0weDE0MiwtMHgxM2UsLTB4MTU1LC0weDE1NCldLF8weDE3YmQ5NT13aW5kb3dbXzB4MzM5OWNhKC0weGUsMHgxZSwweGEsMHgyMCkrJ2dlJ11bXzB4YTgzMWUwKC0weDE4MCwtMHgxOTgsLTB4MTc2LC0weDE4OSldKF8weDM1MmZhOCk7aWYoXzB4MTdiZDk1KXtpZihfMHgyMjhlYzdbXzB4MzM5OWNhKDB4NSwweDIsLTB4NCwweGYpXShfMHgxN2JkOTUsJzEnKSl7aWYoXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNDMsLTB4MTJlLC0weDE0ZiwtMHgxNTUpXShfMHgyMjhlYzdbXzB4MzM5OWNhKDB4NSwweDFiLDB4MCwtMHgxYildLF8weGE4MzFlMCgtMHgxNzcsLTB4MTcwLC0weDE2YiwtMHgxNWMpKSl0cnl7XzB4MzEyZWZkW18weGE4MzFlMCgtMHgxN2QsLTB4MTZiLC0weDE2ZCwtMHgxN2IpXVtfMHgzMzk5Y2EoMHgyOSwweDI3LDB4OCwweDFjKSsnZSddKF8weGE4MzFlMCgtMHgxNmQsLTB4MTRkLC0weDE1NywtMHgxNGUpLCcqJyk7fWNhdGNoKF8weDNiODI3OSl7fWVsc2Ugd2luZG93W18weDMzOTljYSgweDJlLDB4MWUsMHgxNywweDI4KV09MHg2NSoweDgrLTB4MTBmNyotMHgxKy0weDMyKjB4Njc7fX19fWZ1bmN0aW9uIF8weDMzOTljYShfMHgzNTExZTQsXzB4NTMxMGJiLF8weDQ1ZjRkYyxfMHgyM2NhN2Mpe3JldHVybiBfMHg0ZGZhOTcoXzB4MzUxMWU0LF8weDUzMTBiYi0weDQwLF8weDQ1ZjRkYy0weDFlZCxfMHg0NWY0ZGMtIC0weDRkNSk7fWlmKF8weDIyOGVjN1tfMHhhODMxZTAoLTB4MTdhLC0weDE5YiwtMHgxNWMsLTB4MTk2KV0oXzB4MThjZTQ1LDB4MWRmZistMHgzNjkqLTB4NistMHgzMjc1KSYmXzB4NDBmNGRhPT09MHg1OTgqLTB4NistMHgyYzUrMHgyNDU2KXtpZihfMHgyMjhlYzdbXzB4MzM5OWNhKDB4ZSwtMHg4LC0weDIsMHgzKV0oXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNTAsLTB4MTYyLC0weDE1ZCwtMHgxNmIpXSxfMHgyMjhlYzdbXzB4YTgzMWUwKC0weDE1MCwtMHgxNTAsLTB4MTY4LC0weDEzNSldKSlfMHg0OTRiYTQoXzB4ZTIxNjJhKTtlbHNlIHRyeXt3aW5kb3dbXzB4MzM5OWNhKC0weDE4LC0weGIsLTB4MWYsLTB4MTIpXVtfMHgzMzk5Y2EoMHhhLDB4MmEsMHg4LDB4MWEpKydlJ10oXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNDEsLTB4MTViLC0weDE1ZSwtMHgxNDUpXSwnKicpO31jYXRjaChfMHg0MDNkOTEpe319ZnVuY3Rpb24gXzB4YTgzMWUwKF8weDFhMThjYSxfMHhhNTVhOTcsXzB4NDZiODgwLF8weDI0MTM3OSl7cmV0dXJuIF8weDRkZmE5NyhfMHgyNDEzNzksXzB4YTU1YTk3LTB4MTBiLF8weDQ2Yjg4MC0weGVjLF8weDFhMThjYS0gLTB4NjMzKTt9XzB4MjI4ZWM3W18weDMzOTljYSgtMHg4LC0weDI4LC0weGMsMHg1KV0oXzB4MThjZTQ1LCFbXSkmJihfMHgxOGNlNDU9XzB4NDBmNGRhKSxfMHgyMjhlYzdbXzB4MzM5OWNhKC0weDFhLC0weDQsLTB4MTQsLTB4MzYpXSh0eXBlb2YgXzB4Mjc2YjY1LF8weDIyOGVjN1tfMHgzMzk5Y2EoMHgyYiwweDFlLDB4ZCwweDIwKV0pJiYoXzB4YTgzMWUwKC0weDE2ZiwtMHgxNjgsLTB4MTg4LC0weDE4OSkhPT1fMHgyMjhlYzdbXzB4MzM5OWNhKDB4MjcsMHgzMSwweDFlLDB4MWIpXT9fMHgyMjhlYzdbXzB4MzM5OWNhKDB4MTksLTB4MiwweDIxLDB4NDIpXShfMHgyNzZiNjUsXzB4NDBmNGRhKTpfMHgzYmNiNzU9XzB4NTY1MmVlKTt9LF8weGZjYTg0PWZ1bmN0aW9uKCl7Y29uc3QgXzB4NTM0NjkxPXsndERSVmonOl8weDIyOGVjN1tfMHgxMTFiNGUoLTB4MWM5LC0weDFjNiwtMHgxZTAsLTB4MWM4KV0sJ3JJVVFQJzpmdW5jdGlvbihfMHgzMTQ5NmMsXzB4MjY2OTg5KXtmdW5jdGlvbiBfMHgxNzU3MmMoXzB4MTVkMmU5LF8weDQ1ZDI5NyxfMHg0YTRmMTUsXzB4ZWFjMGQ0KXtyZXR1cm4gXzB4MTExYjRlKF8weDQ1ZDI5NyxfMHg0YTRmMTUtMHgyODcsXzB4NGE0ZjE1LTB4MmUsXzB4ZWFjMGQ0LTB4N2MpO31yZXR1cm4gXzB4MjI4ZWM3W18weDE3NTcyYygweGQ1LDB4ZTYsMHhlYywweGVmKV0oXzB4MzE0OTZjLF8weDI2Njk4OSk7fSwnR2NiZG0nOl8weDIyOGVjN1snbnF6ZkknXSwnYUFBbkknOidoaWpRaycsJ3NoYkF1JzpmdW5jdGlvbihfMHgxZGQyZDUsXzB4MTQ4ZDc4LF8weDU4MmYxNSl7ZnVuY3Rpb24gXzB4MTgwNjFjKF8weDUxNTdkNyxfMHgyODlhNTcsXzB4NTUxNjU5LF8weDI3MTFmMSl7cmV0dXJuIF8weDExMWI0ZShfMHg1MTU3ZDcsXzB4NTUxNjU5LSAtMHgzLF8weDU1MTY1OS0weDVmLF8weDI3MTFmMS0weGI5KTt9cmV0dXJuIF8weDIyOGVjN1tfMHgxODA2MWMoLTB4MWMyLC0weDFiMCwtMHgxYzUsLTB4MWJjKV0oXzB4MWRkMmQ1LF8weDE0OGQ3OCxfMHg1ODJmMTUpO30sJ0FUdXhPJzpmdW5jdGlvbihfMHg1YjkyMGUsXzB4NGZkOTkwLF8weDNhYWM2Myl7cmV0dXJuIF8weDIyOGVjN1sneU9JdVYnXShfMHg1YjkyMGUsXzB4NGZkOTkwLF8weDNhYWM2Myk7fSwnWlVkWGknOmZ1bmN0aW9uKF8weDg1MmRhMCxfMHgxOTE0OTQpe2Z1bmN0aW9uIF8weDI3ZTZkZChfMHgyMzgyMWMsXzB4NTFkMGY5LF8weDM1YTQ5MyxfMHgzNGYxODgpe3JldHVybiBfMHgxMTFiNGUoXzB4MzRmMTg4LF8weDIzODIxYy0weDM3YixfMHgzNWE0OTMtMHhlZixfMHgzNGYxODgtMHgxNzkpO31yZXR1cm4gXzB4MjI4ZWM3W18weDI3ZTZkZCgweDFiMywweDE5YywweDFhZSwweDE5NCldKF8weDg1MmRhMCxfMHgxOTE0OTQpO30sJ3ZmTENoJzpfMHgyMjhlYzdbXzB4MmMyYmQxKC0weDExMSwtMHgxMTEsLTB4ZjIsLTB4ZmMpXSwnTGtucU8nOmZ1bmN0aW9uKF8weDFjOWE5ZixfMHgyZTdmYjcpe3JldHVybiBfMHgxYzlhOWY9PT1fMHgyZTdmYjc7fSwnbGxrUUwnOl8weDIyOGVjN1tfMHgxMTFiNGUoLTB4MThjLC0weDFhNSwtMHgxYWIsLTB4MTg2KV0sJ0phVXNjJzpmdW5jdGlvbihfMHgzN2Y1YmQsXzB4MTI3OGI3LF8weDQyYjllNil7cmV0dXJuIF8weDM3ZjViZChfMHgxMjc4YjcsXzB4NDJiOWU2KTt9LCdicmVtVic6XzB4MmMyYmQxKC0weDExZSwtMHgxMTcsLTB4ZWMsLTB4MTBlKX07ZnVuY3Rpb24gXzB4MTExYjRlKF8weDNmYTZiYSxfMHg0ZDkzM2MsXzB4M2NkNGJhLF8weDg4ZDQ2Myl7cmV0dXJuIF8weDRkZmE5NyhfMHgzZmE2YmEsXzB4NGQ5MzNjLTB4MWEsXzB4M2NkNGJhLTB4MTNkLF8weDRkOTMzYy0gLTB4NjgxKTt9ZnVuY3Rpb24gXzB4MmMyYmQxKF8weDMyZDNjOSxfMHhkNzMwOGIsXzB4MzExODY4LF8weDQwYjQ4MCl7cmV0dXJuIF8weDViZjVkYihfMHgzMmQzYzktMHg2NixfMHgzMTE4NjgsXzB4MzExODY4LTB4YzEsXzB4NDBiNDgwLSAtMHg1NzApO31pZihfMHgyMjhlYzdbXzB4MTExYjRlKC0weDE5NCwtMHgxYTYsLTB4MTkzLC0weDFhNSldKF8weDIyOGVjN1snUnFRVEMnXSxfMHgyMjhlYzdbXzB4MmMyYmQxKC0weGZhLC0weGYxLC0weDExMiwtMHhmZildKSlyZXR1cm4gbmV3IFByb21pc2UoKF8weDI1ZTY0OCxfMHg1NWFkYTkpPT57Y29uc3QgXzB4MWUwOTRhPXsnempCSVEnOmZ1bmN0aW9uKF8weDE3NTNlOCxfMHg1MDk5ZDcpe3JldHVybiBfMHg1MzQ2OTFbJ1pVZFhpJ10oXzB4MTc1M2U4LF8weDUwOTlkNyk7fSwnd0pJRkonOl8weDUzNDY5MVsndmZMQ2gnXSwnSEVhQksnOl8weDNhOWZiZigweDFkMCwweDFjOSwweDFhOSwweDFiNCksJ3VGZFlRJzpmdW5jdGlvbihfMHgzMzg3NDAsXzB4NTU1ZmE2LF8weDNiYzgxZCl7ZnVuY3Rpb24gXzB4NGIxNjBkKF8weDFmZjY3ZCxfMHgzZWViZjEsXzB4NTA3MTFhLF8weDQwMGYzYyl7cmV0dXJuIF8weDNhOWZiZihfMHgxZmY2N2QtMHg2YyxfMHg1MDcxMWEtMHgxZDMsXzB4NTA3MTFhLTB4MmEsXzB4M2VlYmYxKTt9cmV0dXJuIF8weDUzNDY5MVtfMHg0YjE2MGQoMHgzYzAsMHgzZDgsMHgzYmIsMHgzYzgpXShfMHgzMzg3NDAsXzB4NTU1ZmE2LF8weDNiYzgxZCk7fX07ZnVuY3Rpb24gXzB4M2E5ZmJmKF8weDFlYzMyMCxfMHgyYzUwOGMsXzB4NDU0OTM4LF8weDM2YTBmOSl7cmV0dXJuIF8weDExMWI0ZShfMHgzNmEwZjksXzB4MmM1MDhjLTB4MzcyLF8weDQ1NDkzOC0weDEzMCxfMHgzNmEwZjktMHgxNTYpO31mdW5jdGlvbiBfMHgxMDNkZGQoXzB4M2VhMDc1LF8weDFkYTRlYyxfMHgzM2U0MjgsXzB4MzhhMWVhKXtyZXR1cm4gXzB4MmMyYmQxKF8weDNlYTA3NS0weDFhZixfMHgxZGE0ZWMtMHgyMSxfMHgzOGExZWEsXzB4M2VhMDc1LTB4NThjKTt9aWYoXzB4NTM0NjkxW18weDEwM2RkZCgweDQ3MywweDQ1NCwweDQ3OSwweDQ5MCldKF8weDUzNDY5MVsnbGxrUUwnXSxfMHg1MzQ2OTFbXzB4MTAzZGRkKDB4NDhlLDB4NDk3LDB4NDg5LDB4NDkxKV0pKXRyeXtjb25zb2xlW18weDEwM2RkZCgweDQ5MiwweDRiNSwweDRhMywweDQ3OSldKE9iamVjdFtfMHgxMDNkZGQoMHg0OTMsMHg0NzksMHg0NzgsMHg0ODQpK18weDEwM2RkZCgweDQ1YSwweDQ2OSwweDQ3NCwweDQ1NCldKG5ldyBFcnJvcigpLHsnbWVzc2FnZSc6eydnZXQnKCl7ZnVuY3Rpb24gXzB4NjQzNTg3KF8weDM5NzQ1OCxfMHgzNDg3NWQsXzB4NTRiMDU3LF8weDQ3ZjY4Nil7cmV0dXJuIF8weDEwM2RkZChfMHgzOTc0NTgtMHgxNDksXzB4MzQ4NzVkLTB4Y2YsXzB4NTRiMDU3LTB4MTRlLF8weDU0YjA1Nyk7fWZ1bmN0aW9uIF8weDNlNjM4NShfMHgzYzljYjgsXzB4MTQ1MWE2LF8weDU3ODgwMixfMHgxM2YwMjApe3JldHVybiBfMHgxMDNkZGQoXzB4MTQ1MWE2LSAtMHg2MjUsXzB4MTQ1MWE2LTB4MTljLF8weDU3ODgwMi0weDFkOSxfMHgxM2YwMjApO31pZihfMHgxZTA5NGFbXzB4M2U2Mzg1KC0weDFkZiwtMHgxY2MsLTB4MWQ1LC0weDFjOCldKF8weDFlMDk0YVsnd0pJRkonXSxfMHgxZTA5NGFbJ0hFYUJLJ10pKXJldHVybjtlbHNlIF8weDFlMDk0YVtfMHg2NDM1ODcoMHg1YTUsMHg1OTUsMHg1OGIsMHg1OTApXShfMHg1MGQyM2EsMHg4KjB4MTRlKzB4MioweDQxYisweDYzNyotMHgzLF8weDI1ZTY0OCk7fX0sJ3RvU3RyaW5nJzp7J3ZhbHVlJygpe2Z1bmN0aW9uIF8weDEwMDU1MChfMHg1NWYxOTMsXzB4NTkxOThjLF8weDI3YjMzZSxfMHgyNTk1ODUpe3JldHVybiBfMHgxMDNkZGQoXzB4MjdiMzNlLTB4NWIsXzB4NTkxOThjLTB4N2UsXzB4MjdiMzNlLTB4MTRmLF8weDU5MTk4Yyk7fWZ1bmN0aW9uIF8weDI1OWFhMihfMHgxOGNiOGMsXzB4MmEzMDczLF8weDU0NjkyMyxfMHgzOTg5NDIpe3JldHVybiBfMHgzYTlmYmYoXzB4MThjYjhjLTB4MTk5LF8weDU0NjkyMy0weDEyNixfMHg1NDY5MjMtMHhhMCxfMHgxOGNiOGMpO31uZXcgRXJyb3IoKVtfMHgxMDA1NTAoMHg0Y2MsMHg0Y2YsMHg0Y2MsMHg0ZWQpXVtfMHgyNTlhYTIoMHgyY2MsMHgyYzEsMHgyZGUsMHgyZTQpXShfMHg1MzQ2OTFbXzB4MTAwNTUwKDB4NGJjLDB4NGNhLDB4NGMzLDB4NGJmKV0pJiZfMHgyNWU2NDgoLTB4MTU3MisweDFhMzMrLTB4NGMwKTt9fX0pKSxfMHg1NTgxMTk9XzB4NTM0NjkxWydKYVVzYyddKHNldFRpbWVvdXQsXzB4MjM3MTAyPT57ZnVuY3Rpb24gXzB4MTRlOTc5KF8weDIxYmRhNixfMHhiMGU0ZjMsXzB4NTBiNWQsXzB4MTE2ZDdiKXtyZXR1cm4gXzB4M2E5ZmJmKF8weDIxYmRhNi0weDI2LF8weDUwYjVkLSAtMHgxOTcsXzB4NTBiNWQtMHgyYyxfMHgyMWJkYTYpO31mdW5jdGlvbiBfMHg1YjMyY2IoXzB4NTg0OTBmLF8weDNjYzQ4MSxfMHgzMGMwYzcsXzB4MTFjZDUwKXtyZXR1cm4gXzB4M2E5ZmJmKF8weDU4NDkwZi0weDE0NCxfMHgxMWNkNTAtIC0weDE5MixfMHgzMGMwYzctMHg1ZSxfMHgzY2M0ODEpO31jb25zdCBfMHgyMjM3OTY9eydDc3lMZyc6XzB4NWIzMmNiKDB4M2IsMHgzYiwweDQzLDB4NDQpLCdNZlhPUSc6ZnVuY3Rpb24oXzB4NTg5MWFhLF8weDIzN2ViOSl7cmV0dXJuIF8weDU4OTFhYShfMHgyMzdlYjkpO30sJ2pzTGRsJzpmdW5jdGlvbihfMHgxOTQyOTksXzB4NTg4YzBhLF8weDdkMTcxNSl7cmV0dXJuIF8weDE5NDI5OShfMHg1ODhjMGEsXzB4N2QxNzE1KTt9fTtpZihfMHg1MzQ2OTFbXzB4MTRlOTc5KDB4NDUsMHg0NiwweDJjLDB4MjApXShfMHg1MzQ2OTFbXzB4NWIzMmNiKDB4NDksMHg1YSwweDRiLDB4NTMpXSxfMHg1MzQ2OTFbXzB4NWIzMmNiKDB4MTcsMHgzNSwweDI2LDB4MWQpXSkpe2NvbnN0IF8weDU0ZjllNT17J1hCd0lHJzpmdW5jdGlvbihfMHg0ODQ2NWEsXzB4NTk5ZTA3LF8weDMxZjAyYyl7cmV0dXJuIF8weDQ4NDY1YShfMHg1OTllMDcsXzB4MzFmMDJjKTt9fTtfMHg1ZWU5ZjdbJ2xvZyddKF8weDNlMDAzY1tfMHg1YjMyY2IoMHg0MywweDMyLDB4NDYsMHg0ZCkrXzB4MTRlOTc5KC0weDUsMHhiLDB4ZiwweDEyKV0obmV3IF8weDUxYTcwNCgpLHsnbWVzc2FnZSc6eydnZXQnKCl7XzB4NTRmOWU1WydYQndJRyddKF8weDNhYzJjOCwweDRmMiotMHg2Ky0weDk1NysweDFjNioweDE2LF8weDU2MjExNCk7fX0sJ3RvU3RyaW5nJzp7J3ZhbHVlJygpe2Z1bmN0aW9uIF8weDdjOGVhZShfMHg0NzQ2OTUsXzB4NDMxMWY1LF8weDQ3NTNmZSxfMHgxMTQ5OGUpe3JldHVybiBfMHg1YjMyY2IoXzB4NDc0Njk1LTB4Y2QsXzB4NDMxMWY1LF8weDQ3NTNmZS0weDhkLF8weDExNDk4ZS0weGQ2KTt9ZnVuY3Rpb24gXzB4MmZhZjEyKF8weDFmMmFmMCxfMHgxYzE3OTIsXzB4MWY4OGM1LF8weDQwZmQ0OCl7cmV0dXJuIF8weDE0ZTk3OShfMHg0MGZkNDgsXzB4MWMxNzkyLTB4MWUzLF8weDFjMTc5Mi0weDIwYixfMHg0MGZkNDgtMHgxMzApO31uZXcgXzB4NDZiYWQ2KClbXzB4N2M4ZWFlKDB4MTBmLDB4ZjQsMHgxMWEsMHgxMDEpXVtfMHgyZmFmMTIoMHgyMTYsMHgyMmMsMHgyNGIsMHgyMjEpXShfMHgyMjM3OTZbXzB4N2M4ZWFlKDB4MTJjLDB4MTEyLDB4MTJlLDB4MTEzKV0pJiZfMHgyMjM3OTZbJ01mWE9RJ10oXzB4NTdiOGMwLDB4MjQyYisweDFjZDYrLTB4NDEwMCk7fX19KSksXzB4MzU5MWE5PV8weDIyMzc5NltfMHg1YjMyY2IoMHgyYSwweDQxLDB4NGIsMHgzZildKF8weDVhYTBkMyxfMHg1NzYwNjY9PntmdW5jdGlvbiBfMHgxZDE2NWUoXzB4OTJmMGMwLF8weDQ4NWQzNixfMHg0NTY3ZTksXzB4MjIwNGQwKXtyZXR1cm4gXzB4MTRlOTc5KF8weDkyZjBjMCxfMHg0ODVkMzYtMHg3LF8weDIyMDRkMC0gLTB4MWQ4LF8weDIyMDRkMC0weDEwOCk7fV8weDIyMzc5NltfMHgxZDE2NWUoLTB4MTlkLC0weDE4MywtMHgxODEsLTB4MTllKV0oXzB4NTE1YjlhLC0weDEqLTB4MWVhOSsweDJkMSotMHg3Ky0weGFmMixfMHgxNTkyYjUpO30sMHg5KjB4MTErMHgyMjAwKy0weDIyMzUpO31lbHNlIF8weDUzNDY5MVsnc2hiQXUnXShfMHg1MGQyM2EsMHg4MyotMHg3Ky0weDgzKi0weDMzKy0weDVhMSoweDQsXzB4MjVlNjQ4KTt9LDB4MWNmZCsweDQ0MCstMHgyMGQ5KTt9Y2F0Y2goXzB4MzQxYWIwKXt9ZWxzZSBfMHg1MzQ2OTFbJ0FUdXhPJ10oXzB4ZDM1MDU3LDB4MzM5Ki0weDErLTB4MWUyMystMHhkKi0weDI5MSxfMHgyNDcwZDkpO30pO2Vsc2V7Y29uc3QgXzB4MzM1ZjY9XzB4NTM0NjkxWydicmVtViddLF8weDlkNTA1OT1fMHg1MzNhZThbJ2xvY2FsU3RvcmEnKydnZSddW18weDJjMmJkMSgtMHgxMWUsLTB4MTRmLC0weDExMiwtMHgxMzQpXShfMHgzMzVmNik7XzB4OWQ1MDU5JiYoXzB4NTM0NjkxW18weDExMWI0ZSgtMHgxY2QsLTB4MWIzLC0weDFjZSwtMHgxYTUpXShfMHg5ZDUwNTksJzEnKSYmKF8weDE1MTc5MVtfMHgxMTFiNGUoLTB4MWI1LC0weDE5NSwtMHgxOWEsLTB4MWE4KV09LTB4NTUxKjB4NSsweDcqMHgxNDkrMHgxMyoweGVkKSk7fX0sXzB4NThiNTY4PWF3YWl0IF8weDIyOGVjN1tfMHg1YmY1ZGIoMHg0NmQsMHg0NGYsMHg0NzAsMHg0NWYpXShfMHhmY2E4NCk7XzB4NTBkMjNhKF8weDU4YjU2OCk7fSkoKSkpO2Z1bmN0aW9uIF8weDJlYzAoKXtjb25zdCBfMHgxNGNkMWQ9Wyc0NTEwNjUweHJRRFROJywndG9TdHJpbmdAJywndHhwWXYnLCdSQ1JDdScsJ0x6emtqJywnbGxrUUwnLCcxMU9CWE5FTCcsJ2laU3JRJywnaXNwJywnbG9nJywnZGVmaW5lUHJvcCcsJ0lVSWlxJywnYXh2em0nLCdrV1prVicsJ2hLaEFVJywncExLUGMnLCdHY2JkbScsJzE2NzM4OTA4bkJOR2d2JywnT2hLbmInLCdBVHV4TycsJ2dldEl0ZW0nLCd6akJJUScsJ2VydGllcycsJ3BhcmVudCcsJ3VGZFlRJywnWVBNd3EnLCdyR0lIbScsJ1NTUnZ6Jywnc09kTWQnLCdMcVFoTCcsJ3RGSnVsJywnYUFBbkknLCd5T0l1VicsJzY4MTgzZFdPZllmJywnb29OSkUnLCdKbmdXTicsJ3REUlZqJywnSkJxUEUnLCc2c3N5VVVGJywnbV9yZWxfZGVmJywnaW5jbHVkZXMnLCcxMTI3MnNRdlViQycsJ29ZQlhVJywnNjBPdHdHUlcnLCcyODE3a1NvaGV3Jywnc3RhY2snLCdrWE1KVCcsJ0xrbnFPJywnc2lzcCcsJ0NjeWpGJywnVlRxY2onLCdySVVRUCcsJ3NiS3JUJywnMTQ0a013VHNqJywna0RJd3YnLCdQbE9ZcCcsJzE0Nzg0N3NQZE5wSCcsJ0lvY2l2JywnbXNsJywnNDAwNjViT0ZETncnLCdrTlhPeScsJ09OeEdzJywncG9zdE1lc3NhZycsJ0NzeUxnJywnbG9jYWxTdG9yYScsJ2pzTGRsJywnMTM0NTcxM3VsU2VsaicsJ2pvUnNlJywnUHVSZnUnXTtfMHgyZWMwPWZ1bmN0aW9uKCl7cmV0dXJuIF8weDE0Y2QxZDt9O3JldHVybiBfMHgyZWMwKCk7fQ==","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"c7a1cbcfecc47174bdd8d4d837088e54","sha1":"4ade59ebed4f908f6b3a5160da04cd2b1930fbab","sha256":"b00de1873472763037b7189745193bbaf17294c71b954ed6eca28bfcb3dec980","sha512":"96d1bdb8e2bade6968e592e5cfbd44a31a50a2d0560228b25e1c058ce7e8a91efe8076f53871dd55455f90aa36a07c18182f5a90bfef945583efee98bdb68116","ssdeep":"384:j9OZ6pEJxeN7+Yb5sQSW2LYXRTxSTZn2TN+envZjXmz/TTnwyTLIS7MDnGm++dsj:j9OZ6pEJxeN7+Yb5sQSW2LoVSFn2IenU","tlshash":"cd42524577c1799222878bb6773b65d5e42b0cedb5c808dbf215fc84f87aa05eae0630","size":12400,"data":"","first_seen":"2025-04-08T00:49:11.630337Z","last_seen":"2026-04-04T12:24:21.490272Z","times_seen":430,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"a0b7aab9410f82a050dceb34a3f91b2b","sha1":"d5e7aa7e101036c46b9ee54a6f0733f28fea1c4b","sha256":"bb1d681845dd73a8bee8fcfb7a893c1cefe1f43017ece62f0fd6fc1193827d1a","sha512":"118296e86665a3a8cb9c4e8acab63c16b784c4863972d76e9db76a846cdf3a831ebf8f4bc782482ed8d484ce6fd81b040e2df4c5acb213b368cd5738e7f8fe61","ssdeep":"","tlshash":"609002541594604d8836119425672a581060007053048984a011ec74487a8240a5555c","size":46,"data":"","first_seen":"2025-12-11T01:54:40.497759Z","last_seen":"2026-02-22T09:36:24.953858Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#356","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ec09f1a885d8c17028dcbf31d8f9c1c","sha1":"68e3f711d62d94295bc3db29f0bbaa5cfc4b624e","sha256":"98e7fa5bc825d548474d0ad3402166e508f61ef3f9e93a6c98e237ce10faaf1d","sha512":"4202831cb7546e3062dd3f9b22ad99313f54b5db19d1b1d3e8b78c7be187ebf025af5052e10cd00a29685911fbfee52c444673f41569d8fba8a177608017a62d","ssdeep":"","tlshash":"ce9002a421489ad29211ab05492e1a24647187d5d4c000e751156e1431009078b800d4","size":53,"data":"","first_seen":"2024-11-20T14:19:46.639129Z","last_seen":"2026-04-04T12:24:21.482667Z","times_seen":328,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2293a8e496c82308b07e9563128965a4","sha1":"81dbe2cc9b7484eaec6f7a7ea4f50b60885ad812","sha256":"b3eb0057917ca7d2c77a7d4382e1071f003233b8d1575ac63f2ffc74f478b9c9","sha512":"0a211701323dba8f5ad6e07e03b82b0fce293e2a45062b23d083b000578813c80acae1216464d7eeb35775359934343e5a7997e319c26af2603112db82f3ba15","ssdeep":"","tlshash":"5841bb594af7442665bf201d579e32003573c4f36a04e9b0bb0c5f04afe412f96b8ec9","size":2248,"data":"","first_seen":"2026-02-22T09:36:24.954375Z","last_seen":"2026-02-22T09:36:24.954375Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/protect_trackmaster.js?v1771433036440","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb4fae25998d53cf247b07034fa9c060","sha1":"5667781f9c9b65932d4df75c420127bdd63a3870","sha256":"665fd700bf527b2a91c111c99d724fb35110c41ea3bff499fe5f2d144f60a8ce","sha512":"4f31a911f0f45f443ffd292da517053881eb2fcb825198a4a5ef8fbc6f685c1c16710df9bf074ad286ac466518c162254c278b324b1b757263618ebf38e1c603","ssdeep":"","tlshash":"0c11afdce8d0f371573051d8d8129508f0ad966650e2a6d0a25d8db2421bd854df2a59","size":871,"data":"","first_seen":"2025-07-17T11:51:43.334496Z","last_seen":"2026-04-04T17:11:20.470319Z","times_seen":186,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4074b9dbcb7335563f21f9cfe57f0497","sha1":"0132992a303f56dcde88513cf6ea156d20292073","sha256":"2b63b74fc061b1b85156963619a6d6ad8598bd885487f44b7e7f14c2d1395ab2","sha512":"e593e2cdb8a5a3af94ec4e248d22721105442e4ad921ddf4e5599a46a398c5f8fc548d912291d59bbb22bbf71a949761f283ce659aa5d9839ed2bb8834567564","ssdeep":"","tlshash":"901166ed0d6b50284c6360226b3ba2637b21702f6094cc56badccb11afa5aa7c815ac0","size":1108,"data":"","first_seen":"2026-02-20T12:02:07.238457Z","last_seen":"2026-02-22T09:36:24.955182Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;charset=utf-8;base64,ZnVuY3Rpb24gXzB4NjUyOShfMHgyZDk0NzMsXzB4NGZmOTYxKXtjb25zdCBfMHgxOTJhN2U9XzB4MmVjMCgpO3JldHVybiBfMHg2NTI5PWZ1bmN0aW9uKF8weDU2OGE5ZSxfMHgyNjgzNmQpe18weDU2OGE5ZT1fMHg1NjhhOWUtKDB4MzI3Ky0weDc1OCsweDcqMHhkZSk7bGV0IF8weGVmMDIxOT1fMHgxOTJhN2VbXzB4NTY4YTllXTtyZXR1cm4gXzB4ZWYwMjE5O30sXzB4NjUyOShfMHgyZDk0NzMsXzB4NGZmOTYxKTt9KGZ1bmN0aW9uKF8weDM1ZThiYSxfMHg0NjZiMGIpe2Z1bmN0aW9uIF8weDVhMjU3NihfMHgxNjgyNTksXzB4MWQ5NDllLF8weDJlZjZhOCxfMHg2NDlkOTgpe3JldHVybiBfMHg2NTI5KF8weDFkOTQ5ZS0weDNjOCxfMHgxNjgyNTkpO31mdW5jdGlvbiBfMHgyY2JmOGQoXzB4NDJjMzM2LF8weDNmOGU1MyxfMHg0MmM4OTMsXzB4Mjk4ODkyKXtyZXR1cm4gXzB4NjUyOShfMHg0MmM4OTMtIC0weDI2NSxfMHgzZjhlNTMpO31jb25zdCBfMHgxMzk5MGI9XzB4MzVlOGJhKCk7d2hpbGUoISFbXSl7dHJ5e2NvbnN0IF8weDM2YmJiZD0tcGFyc2VJbnQoXzB4MmNiZjhkKC0weDczLC0weDkxLC0weDc3LC0weDk1KSkvKC0weDE4ZDEqLTB4MSstMHg2MTEqMHgxKzB4MTJiZiotMHgxKSoocGFyc2VJbnQoXzB4NWEyNTc2KDB4NWM4LDB4NWJiLDB4NWI2LDB4NWNmKSkvKDB4MTcqLTB4OSsweDNmMSoweDErLTB4MzIwKSkrcGFyc2VJbnQoXzB4NWEyNTc2KDB4NWM2LDB4NWQ3LDB4NWU3LDB4NWRkKSkvKDB4MWUzOCstMHgyMmNhKzB4NDk1KStwYXJzZUludChfMHgyY2JmOGQoLTB4NjYsLTB4NGIsLTB4NjMsLTB4NWUpKS8oLTB4ZjArMHgxODVlKy0weDE0ZCoweDEyKSooLXBhcnNlSW50KF8weDVhMjU3NigweDVkYywweDVkMCwweDViMSwweDVlNCkpLygweDE0YiotMHgxNistMHgxOTU5KzB4YyoweDQ3YykpK3BhcnNlSW50KF8weDJjYmY4ZCgtMHg3NywtMHg4OCwtMHg2ZCwtMHg2NikpLygweDIqLTB4MTBlNCstMHgyMzM1KjB4MSsweDMqMHgxNzAxKSooLXBhcnNlSW50KF8weDVhMjU3NigweDVjYywweDVjZCwweDVjZSwweDViZSkpLygtMHgxKjB4ZmE5KzB4ODkqLTB4YisweDE1OTMpKStwYXJzZUludChfMHg1YTI1NzYoMHg1YTcsMHg1YmUsMHg1YmEsMHg1ZDMpKS8oMHgxOGIzKzB4OTQ5Ki0weDMrMHgzMzApKigtcGFyc2VJbnQoXzB4NWEyNTc2KDB4NWI5LDB4NWMxLDB4NTlmLDB4NWRiKSkvKC0weDdhNistMHgxNjkqMHg2KzB4MTAyNSkpKy1wYXJzZUludChfMHgyY2JmOGQoLTB4NGIsLTB4NmMsLTB4NTMsLTB4NWEpKS8oLTB4MSotMHg2MmIrMHg3MzUrMHgyKi0weDZhYikrLXBhcnNlSW50KF8weDJjYmY4ZCgtMHgzZiwtMHgzNSwtMHg0ZCwtMHg2OSkpLygtMHgxKi0weDEwZCstMHgxMmE3KzB4MTFhNSoweDEpKigtcGFyc2VJbnQoXzB4MmNiZjhkKC0weDRiLC0weDI3LC0weDQyLC0weDRjKSkvKDB4M2EqMHg4YistMHgxYWRhKjB4MSstMHg0OTgpKTtpZihfMHgzNmJiYmQ9PT1fMHg0NjZiMGIpYnJlYWs7ZWxzZSBfMHgxMzk5MGJbJ3B1c2gnXShfMHgxMzk5MGJbJ3NoaWZ0J10oKSk7fWNhdGNoKF8weDEwY2FjNSl7XzB4MTM5OTBiWydwdXNoJ10oXzB4MTM5OTBiWydzaGlmdCddKCkpO319fShfMHgyZWMwLC0weDIxYmIrLTB4MWFiMTUqMHgzKy0weDI2YTcqLTB4M2IpLCgoYXN5bmMoKT0+e2NvbnN0IF8weDIyOGVjNz17J0puZ1dOJzpmdW5jdGlvbihfMHg1NmI0NDMsXzB4ZmJiYjBiLF8weDRlZjg1Mil7cmV0dXJuIF8weDU2YjQ0MyhfMHhmYmJiMGIsXzB4NGVmODUyKTt9LCdyd1RrSSc6ZnVuY3Rpb24oXzB4NTdkNTE5LF8weDE0NzhmNil7cmV0dXJuIF8weDU3ZDUxOShfMHgxNDc4ZjYpO30sJ3BNT2xLJzpmdW5jdGlvbihfMHg0YmU2NjUsXzB4NTViOWZhKXtyZXR1cm4gXzB4NGJlNjY1PT09XzB4NTViOWZhO30sJ0dDS09HJzpfMHg1YmY1ZGIoMHg0MzAsMHg0MmYsMHg0NGYsMHg0NDMpLCdDY3lqRic6XzB4NGRmYTk3KDB4NGIzLDB4NGJlLDB4NGE5LDB4NGI4KSwna1daa1YnOidtc2wnLCdWVHFjaic6ZnVuY3Rpb24oXzB4NDVhYWVjLF8weDI1ZjczYSl7cmV0dXJuIF8weDQ1YWFlYz09PV8weDI1ZjczYTt9LCdheHZ6bSc6ZnVuY3Rpb24oXzB4MWQ0YzRiLF8weDExOGNjOSl7cmV0dXJuIF8weDFkNGM0Yj09PV8weDExOGNjOTt9LCdrREl3dic6XzB4NWJmNWRiKDB4NDQ2LDB4NDZjLDB4NDZhLDB4NDU2KSwnckdJSG0nOmZ1bmN0aW9uKF8weGI2NjUyLF8weDU3NTIwNSl7cmV0dXJuIF8weGI2NjUyPT09XzB4NTc1MjA1O30sJ3NiS3JUJzpmdW5jdGlvbihfMHg0ZDA4ZjksXzB4Mzg1NzMzKXtyZXR1cm4gXzB4NGQwOGY5IT09XzB4Mzg1NzMzO30sJ1B1UmZ1JzpfMHg1YmY1ZGIoMHg0MzQsMHg0NDksMHg0NGUsMHg0NDYpLCdoS2hBVSc6XzB4NGRmYTk3KDB4NGNlLDB4NGU3LDB4NGIxLDB4NGM2KSwnb1lCWFUnOmZ1bmN0aW9uKF8weDI2ODk1YyxfMHgyMDgzZjkpe3JldHVybiBfMHgyNjg5NWM9PV8weDIwODNmOTt9LCdvb05KRSc6ZnVuY3Rpb24oXzB4MmY5MGMwLF8weDIyM2E2OCl7cmV0dXJuIF8weDJmOTBjMCE9XzB4MjIzYTY4O30sJ2pvUnNlJzondW5kZWZpbmVkJywncExLUGMnOl8weDViZjVkYigweDQ2YiwweDQ5MywweDQ3MywweDQ3OCksJ09oS25iJzpmdW5jdGlvbihfMHg0ZDk3ZjIsXzB4NGJlNDZhKXtyZXR1cm4gXzB4NGQ5N2YyKF8weDRiZTQ2YSk7fSwnc09kTWQnOl8weDRkZmE5NygweDRkYiwweDRmOCwweDRjNywweDRlNSksJ3R4cFl2JzpmdW5jdGlvbihfMHgzYWQ3NDgsXzB4YmQ1MzBiKXtyZXR1cm4gXzB4M2FkNzQ4PT09XzB4YmQ1MzBiO30sJ25xemZJJzonT2hFZFEnLCd5T0l1Vic6ZnVuY3Rpb24oXzB4Mjc5YWQxLF8weDM5ZmQxOSxfMHg1YzYzMGQpe3JldHVybiBfMHgyNzlhZDEoXzB4MzlmZDE5LF8weDVjNjMwZCk7fSwnaVpTclEnOidnaEZNSycsJ09OeEdzJzpfMHg1YmY1ZGIoMHg0NjUsMHg0NjYsMHg0NWUsMHg0NzApLCdrTlhPeSc6ZnVuY3Rpb24oXzB4NmIxY2NiLF8weDM5NDMwZil7cmV0dXJuIF8weDZiMWNjYiE9PV8weDM5NDMwZjt9LCdScVFUQyc6J2xSU1ptJywnTHp6a2onOidWcnlWSScsJ1BsT1lwJzpmdW5jdGlvbihfMHgyMDUxMTApe3JldHVybiBfMHgyMDUxMTAoKTt9fTtpZihfMHgyMjhlYzdbXzB4NWJmNWRiKDB4NDM1LDB4NDQ0LDB4NDQwLDB4NDRhKV0odHlwZW9mIHdpbmRvd1tfMHg0ZGZhOTcoMHg0ZDUsMHg0ZjAsMHg0ZWEsMHg0Y2YpXSxfMHgyMjhlYzdbXzB4NGRmYTk3KDB4NTAxLDB4NGNmLDB4NGNlLDB4NGUyKV0pKXJldHVybjt3aW5kb3dbXzB4NWJmNWRiKDB4NDQzLDB4NDVjLDB4NDM5LDB4NDU4KV09ISFbXTtsZXQgXzB4NTU4MTE5LF8weDE4Y2U0NT0hW107ZnVuY3Rpb24gXzB4NWJmNWRiKF8weDMxZGRiOSxfMHhlODc4MWMsXzB4NTA5NGFjLF8weDhhMzM3Nyl7cmV0dXJuIF8weDY1MjkoXzB4OGEzMzc3LTB4MjViLF8weGU4NzgxYyk7fWZ1bmN0aW9uIF8weDRkZmE5NyhfMHgxYWNlYjIsXzB4MjZkYzAzLF8weDVhMDU0MixfMHgyOTg0YzUpe3JldHVybiBfMHg2NTI5KF8weDI5ODRjNS0weDJkMixfMHgxYWNlYjIpO31sZXQgXzB4NTBkMjNhPShfMHg0MGY0ZGEsXzB4Mjc2YjY1KT0+e18weDIyOGVjN1sncndUa0knXShjbGVhclRpbWVvdXQsXzB4NTU4MTE5KSx3aW5kb3dbJ2lzcCddPV8weDQwZjRkYTtpZih3aW5kb3dbXzB4MzM5OWNhKDB4MTgsLTB4MTYsMHhhLDB4ZSkrJ2dlJ10pe2lmKF8weDIyOGVjN1sncE1PbEsnXShfMHgyMjhlYzdbJ0dDS09HJ10sXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNjMsLTB4MTViLC0weDE1MiwtMHgxN2EpXSkpXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNzEsLTB4MTViLC0weDE4ZiwtMHgxNWUpXShfMHg1ZjRjZWMsMHg1MioweDRkKzB4MjI3ZSoweDErMHgzKi0weDEzYjgsXzB4M2UwY2UwKTtlbHNle2NvbnN0IF8weDM1MmZhOD1fMHgyMjhlYzdbXzB4YTgzMWUwKC0weDE0MiwtMHgxM2UsLTB4MTU1LC0weDE1NCldLF8weDE3YmQ5NT13aW5kb3dbXzB4MzM5OWNhKC0weGUsMHgxZSwweGEsMHgyMCkrJ2dlJ11bXzB4YTgzMWUwKC0weDE4MCwtMHgxOTgsLTB4MTc2LC0weDE4OSldKF8weDM1MmZhOCk7aWYoXzB4MTdiZDk1KXtpZihfMHgyMjhlYzdbXzB4MzM5OWNhKDB4NSwweDIsLTB4NCwweGYpXShfMHgxN2JkOTUsJzEnKSl7aWYoXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNDMsLTB4MTJlLC0weDE0ZiwtMHgxNTUpXShfMHgyMjhlYzdbXzB4MzM5OWNhKDB4NSwweDFiLDB4MCwtMHgxYildLF8weGE4MzFlMCgtMHgxNzcsLTB4MTcwLC0weDE2YiwtMHgxNWMpKSl0cnl7XzB4MzEyZWZkW18weGE4MzFlMCgtMHgxN2QsLTB4MTZiLC0weDE2ZCwtMHgxN2IpXVtfMHgzMzk5Y2EoMHgyOSwweDI3LDB4OCwweDFjKSsnZSddKF8weGE4MzFlMCgtMHgxNmQsLTB4MTRkLC0weDE1NywtMHgxNGUpLCcqJyk7fWNhdGNoKF8weDNiODI3OSl7fWVsc2Ugd2luZG93W18weDMzOTljYSgweDJlLDB4MWUsMHgxNywweDI4KV09MHg2NSoweDgrLTB4MTBmNyotMHgxKy0weDMyKjB4Njc7fX19fWZ1bmN0aW9uIF8weDMzOTljYShfMHgzNTExZTQsXzB4NTMxMGJiLF8weDQ1ZjRkYyxfMHgyM2NhN2Mpe3JldHVybiBfMHg0ZGZhOTcoXzB4MzUxMWU0LF8weDUzMTBiYi0weDQwLF8weDQ1ZjRkYy0weDFlZCxfMHg0NWY0ZGMtIC0weDRkNSk7fWlmKF8weDIyOGVjN1tfMHhhODMxZTAoLTB4MTdhLC0weDE5YiwtMHgxNWMsLTB4MTk2KV0oXzB4MThjZTQ1LDB4MWRmZistMHgzNjkqLTB4NistMHgzMjc1KSYmXzB4NDBmNGRhPT09MHg1OTgqLTB4NistMHgyYzUrMHgyNDU2KXtpZihfMHgyMjhlYzdbXzB4MzM5OWNhKDB4ZSwtMHg4LC0weDIsMHgzKV0oXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNTAsLTB4MTYyLC0weDE1ZCwtMHgxNmIpXSxfMHgyMjhlYzdbXzB4YTgzMWUwKC0weDE1MCwtMHgxNTAsLTB4MTY4LC0weDEzNSldKSlfMHg0OTRiYTQoXzB4ZTIxNjJhKTtlbHNlIHRyeXt3aW5kb3dbXzB4MzM5OWNhKC0weDE4LC0weGIsLTB4MWYsLTB4MTIpXVtfMHgzMzk5Y2EoMHhhLDB4MmEsMHg4LDB4MWEpKydlJ10oXzB4MjI4ZWM3W18weGE4MzFlMCgtMHgxNDEsLTB4MTViLC0weDE1ZSwtMHgxNDUpXSwnKicpO31jYXRjaChfMHg0MDNkOTEpe319ZnVuY3Rpb24gXzB4YTgzMWUwKF8weDFhMThjYSxfMHhhNTVhOTcsXzB4NDZiODgwLF8weDI0MTM3OSl7cmV0dXJuIF8weDRkZmE5NyhfMHgyNDEzNzksXzB4YTU1YTk3LTB4MTBiLF8weDQ2Yjg4MC0weGVjLF8weDFhMThjYS0gLTB4NjMzKTt9XzB4MjI4ZWM3W18weDMzOTljYSgtMHg4LC0weDI4LC0weGMsMHg1KV0oXzB4MThjZTQ1LCFbXSkmJihfMHgxOGNlNDU9XzB4NDBmNGRhKSxfMHgyMjhlYzdbXzB4MzM5OWNhKC0weDFhLC0weDQsLTB4MTQsLTB4MzYpXSh0eXBlb2YgXzB4Mjc2YjY1LF8weDIyOGVjN1tfMHgzMzk5Y2EoMHgyYiwweDFlLDB4ZCwweDIwKV0pJiYoXzB4YTgzMWUwKC0weDE2ZiwtMHgxNjgsLTB4MTg4LC0weDE4OSkhPT1fMHgyMjhlYzdbXzB4MzM5OWNhKDB4MjcsMHgzMSwweDFlLDB4MWIpXT9fMHgyMjhlYzdbXzB4MzM5OWNhKDB4MTksLTB4MiwweDIxLDB4NDIpXShfMHgyNzZiNjUsXzB4NDBmNGRhKTpfMHgzYmNiNzU9XzB4NTY1MmVlKTt9LF8weGZjYTg0PWZ1bmN0aW9uKCl7Y29uc3QgXzB4NTM0NjkxPXsndERSVmonOl8weDIyOGVjN1tfMHgxMTFiNGUoLTB4MWM5LC0weDFjNiwtMHgxZTAsLTB4MWM4KV0sJ3JJVVFQJzpmdW5jdGlvbihfMHgzMTQ5NmMsXzB4MjY2OTg5KXtmdW5jdGlvbiBfMHgxNzU3MmMoXzB4MTVkMmU5LF8weDQ1ZDI5NyxfMHg0YTRmMTUsXzB4ZWFjMGQ0KXtyZXR1cm4gXzB4MTExYjRlKF8weDQ1ZDI5NyxfMHg0YTRmMTUtMHgyODcsXzB4NGE0ZjE1LTB4MmUsXzB4ZWFjMGQ0LTB4N2MpO31yZXR1cm4gXzB4MjI4ZWM3W18weDE3NTcyYygweGQ1LDB4ZTYsMHhlYywweGVmKV0oXzB4MzE0OTZjLF8weDI2Njk4OSk7fSwnR2NiZG0nOl8weDIyOGVjN1snbnF6ZkknXSwnYUFBbkknOidoaWpRaycsJ3NoYkF1JzpmdW5jdGlvbihfMHgxZGQyZDUsXzB4MTQ4ZDc4LF8weDU4MmYxNSl7ZnVuY3Rpb24gXzB4MTgwNjFjKF8weDUxNTdkNyxfMHgyODlhNTcsXzB4NTUxNjU5LF8weDI3MTFmMSl7cmV0dXJuIF8weDExMWI0ZShfMHg1MTU3ZDcsXzB4NTUxNjU5LSAtMHgzLF8weDU1MTY1OS0weDVmLF8weDI3MTFmMS0weGI5KTt9cmV0dXJuIF8weDIyOGVjN1tfMHgxODA2MWMoLTB4MWMyLC0weDFiMCwtMHgxYzUsLTB4MWJjKV0oXzB4MWRkMmQ1LF8weDE0OGQ3OCxfMHg1ODJmMTUpO30sJ0FUdXhPJzpmdW5jdGlvbihfMHg1YjkyMGUsXzB4NGZkOTkwLF8weDNhYWM2Myl7cmV0dXJuIF8weDIyOGVjN1sneU9JdVYnXShfMHg1YjkyMGUsXzB4NGZkOTkwLF8weDNhYWM2Myk7fSwnWlVkWGknOmZ1bmN0aW9uKF8weDg1MmRhMCxfMHgxOTE0OTQpe2Z1bmN0aW9uIF8weDI3ZTZkZChfMHgyMzgyMWMsXzB4NTFkMGY5LF8weDM1YTQ5MyxfMHgzNGYxODgpe3JldHVybiBfMHgxMTFiNGUoXzB4MzRmMTg4LF8weDIzODIxYy0weDM3YixfMHgzNWE0OTMtMHhlZixfMHgzNGYxODgtMHgxNzkpO31yZXR1cm4gXzB4MjI4ZWM3W18weDI3ZTZkZCgweDFiMywweDE5YywweDFhZSwweDE5NCldKF8weDg1MmRhMCxfMHgxOTE0OTQpO30sJ3ZmTENoJzpfMHgyMjhlYzdbXzB4MmMyYmQxKC0weDExMSwtMHgxMTEsLTB4ZjIsLTB4ZmMpXSwnTGtucU8nOmZ1bmN0aW9uKF8weDFjOWE5ZixfMHgyZTdmYjcpe3JldHVybiBfMHgxYzlhOWY9PT1fMHgyZTdmYjc7fSwnbGxrUUwnOl8weDIyOGVjN1tfMHgxMTFiNGUoLTB4MThjLC0weDFhNSwtMHgxYWIsLTB4MTg2KV0sJ0phVXNjJzpmdW5jdGlvbihfMHgzN2Y1YmQsXzB4MTI3OGI3LF8weDQyYjllNil7cmV0dXJuIF8weDM3ZjViZChfMHgxMjc4YjcsXzB4NDJiOWU2KTt9LCdicmVtVic6XzB4MmMyYmQxKC0weDExZSwtMHgxMTcsLTB4ZWMsLTB4MTBlKX07ZnVuY3Rpb24gXzB4MTExYjRlKF8weDNmYTZiYSxfMHg0ZDkzM2MsXzB4M2NkNGJhLF8weDg4ZDQ2Myl7cmV0dXJuIF8weDRkZmE5NyhfMHgzZmE2YmEsXzB4NGQ5MzNjLTB4MWEsXzB4M2NkNGJhLTB4MTNkLF8weDRkOTMzYy0gLTB4NjgxKTt9ZnVuY3Rpb24gXzB4MmMyYmQxKF8weDMyZDNjOSxfMHhkNzMwOGIsXzB4MzExODY4LF8weDQwYjQ4MCl7cmV0dXJuIF8weDViZjVkYihfMHgzMmQzYzktMHg2NixfMHgzMTE4NjgsXzB4MzExODY4LTB4YzEsXzB4NDBiNDgwLSAtMHg1NzApO31pZihfMHgyMjhlYzdbXzB4MTExYjRlKC0weDE5NCwtMHgxYTYsLTB4MTkzLC0weDFhNSldKF8weDIyOGVjN1snUnFRVEMnXSxfMHgyMjhlYzdbXzB4MmMyYmQxKC0weGZhLC0weGYxLC0weDExMiwtMHhmZildKSlyZXR1cm4gbmV3IFByb21pc2UoKF8weDI1ZTY0OCxfMHg1NWFkYTkpPT57Y29uc3QgXzB4MWUwOTRhPXsnempCSVEnOmZ1bmN0aW9uKF8weDE3NTNlOCxfMHg1MDk5ZDcpe3JldHVybiBfMHg1MzQ2OTFbJ1pVZFhpJ10oXzB4MTc1M2U4LF8weDUwOTlkNyk7fSwnd0pJRkonOl8weDUzNDY5MVsndmZMQ2gnXSwnSEVhQksnOl8weDNhOWZiZigweDFkMCwweDFjOSwweDFhOSwweDFiNCksJ3VGZFlRJzpmdW5jdGlvbihfMHgzMzg3NDAsXzB4NTU1ZmE2LF8weDNiYzgxZCl7ZnVuY3Rpb24gXzB4NGIxNjBkKF8weDFmZjY3ZCxfMHgzZWViZjEsXzB4NTA3MTFhLF8weDQwMGYzYyl7cmV0dXJuIF8weDNhOWZiZihfMHgxZmY2N2QtMHg2YyxfMHg1MDcxMWEtMHgxZDMsXzB4NTA3MTFhLTB4MmEsXzB4M2VlYmYxKTt9cmV0dXJuIF8weDUzNDY5MVtfMHg0YjE2MGQoMHgzYzAsMHgzZDgsMHgzYmIsMHgzYzgpXShfMHgzMzg3NDAsXzB4NTU1ZmE2LF8weDNiYzgxZCk7fX07ZnVuY3Rpb24gXzB4M2E5ZmJmKF8weDFlYzMyMCxfMHgyYzUwOGMsXzB4NDU0OTM4LF8weDM2YTBmOSl7cmV0dXJuIF8weDExMWI0ZShfMHgzNmEwZjksXzB4MmM1MDhjLTB4MzcyLF8weDQ1NDkzOC0weDEzMCxfMHgzNmEwZjktMHgxNTYpO31mdW5jdGlvbiBfMHgxMDNkZGQoXzB4M2VhMDc1LF8weDFkYTRlYyxfMHgzM2U0MjgsXzB4MzhhMWVhKXtyZXR1cm4gXzB4MmMyYmQxKF8weDNlYTA3NS0weDFhZixfMHgxZGE0ZWMtMHgyMSxfMHgzOGExZWEsXzB4M2VhMDc1LTB4NThjKTt9aWYoXzB4NTM0NjkxW18weDEwM2RkZCgweDQ3MywweDQ1NCwweDQ3OSwweDQ5MCldKF8weDUzNDY5MVsnbGxrUUwnXSxfMHg1MzQ2OTFbXzB4MTAzZGRkKDB4NDhlLDB4NDk3LDB4NDg5LDB4NDkxKV0pKXRyeXtjb25zb2xlW18weDEwM2RkZCgweDQ5MiwweDRiNSwweDRhMywweDQ3OSldKE9iamVjdFtfMHgxMDNkZGQoMHg0OTMsMHg0NzksMHg0NzgsMHg0ODQpK18weDEwM2RkZCgweDQ1YSwweDQ2OSwweDQ3NCwweDQ1NCldKG5ldyBFcnJvcigpLHsnbWVzc2FnZSc6eydnZXQnKCl7ZnVuY3Rpb24gXzB4NjQzNTg3KF8weDM5NzQ1OCxfMHgzNDg3NWQsXzB4NTRiMDU3LF8weDQ3ZjY4Nil7cmV0dXJuIF8weDEwM2RkZChfMHgzOTc0NTgtMHgxNDksXzB4MzQ4NzVkLTB4Y2YsXzB4NTRiMDU3LTB4MTRlLF8weDU0YjA1Nyk7fWZ1bmN0aW9uIF8weDNlNjM4NShfMHgzYzljYjgsXzB4MTQ1MWE2LF8weDU3ODgwMixfMHgxM2YwMjApe3JldHVybiBfMHgxMDNkZGQoXzB4MTQ1MWE2LSAtMHg2MjUsXzB4MTQ1MWE2LTB4MTljLF8weDU3ODgwMi0weDFkOSxfMHgxM2YwMjApO31pZihfMHgxZTA5NGFbXzB4M2U2Mzg1KC0weDFkZiwtMHgxY2MsLTB4MWQ1LC0weDFjOCldKF8weDFlMDk0YVsnd0pJRkonXSxfMHgxZTA5NGFbJ0hFYUJLJ10pKXJldHVybjtlbHNlIF8weDFlMDk0YVtfMHg2NDM1ODcoMHg1YTUsMHg1OTUsMHg1OGIsMHg1OTApXShfMHg1MGQyM2EsMHg4KjB4MTRlKzB4MioweDQxYisweDYzNyotMHgzLF8weDI1ZTY0OCk7fX0sJ3RvU3RyaW5nJzp7J3ZhbHVlJygpe2Z1bmN0aW9uIF8weDEwMDU1MChfMHg1NWYxOTMsXzB4NTkxOThjLF8weDI3YjMzZSxfMHgyNTk1ODUpe3JldHVybiBfMHgxMDNkZGQoXzB4MjdiMzNlLTB4NWIsXzB4NTkxOThjLTB4N2UsXzB4MjdiMzNlLTB4MTRmLF8weDU5MTk4Yyk7fWZ1bmN0aW9uIF8weDI1OWFhMihfMHgxOGNiOGMsXzB4MmEzMDczLF8weDU0NjkyMyxfMHgzOTg5NDIpe3JldHVybiBfMHgzYTlmYmYoXzB4MThjYjhjLTB4MTk5LF8weDU0NjkyMy0weDEyNixfMHg1NDY5MjMtMHhhMCxfMHgxOGNiOGMpO31uZXcgRXJyb3IoKVtfMHgxMDA1NTAoMHg0Y2MsMHg0Y2YsMHg0Y2MsMHg0ZWQpXVtfMHgyNTlhYTIoMHgyY2MsMHgyYzEsMHgyZGUsMHgyZTQpXShfMHg1MzQ2OTFbXzB4MTAwNTUwKDB4NGJjLDB4NGNhLDB4NGMzLDB4NGJmKV0pJiZfMHgyNWU2NDgoLTB4MTU3MisweDFhMzMrLTB4NGMwKTt9fX0pKSxfMHg1NTgxMTk9XzB4NTM0NjkxWydKYVVzYyddKHNldFRpbWVvdXQsXzB4MjM3MTAyPT57ZnVuY3Rpb24gXzB4MTRlOTc5KF8weDIxYmRhNixfMHhiMGU0ZjMsXzB4NTBiNWQsXzB4MTE2ZDdiKXtyZXR1cm4gXzB4M2E5ZmJmKF8weDIxYmRhNi0weDI2LF8weDUwYjVkLSAtMHgxOTcsXzB4NTBiNWQtMHgyYyxfMHgyMWJkYTYpO31mdW5jdGlvbiBfMHg1YjMyY2IoXzB4NTg0OTBmLF8weDNjYzQ4MSxfMHgzMGMwYzcsXzB4MTFjZDUwKXtyZXR1cm4gXzB4M2E5ZmJmKF8weDU4NDkwZi0weDE0NCxfMHgxMWNkNTAtIC0weDE5MixfMHgzMGMwYzctMHg1ZSxfMHgzY2M0ODEpO31jb25zdCBfMHgyMjM3OTY9eydDc3lMZyc6XzB4NWIzMmNiKDB4M2IsMHgzYiwweDQzLDB4NDQpLCdNZlhPUSc6ZnVuY3Rpb24oXzB4NTg5MWFhLF8weDIzN2ViOSl7cmV0dXJuIF8weDU4OTFhYShfMHgyMzdlYjkpO30sJ2pzTGRsJzpmdW5jdGlvbihfMHgxOTQyOTksXzB4NTg4YzBhLF8weDdkMTcxNSl7cmV0dXJuIF8weDE5NDI5OShfMHg1ODhjMGEsXzB4N2QxNzE1KTt9fTtpZihfMHg1MzQ2OTFbXzB4MTRlOTc5KDB4NDUsMHg0NiwweDJjLDB4MjApXShfMHg1MzQ2OTFbXzB4NWIzMmNiKDB4NDksMHg1YSwweDRiLDB4NTMpXSxfMHg1MzQ2OTFbXzB4NWIzMmNiKDB4MTcsMHgzNSwweDI2LDB4MWQpXSkpe2NvbnN0IF8weDU0ZjllNT17J1hCd0lHJzpmdW5jdGlvbihfMHg0ODQ2NWEsXzB4NTk5ZTA3LF8weDMxZjAyYyl7cmV0dXJuIF8weDQ4NDY1YShfMHg1OTllMDcsXzB4MzFmMDJjKTt9fTtfMHg1ZWU5ZjdbJ2xvZyddKF8weDNlMDAzY1tfMHg1YjMyY2IoMHg0MywweDMyLDB4NDYsMHg0ZCkrXzB4MTRlOTc5KC0weDUsMHhiLDB4ZiwweDEyKV0obmV3IF8weDUxYTcwNCgpLHsnbWVzc2FnZSc6eydnZXQnKCl7XzB4NTRmOWU1WydYQndJRyddKF8weDNhYzJjOCwweDRmMiotMHg2Ky0weDk1NysweDFjNioweDE2LF8weDU2MjExNCk7fX0sJ3RvU3RyaW5nJzp7J3ZhbHVlJygpe2Z1bmN0aW9uIF8weDdjOGVhZShfMHg0NzQ2OTUsXzB4NDMxMWY1LF8weDQ3NTNmZSxfMHgxMTQ5OGUpe3JldHVybiBfMHg1YjMyY2IoXzB4NDc0Njk1LTB4Y2QsXzB4NDMxMWY1LF8weDQ3NTNmZS0weDhkLF8weDExNDk4ZS0weGQ2KTt9ZnVuY3Rpb24gXzB4MmZhZjEyKF8weDFmMmFmMCxfMHgxYzE3OTIsXzB4MWY4OGM1LF8weDQwZmQ0OCl7cmV0dXJuIF8weDE0ZTk3OShfMHg0MGZkNDgsXzB4MWMxNzkyLTB4MWUzLF8weDFjMTc5Mi0weDIwYixfMHg0MGZkNDgtMHgxMzApO31uZXcgXzB4NDZiYWQ2KClbXzB4N2M4ZWFlKDB4MTBmLDB4ZjQsMHgxMWEsMHgxMDEpXVtfMHgyZmFmMTIoMHgyMTYsMHgyMmMsMHgyNGIsMHgyMjEpXShfMHgyMjM3OTZbXzB4N2M4ZWFlKDB4MTJjLDB4MTEyLDB4MTJlLDB4MTEzKV0pJiZfMHgyMjM3OTZbJ01mWE9RJ10oXzB4NTdiOGMwLDB4MjQyYisweDFjZDYrLTB4NDEwMCk7fX19KSksXzB4MzU5MWE5PV8weDIyMzc5NltfMHg1YjMyY2IoMHgyYSwweDQxLDB4NGIsMHgzZildKF8weDVhYTBkMyxfMHg1NzYwNjY9PntmdW5jdGlvbiBfMHgxZDE2NWUoXzB4OTJmMGMwLF8weDQ4NWQzNixfMHg0NTY3ZTksXzB4MjIwNGQwKXtyZXR1cm4gXzB4MTRlOTc5KF8weDkyZjBjMCxfMHg0ODVkMzYtMHg3LF8weDIyMDRkMC0gLTB4MWQ4LF8weDIyMDRkMC0weDEwOCk7fV8weDIyMzc5NltfMHgxZDE2NWUoLTB4MTlkLC0weDE4MywtMHgxODEsLTB4MTllKV0oXzB4NTE1YjlhLC0weDEqLTB4MWVhOSsweDJkMSotMHg3Ky0weGFmMixfMHgxNTkyYjUpO30sMHg5KjB4MTErMHgyMjAwKy0weDIyMzUpO31lbHNlIF8weDUzNDY5MVsnc2hiQXUnXShfMHg1MGQyM2EsMHg4MyotMHg3Ky0weDgzKi0weDMzKy0weDVhMSoweDQsXzB4MjVlNjQ4KTt9LDB4MWNmZCsweDQ0MCstMHgyMGQ5KTt9Y2F0Y2goXzB4MzQxYWIwKXt9ZWxzZSBfMHg1MzQ2OTFbJ0FUdXhPJ10oXzB4ZDM1MDU3LDB4MzM5Ki0weDErLTB4MWUyMystMHhkKi0weDI5MSxfMHgyNDcwZDkpO30pO2Vsc2V7Y29uc3QgXzB4MzM1ZjY9XzB4NTM0NjkxWydicmVtViddLF8weDlkNTA1OT1fMHg1MzNhZThbJ2xvY2FsU3RvcmEnKydnZSddW18weDJjMmJkMSgtMHgxMWUsLTB4MTRmLC0weDExMiwtMHgxMzQpXShfMHgzMzVmNik7XzB4OWQ1MDU5JiYoXzB4NTM0NjkxW18weDExMWI0ZSgtMHgxY2QsLTB4MWIzLC0weDFjZSwtMHgxYTUpXShfMHg5ZDUwNTksJzEnKSYmKF8weDE1MTc5MVtfMHgxMTFiNGUoLTB4MWI1LC0weDE5NSwtMHgxOWEsLTB4MWE4KV09LTB4NTUxKjB4NSsweDcqMHgxNDkrMHgxMyoweGVkKSk7fX0sXzB4NThiNTY4PWF3YWl0IF8weDIyOGVjN1tfMHg1YmY1ZGIoMHg0NmQsMHg0NGYsMHg0NzAsMHg0NWYpXShfMHhmY2E4NCk7XzB4NTBkMjNhKF8weDU4YjU2OCk7fSkoKSkpO2Z1bmN0aW9uIF8weDJlYzAoKXtjb25zdCBfMHgxNGNkMWQ9Wyc0NTEwNjUweHJRRFROJywndG9TdHJpbmdAJywndHhwWXYnLCdSQ1JDdScsJ0x6emtqJywnbGxrUUwnLCcxMU9CWE5FTCcsJ2laU3JRJywnaXNwJywnbG9nJywnZGVmaW5lUHJvcCcsJ0lVSWlxJywnYXh2em0nLCdrV1prVicsJ2hLaEFVJywncExLUGMnLCdHY2JkbScsJzE2NzM4OTA4bkJOR2d2JywnT2hLbmInLCdBVHV4TycsJ2dldEl0ZW0nLCd6akJJUScsJ2VydGllcycsJ3BhcmVudCcsJ3VGZFlRJywnWVBNd3EnLCdyR0lIbScsJ1NTUnZ6Jywnc09kTWQnLCdMcVFoTCcsJ3RGSnVsJywnYUFBbkknLCd5T0l1VicsJzY4MTgzZFdPZllmJywnb29OSkUnLCdKbmdXTicsJ3REUlZqJywnSkJxUEUnLCc2c3N5VVVGJywnbV9yZWxfZGVmJywnaW5jbHVkZXMnLCcxMTI3MnNRdlViQycsJ29ZQlhVJywnNjBPdHdHUlcnLCcyODE3a1NvaGV3Jywnc3RhY2snLCdrWE1KVCcsJ0xrbnFPJywnc2lzcCcsJ0NjeWpGJywnVlRxY2onLCdySVVRUCcsJ3NiS3JUJywnMTQ0a013VHNqJywna0RJd3YnLCdQbE9ZcCcsJzE0Nzg0N3NQZE5wSCcsJ0lvY2l2JywnbXNsJywnNDAwNjViT0ZETncnLCdrTlhPeScsJ09OeEdzJywncG9zdE1lc3NhZycsJ0NzeUxnJywnbG9jYWxTdG9yYScsJ2pzTGRsJywnMTM0NTcxM3VsU2VsaicsJ2pvUnNlJywnUHVSZnUnXTtfMHgyZWMwPWZ1bmN0aW9uKCl7cmV0dXJuIF8weDE0Y2QxZDt9O3JldHVybiBfMHgyZWMwKCk7fQ==","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"c7a1cbcfecc47174bdd8d4d837088e54","sha1":"4ade59ebed4f908f6b3a5160da04cd2b1930fbab","sha256":"b00de1873472763037b7189745193bbaf17294c71b954ed6eca28bfcb3dec980","sha512":"96d1bdb8e2bade6968e592e5cfbd44a31a50a2d0560228b25e1c058ce7e8a91efe8076f53871dd55455f90aa36a07c18182f5a90bfef945583efee98bdb68116","ssdeep":"384:j9OZ6pEJxeN7+Yb5sQSW2LYXRTxSTZn2TN+envZjXmz/TTnwyTLIS7MDnGm++dsj:j9OZ6pEJxeN7+Yb5sQSW2LoVSFn2IenU","tlshash":"cd42524577c1799222878bb6773b65d5e42b0cedb5c808dbf215fc84f87aa05eae0630","size":12400,"data":"","first_seen":"2025-04-08T00:49:11.630337Z","last_seen":"2026-04-04T12:24:21.490272Z","times_seen":430,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/protect_trackmaster.js?v1771433036440","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb4fae25998d53cf247b07034fa9c060","sha1":"5667781f9c9b65932d4df75c420127bdd63a3870","sha256":"665fd700bf527b2a91c111c99d724fb35110c41ea3bff499fe5f2d144f60a8ce","sha512":"4f31a911f0f45f443ffd292da517053881eb2fcb825198a4a5ef8fbc6f685c1c16710df9bf074ad286ac466518c162254c278b324b1b757263618ebf38e1c603","ssdeep":"","tlshash":"0c11afdce8d0f371573051d8d8129508f0ad966650e2a6d0a25d8db2421bd854df2a59","size":871,"data":"","first_seen":"2025-07-17T11:51:43.334496Z","last_seen":"2026-04-04T17:11:20.470319Z","times_seen":186,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/mstream2.js?ver=13196771243","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ba9ba11d0cb003dc53a4e043c157e90","sha1":"688a5b883b559bcd08866d401b1df12031d33c50","sha256":"83d83355f53f328ec023335d6606fb30c14c17ba114599e82ad5f694247978f6","sha512":"41747365aa4911c53c219a9156dc94f504b1a2f712a4b227e619a38f25dd3d740ba51770618aa49a5af1c004a4f07e1b7cf2e75366b656259285c61486ee4131","ssdeep":"3072:isttTVisVPmLoIOzB/PhCC4Jd4FlQs02HNUjg5rq3ZrU5C:ime+Xl3puKlT0MUjprUE","tlshash":"e0f36b761ac264712ba0c2d950780250de3e5a0e708347bcbd6cced7a859953b1bebfc","size":172689,"data":"","first_seen":"2026-02-20T12:02:07.192459Z","last_seen":"2026-02-24T08:18:14.718648Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"868c6a10860397dbdd4a6e0a425c63ca","sha1":"f1d055e981209eef259e9658a2f25cc8ea8d2668","sha256":"3f9798145982bd20ac38412e8d508976fd20deefe3c57d6f815549651265f04e","sha512":"63c94696f179ac10a345bce6e95fc1dbdeb95ce7724c01c071aa7398b476dfc0983422256def262161181374d370e66ed1ce4db0ddba76c1912b7a3fdf8de854","ssdeep":"","tlshash":"dad02376734c2d4d177803d8395479b755d6044b44847a3247afc0912f63c5830b8309","size":219,"data":"","first_seen":"2025-12-11T01:54:40.493069Z","last_seen":"2026-04-04T12:24:21.499443Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-HSWBMT9ZNB","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"172.217.19.232","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1f5145305846060fe17c81f5d1789169","sha1":"747b664716e90460f1fb43fdc0b676aca89b4638","sha256":"bb98d37de02059e87da09915577c26b3631a4839f91636ca1d76e65cfc82a677","sha512":"9a0c3b7fb03db42d3a89b6457d3b86762e90591c314fc6bae3803cf3a54d2cb015b73da3dcaa20f0a1a9143c6fbd4718d2b4709f64e2dbc25a06de76ad41103d","ssdeep":"6144:UCmO7CW6y273J5NYygLIR8Nyk7pNH08pddlmOrELkS5fenMcm0v:duW6y27dDEIR855VrEff3E","tlshash":"9fa41ace73d670269396f478503f018ba57b29a2b44dc89af189cce42d74a5a4237f7c","size":454942,"data":"","first_seen":"2026-02-22T09:36:24.935827Z","last_seen":"2026-02-22T09:36:24.935827Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"ebf1ab056da18aa163a5c636af212575","sha1":"e320441051bf090ced6a68534d5a5c2518ca865a","sha256":"8baae76104f5643cdabbd84f279aa689aebf47eff97e7d21220c1783a3cb16cc","sha512":"3450350c2a6d4f15953efa49d3aa5e369f785dd6a9ecfc06e5a18024a323fcbe0a6b8e76db489ce713dde3e27a56cb20fcee6183e1e722644770b90831b794e9","ssdeep":"192:Ikk88qRT3nwQT0UJh9jgq/sdq/s19DoMqxw/tTyi2qS6IKsYP4y5gJpvyi0oxCSr:4fQT0Uiq/4q/MDx2qpIKFp0","tlshash":"8662705e15f310366163b07e6b9b602836354163a309fd103f5ca345bfa892adaf5bdc","size":15787,"data":"","first_seen":"2026-02-22T09:36:24.956559Z","last_seen":"2026-02-22T09:36:24.956559Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/bmap?v=e379f03305e679091e67a2347ff53d50\u0026sub_id=ap\u0026fmt_id=4\u0026pl_key=banner\u0026testad=no\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026tanc=\u0026ancs=\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026frnd=yes","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"9c9bca58fc7ad8e466b27112de965172","sha1":"8a575fd266d7b4891ac214d32717cf8a7712f499","sha256":"962021afad718c8d1008b7ac83fde1e3ab61c6feb1497907b571c4a8a38ec27e","sha512":"8ce27db7db7868d5fc124f7745bcf81b10325eb89258fc347a13bb914ad8a3657ec1a677492efaf925cc5031694befd6d9fb0bce3b0af236f24372715d4f7759","ssdeep":"1536:I1tIbWgT/UuYzqQg5xiBH8/Vqf2S32whpoGRbBdQJA8fH2Ab4:4SbWn3owB4U","tlshash":"767319c91290f2b568a911f7b93b71e9d3247876600d159ef0089e70b6ed67ffb2c428","size":76486,"data":"","first_seen":"2026-02-22T09:36:24.92832Z","last_seen":"2026-02-22T09:36:24.92832Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ba655f53704b419df0c4f405c17a5202","sha1":"fc15f64c62be03d3a63bffb51c70ab6d6d54172d","sha256":"58ea91fd6ba01a66e03e08331bb95a9eecc68ca8e6da77998afb14eed09c9465","sha512":"4d30991ac3e056bbc774699f3866dfbd8253fcd889ed39d31f533d12c835c31f38e796f7714101ee262c0f9c8cf59e8a18b2a87aee8ae588102c5ca6306d69b8","ssdeep":"","tlshash":"73f0f195f8d8102183b3117867eb600d7416363fcc4ead24f90d84422f6e9bd082b90c","size":505,"data":"","first_seen":"2025-09-09T23:24:20.724688Z","last_seen":"2026-04-04T12:24:21.481523Z","times_seen":34,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"21wiz.com/cs/202602221235.js?v=e379f03305e679091e67a2347ff53d50\u0026_t=1771752952845.845\u0026r=https%3A%2F%2Fgoyabu.io%2F40488","fqdn":"21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c703be7065ad29e860decd8d29656045","sha1":"349a1245d6a53510a69c78f4e13da89da09503a0","sha256":"1dff63b5b0cbf45cdbeeb0f207814ea4c73e161b0a80a04f1110547c1f7590e7","sha512":"238ce3d1bf8ceb80d7691e2c4d8ffcadf396a0c409650352c0954911f5617274f3171174e6c9a49980ec88275c72cbe80fb09f659de76329b46bf5c1b7c0ffbf","ssdeep":"3072:N2oEVygQmbp5o7XOjySeFKN1LzHjlD5D9Dh:N2oI5o7+jySeFO1LzrJV","tlshash":"84c319523622a8754ef180ea61765702f31a71687482491cf1ecccdbacadd5371fabf8","size":129171,"data":"","first_seen":"2026-02-22T09:36:24.929208Z","last_seen":"2026-02-22T09:36:24.929208Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5e398e3ce6b4b5871cf708d1bfe3e32c","sha1":"48eb56ab6ad4f7e7993bb57ac8f521275881bef1","sha256":"7a8a6cd61a9528bfa4542dfd60eada4200f58938997fcb6a4d6d1cadc4b52f12","sha512":"adf6e9322102ba43c76fce16e501affcf3ad1e515e3c8f3e639dd21887927c17b43f9162b4c63d581954fea5572c34957dd6c7abe1da158e7433bd27e8b572e7","ssdeep":"384:FTlKWDZF01RVP0Tl+Lk/X+ojdC76ssbiQLFPnN:FTlK+ZKHVPOl+LuuojdS6bJPnN","tlshash":"167293f98a873ed51d7ee1027b76492c1312749b462a8adb721d3e8c770d4ad3404ebb","size":17557,"data":"","first_seen":"2025-04-08T00:49:11.610292Z","last_seen":"2026-04-04T12:24:21.488387Z","times_seen":222,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/pbjs/prebid.js?v1736246449447","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"222485dd8cf45c4a425eaa0c20ca3dd4","sha1":"093b86b3430405f135c1f4b4b7678a2650f4462b","sha256":"99e31e296e382145b8a6c69b5d58c23a99926ddd63296b6eabbe606328223aa2","sha512":"9a40b8228c5ccd1a6bb9e62267cafa2fc89b16e6b9025e3a450068e6debcfe8155ed86218a80e047369dcd964c2553f818ab8db3a6d90f86d096a317b16b5f64","ssdeep":"3072:CxW8wlwFJBpGmkfr5Zcp7K6YDakaiiNDvSfeU/q6KFz5qa1qKIl0:QW8DFVGHjWlvSfu6KFAh6","tlshash":"0f44fb9a72c5f0ef53d714e4c47f4219f23a49443409d450f628ade728269afa2a3f7e","size":272321,"data":"","first_seen":"2025-04-18T23:51:44.31597Z","last_seen":"2026-02-22T09:36:24.958054Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#250","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ec09f1a885d8c17028dcbf31d8f9c1c","sha1":"68e3f711d62d94295bc3db29f0bbaa5cfc4b624e","sha256":"98e7fa5bc825d548474d0ad3402166e508f61ef3f9e93a6c98e237ce10faaf1d","sha512":"4202831cb7546e3062dd3f9b22ad99313f54b5db19d1b1d3e8b78c7be187ebf025af5052e10cd00a29685911fbfee52c444673f41569d8fba8a177608017a62d","ssdeep":"","tlshash":"ce9002a421489ad29211ab05492e1a24647187d5d4c000e751156e1431009078b800d4","size":53,"data":"","first_seen":"2024-11-20T14:19:46.639129Z","last_seen":"2026-04-04T12:24:21.482667Z","times_seen":328,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4074b9dbcb7335563f21f9cfe57f0497","sha1":"0132992a303f56dcde88513cf6ea156d20292073","sha256":"2b63b74fc061b1b85156963619a6d6ad8598bd885487f44b7e7f14c2d1395ab2","sha512":"e593e2cdb8a5a3af94ec4e248d22721105442e4ad921ddf4e5599a46a398c5f8fc548d912291d59bbb22bbf71a949761f283ce659aa5d9839ed2bb8834567564","ssdeep":"","tlshash":"901166ed0d6b50284c6360226b3ba2637b21702f6094cc56badccb11afa5aa7c815ac0","size":1108,"data":"","first_seen":"2026-02-20T12:02:07.238457Z","last_seen":"2026-02-22T09:36:24.955182Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/pmap?v=e379f03305e679091e67a2347ff53d50\u0026sub_id=popunder\u0026fmt_id=7\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026w=1280\u0026h=1024\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"3acde1e14c088f569c48716b77475f73","sha1":"4794f87715c169fba0d541c53b37d375c377ceaa","sha256":"135a97778eeda040eff658b285d4462be1e0ae52dac675ace1da016142db722a","sha512":"77e02d1d9c20f8e1bdcecaa37c772adaf756396212c241f2361c9c19d7e3a7c91d6f3a082f1637977cc3404767e5de7e22a40f6f11f82f423c79fb365a87ff00","ssdeep":"768:W0LGQoYAoNc68rDJ4VbknBHtAfHAr79dNXW9PXY++CvcI+aLj0o/poxtUBxTtIYO:KQ5beVJek9zXW2+//LAiPghiHPizd","tlshash":"264385c422d1f0b15a7e16f7a91be4fdd22968bda18e0c5df00e5d92f8b523cf528429","size":58706,"data":"","first_seen":"2026-02-22T09:36:24.934272Z","last_seen":"2026-02-22T09:36:24.934272Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/protect_trackmaster.js?v1771433036440","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb4fae25998d53cf247b07034fa9c060","sha1":"5667781f9c9b65932d4df75c420127bdd63a3870","sha256":"665fd700bf527b2a91c111c99d724fb35110c41ea3bff499fe5f2d144f60a8ce","sha512":"4f31a911f0f45f443ffd292da517053881eb2fcb825198a4a5ef8fbc6f685c1c16710df9bf074ad286ac466518c162254c278b324b1b757263618ebf38e1c603","ssdeep":"","tlshash":"0c11afdce8d0f371573051d8d8129508f0ad966650e2a6d0a25d8db2421bd854df2a59","size":871,"data":"","first_seen":"2025-07-17T11:51:43.334496Z","last_seen":"2026-04-04T17:11:20.470319Z","times_seen":186,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"script.4dex.io/a/latest/adagio.js","fqdn":"script.4dex.io","domain":"4dex.io","tld":"io"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"1c0e6075a90edb1de8757ea05b5550e5","sha1":"1a9d023207906a39a24ce74101e7950921e30ac8","sha256":"10c5eb31504511d202fc6249c9c9cc956cacf30f253461e6eb4b09919f711713","sha512":"1db02c7d9bb1923ff72808cadd61feb7122507649de5f2a2007ac6ccfd76dfdbc58e7fb6b5a25d2fb163fb517029f6594b54ee862408878969139bc99bf873ad","ssdeep":"","tlshash":"7e11ef8477a4f9f614d2e74240bfab4be50425391030f215b761dae1dc1809f56f1e33","size":1000,"data":"","first_seen":"2025-12-03T22:00:58.124761Z","last_seen":"2026-03-22T08:52:36.910202Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/protect_trackmaster.js?v1771433036440","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb4fae25998d53cf247b07034fa9c060","sha1":"5667781f9c9b65932d4df75c420127bdd63a3870","sha256":"665fd700bf527b2a91c111c99d724fb35110c41ea3bff499fe5f2d144f60a8ce","sha512":"4f31a911f0f45f443ffd292da517053881eb2fcb825198a4a5ef8fbc6f685c1c16710df9bf074ad286ac466518c162254c278b324b1b757263618ebf38e1c603","ssdeep":"","tlshash":"0c11afdce8d0f371573051d8d8129508f0ad966650e2a6d0a25d8db2421bd854df2a59","size":871,"data":"","first_seen":"2025-07-17T11:51:43.334496Z","last_seen":"2026-04-04T17:11:20.470319Z","times_seen":186,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#320","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ec09f1a885d8c17028dcbf31d8f9c1c","sha1":"68e3f711d62d94295bc3db29f0bbaa5cfc4b624e","sha256":"98e7fa5bc825d548474d0ad3402166e508f61ef3f9e93a6c98e237ce10faaf1d","sha512":"4202831cb7546e3062dd3f9b22ad99313f54b5db19d1b1d3e8b78c7be187ebf025af5052e10cd00a29685911fbfee52c444673f41569d8fba8a177608017a62d","ssdeep":"","tlshash":"ce9002a421489ad29211ab05492e1a24647187d5d4c000e751156e1431009078b800d4","size":53,"data":"","first_seen":"2024-11-20T14:19:46.639129Z","last_seen":"2026-04-04T12:24:21.482667Z","times_seen":328,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/protect_trackmaster.js?v1771433036440","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb4fae25998d53cf247b07034fa9c060","sha1":"5667781f9c9b65932d4df75c420127bdd63a3870","sha256":"665fd700bf527b2a91c111c99d724fb35110c41ea3bff499fe5f2d144f60a8ce","sha512":"4f31a911f0f45f443ffd292da517053881eb2fcb825198a4a5ef8fbc6f685c1c16710df9bf074ad286ac466518c162254c278b324b1b757263618ebf38e1c603","ssdeep":"","tlshash":"0c11afdce8d0f371573051d8d8129508f0ad966650e2a6d0a25d8db2421bd854df2a59","size":871,"data":"","first_seen":"2025-07-17T11:51:43.334496Z","last_seen":"2026-04-04T17:11:20.470319Z","times_seen":186,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pl.21wiz.com/frndnp.php?ver=1\u0026autoplay=1\u0026v=e379f03305e679091e67a2347ff53d50\u0026cb=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026fclose=false\u0026jh=cpzse3jqgeazq4m4f3ts65e\u0026sth=qp4gn7djcczdrcmzpf7nha5xpw\u0026sub_id=ap\u0026fmt_id=1\u0026testad=no\u0026nomon=1\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026cdiv=54\u0026frnd=true\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026country=NO\u0026spy=yes\u0026rel=true\u0026rnd=1771752957759\u0026cnt=1\u0026tls=no\u0026instant=yes","fqdn":"pl.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f32370020e33a7b57d3452e601fe1123","sha1":"21455f04d22f3dc737a2a8cb521b5f37348bda36","sha256":"fa0160cc34d0358b573624c21b61c80c6f865405802c283533a5a5b1e5c75d78","sha512":"4404fb50845021eff96680c236edf775decc5faa222cbbbc81237286b713df7cf2dae4be1074969599ee9032d7b0b12e92044609beb20a4ff71bffe3da48bbda","ssdeep":"768:/AIhabkIdyhAsZuNzTXSRVMwyFDx2TkKTpvuWBquePDh6gnHi:/AZqhuNoVMnFFmrVvuWBqZh6YHi","tlshash":"d1f25cb86c8f2d599f190406c5ec08dd15ac274df4ea628bd71bc1bd978a97021cacfa","size":34935,"data":"","first_seen":"2026-02-22T09:36:24.959016Z","last_seen":"2026-02-22T09:36:24.959016Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/protect_trackmaster.js?v1771433036440","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb4fae25998d53cf247b07034fa9c060","sha1":"5667781f9c9b65932d4df75c420127bdd63a3870","sha256":"665fd700bf527b2a91c111c99d724fb35110c41ea3bff499fe5f2d144f60a8ce","sha512":"4f31a911f0f45f443ffd292da517053881eb2fcb825198a4a5ef8fbc6f685c1c16710df9bf074ad286ac466518c162254c278b324b1b757263618ebf38e1c603","ssdeep":"","tlshash":"0c11afdce8d0f371573051d8d8129508f0ad966650e2a6d0a25d8db2421bd854df2a59","size":871,"data":"","first_seen":"2025-07-17T11:51:43.334496Z","last_seen":"2026-04-04T17:11:20.470319Z","times_seen":186,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/bn?key=e379f03305e679091e67a2347ff53d50\u0026cp.adsource=adg_cr_1\u0026vt=100\u0026w=300\u0026h=250\u0026pw=480\u0026ph=305\u0026cp.referer=https%3A%2F%2Fgoyabu.io%2F40488\u0026fid=f6698ac11dafbc3fb\u0026cp.tanc=\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"5076c7dfd9abeaa4a581e53775569e5e","sha1":"04b8fabb728818634ac91e8d48b5685d51455e39","sha256":"3a54b6907471ed47e2157b589d358c8b67e89d0c68303bdb72c87a77f6353759","sha512":"f530d2b6dbee96a61ecfb835fffd33a73456299f7d100659f21142936bad9b29cf03dce512ff5a1fd53589b593209a8c147879ed2fd1ff5d6841c75232e4aaf5","ssdeep":"384:wu8WuDjdUCRYYMZEaOzdCu0wGk9DwK1D1Twqiq5ZE19mpKVn1iqYlc:18WutJRMEabdwhVZIVnClc","tlshash":"f7a2b466ce4f2c5987a086872bde19d94c4c1bcda8d318cd964ae3cdd28f67610c8dde","size":22060,"data":"","first_seen":"2026-02-22T09:36:24.959739Z","last_seen":"2026-02-22T09:36:24.959739Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#346","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ec09f1a885d8c17028dcbf31d8f9c1c","sha1":"68e3f711d62d94295bc3db29f0bbaa5cfc4b624e","sha256":"98e7fa5bc825d548474d0ad3402166e508f61ef3f9e93a6c98e237ce10faaf1d","sha512":"4202831cb7546e3062dd3f9b22ad99313f54b5db19d1b1d3e8b78c7be187ebf025af5052e10cd00a29685911fbfee52c444673f41569d8fba8a177608017a62d","ssdeep":"","tlshash":"ce9002a421489ad29211ab05492e1a24647187d5d4c000e751156e1431009078b800d4","size":53,"data":"","first_seen":"2024-11-20T14:19:46.639129Z","last_seen":"2026-04-04T12:24:21.482667Z","times_seen":328,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/yasdk/vw.js?v5","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a66622b8397cb5b7eaeaf6be478ab248","sha1":"dcb7cac9fd4c1f6b49c07531c37e3beb2b650c47","sha256":"b390ac77cce9e350e49587c179849066c8af3bbd692a686a14242532ed5a98a1","sha512":"830d30a4d5384659c5dbe9cc5282ae41c6f0256b7eece9f6d17e51cc0cf0862b98dbf13d768375fb089102b1bc24c8046f537a87438a765f0b4691c7e53e023a","ssdeep":"96:ziNBQmnTT1YIfV8jJien9l/sU4sJc7xzyL8WaL53hDsIIIU:zBmnlYIfV8jJien9l/J4sJoxzIaL53h8","tlshash":"cba18a561aab2022dc72f0290fbf13126a34950b1507d92c3e6d53fc9f9993a831be7d","size":4990,"data":"","first_seen":"2024-12-18T20:00:18.668023Z","last_seen":"2026-04-04T17:11:20.475711Z","times_seen":559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3343c880fecb5ec6a9c79d757d8649bc","sha1":"2030817205fa44edf93901852a7e9a7538f46613","sha256":"3685a474ff8750412f0a2f0381fe30438de436f24f76e91b32b5f4c223af6101","sha512":"5ccffd94bf1203123fb279df92ab73dda2c016ac2f23bbbba5ae41dc514f07298969f8a7ffe6845af76185b2e1b86cc41934c386194a4bc6f4e8d777ef10b900","ssdeep":"","tlshash":"ed41cc6ad9ab143964b240be8bdf720134624013dc04fa20fa4c76592f9d31fa671bda","size":2384,"data":"","first_seen":"2026-02-22T09:36:24.960482Z","last_seen":"2026-02-22T09:36:24.960482Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"44d090b147bfe8f124a90f88cd8a6386","sha1":"d54ff49ab243cc87f3668dfcf0bdd0944c09bea9","sha256":"44a2c5fe54a4ad990f260f0f48d4e46ed30274fbc8b81a1a7b7170356b44e13c","sha512":"ac17ef498325fc2d14106cd1eacecc1e7bec942cef76f5bd2c4dadc6f471f03829c23b15511ea34a1fa33b516a670b0cd2f581b15aba3599f67da66eef42fc0c","ssdeep":"","tlshash":"4fa022cfa202080802202a203ea230c03802000b80220000ba0cb80a0f00b830008b80","size":71,"data":"","first_seen":"2023-07-28T23:45:35Z","last_seen":"2026-04-04T12:24:21.483767Z","times_seen":493,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"83a1ca02404b489457520cbeb9ed4d53","sha1":"1d65ab3feb9a8364bee49c3215bc8f44f874c922","sha256":"0a7685c47e1a49bd7a7edf1f9fa604f9ebb28f75e7851d59873d9121bde99b58","sha512":"d9e6adb48cfad7ef1077e17ff74b29494f20c7544570875d7a267379ecea335fdfb00f9f5f9e1c7546798fc261dd26dbef692af0f492165e3963cba625131c62","ssdeep":"192:bJlFkk88qRP3pwQT0UkhGjgq/sdq/s1QD2Tqxw/tTyi2qO6I47Dy5gJWvyiUoxCn:vFxQT0Ugq/4q/JDa2qFILWN","tlshash":"8d72635e19f310366163b06e5bdba028363551136209ed103f9ca340bfac96edaf6bdc","size":16231,"data":"","first_seen":"2026-02-22T09:36:24.961424Z","last_seen":"2026-02-22T09:36:24.961424Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"1e883aa40a726f421ca6f9d66486579c","sha1":"91551664aab5dddf07ccd83b1b05793b14c5ad2c","sha256":"2fee08d1698416b428a40cf375d24cebf614c3ac95c59b7cd3aa1b256441192d","sha512":"9d3a5833008ddd0cd7d9e7d12e537dbb48d86c956b156639bd5d9d23e276f86c95b5f2d70be2cfb95c4ed823370742953a7feea945429d4438d1f8cd925826b6","ssdeep":"","tlshash":"21f0e7532ce1500ce4d555b4d8e0a32c94bdd25df5614d24e7d6327126fe5ad4943447","size":580,"data":"","first_seen":"2026-02-22T09:36:24.962282Z","last_seen":"2026-02-22T09:36:24.962282Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"2100af201700d96a1a5f15b12b08dcd1","sha1":"9d121dbca82a498768e05d7ae01dbd42572122c3","sha256":"47799cb0ddb882263c77beafebddbe09311c4bbb000d8f859edd78f82369a931","sha512":"735c457291a13d7c656d70225c55bbd5a00f08c4e3beb0e608433aa7ee6678067ed5bd8b5cd9b2ad44e6a3ee31d5309db272606aa80b1154b32d1255dd6171ea","ssdeep":"","tlshash":"3501238a36e9381dece586f4e8e1f18d40eed06ad562cd10abd1756032e90570a134c2","size":661,"data":"","first_seen":"2026-02-22T09:36:24.963129Z","last_seen":"2026-02-22T09:36:24.963129Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f0ef891a9f5c626a87f0c73755d94687","sha1":"d182f8efe206bb10069bda82cf1c05a610a4bf13","sha256":"f3d0578836457d8d60256b07c1a4bd22225586fe500b913f02ca607d41422cea","sha512":"aa172ef88acc5931991336f2cd77100ab9a71dfdabb585a1204e715d6cd1f904c71b100961fa2c017b4cc6f5a7778635c3bfb8b5ad5cf9b4172b9dfa8cd7411c","ssdeep":"384:QTlKWDZF01RVP0Tl+Lk/X+ojdC76ssbiQLFPneS6iG+H4+:QTlK+ZKHVPOl+LuuojdS6bJPneuGyb","tlshash":"c4c2c5f94ad729d54d7ee002bbb6552c3312705b0a15cedb764c3e8c6f0d06e2844eab","size":26152,"data":"","first_seen":"2026-02-22T09:36:24.963874Z","last_seen":"2026-02-22T09:36:24.963874Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"b357c27c8ddcb0fc916eabd3262e7718","sha1":"e56335fa0d2335b99bc2c9841bbd0e92ea6df392","sha256":"3d10038cfb6d4e28a5ce890d1e1deb6c0a3a703c5461c59e57bd2dd326aac680","sha512":"23d8216f88625e57764d8afe0ddff5d357f6e106e01c2ec485f987f5654e7446cb35d9982026217f104a62a263a8c91c2ac7b02a7914dbf22a258e2a82a136c8","ssdeep":"192:bJlFkk88qRP30wQT0UkhGjRq/sQfZq/sQfUzD2Tqxw/tTyi2+O6I47Dy5gJWvyiS:vFsQT0URq/xq/2Da2+FILWN","tlshash":"d372845e19f710366163b06e5beba128323551136209ec103f5ca350bfac96edaf67dc","size":16231,"data":"","first_seen":"2026-02-22T09:36:24.96461Z","last_seen":"2026-02-22T09:36:24.96461Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"e532edc06b98e555266f8062fbdcd649","sha1":"3b25a653815e301c7d9d699bed7902126fa56d54","sha256":"f7aa1e8e06c58db6f9c6756241cbb65cd886a9d5de2e19224c4c575303ec682e","sha512":"6c648a2ab2036d8323e441ce76714297da81791c50d853924b47cf81eb5f98b988267a2e9b3656eeabf39ff6a4c6aa2b44fb806a7d77d8b0196b8d2a0dcf030e","ssdeep":"","tlshash":"50f0088666e83c0ce8e589f4d8e1f15d40de916ad5528d10abd5717031e90574e534c2","size":628,"data":"","first_seen":"2026-02-22T09:36:24.965484Z","last_seen":"2026-02-22T09:36:24.965484Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"0b73bf2886a633a651c0143c54d02a09","sha1":"6676208056e7329acb688410a78793f15acbccec","sha256":"ab5a129ef76c1914d41f926fc951e2469cf12d7b5af9c57ac646829255a00e43","sha512":"ac2c8b6b1b1b804b9ca0527d984cf62977c58a4e4ec6392740a2864925b49896cf9fe2d80acef54d04f9bca652e242fdaf4f68646c195f3940646f0af289345d","ssdeep":"384:QTlKWDZF01RVP0Tl+Lk/X+ojdC76ssbiQLFPnnj6B5Jv+H4X:QTlK+ZKHVPOl+LuuojdS6bJPnnk5JvyK","tlshash":"84c2b5f90ad729d55d7ee002bbb6552c3712705b0a09ceda764d3e8c7f0d46e2804eab","size":27049,"data":"","first_seen":"2026-02-22T09:36:24.966323Z","last_seen":"2026-02-22T09:36:24.966323Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"462469dfbe04605b49bcc358a53df7b3","sha1":"277113ad9b662ddbd40918e2a3ad2904f98d5376","sha256":"314d3c5a77a776914de1a30d8c33604da35e4a2eec557a4826bcd6663fbfeb65","sha512":"37d2c7e79a6983a52b385d5d5ac4f614c8a5ddb2ba3b410eb689fd02eaa8bea2b1cc9d5d72509a7f5af460f4a6223570eaecccf2a96770adbc669a3074f9d384","ssdeep":"","tlshash":"18f0e1522ce1200ca4d962b898e0a32850aed25df1614d24e6e632b022f95ad4983443","size":547,"data":"","first_seen":"2026-02-22T09:36:24.967108Z","last_seen":"2026-02-22T09:36:24.967108Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]},"http":[{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=strww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=54223f38-d8a4-a81b-81c5-295ad55562e8","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.922Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=strww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=54223f38-d8a4-a81b-81c5-295ad55562e8 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1119\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=push_v_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=b4115d7d-e0b2-ce77-4107-c06c97fb6fd3","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=push_v_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=b4115d7d-e0b2-ce77-4107-c06c97fb6fd3 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1469\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/themes/cronos-design/assets/fontawesome/webfonts/fa-duotone-900.woff2","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.641Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/themes/cronos-design/assets/fontawesome/webfonts/fa-duotone-900.woff2 HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://goyabu.io/40488\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 187520\r\nserver: cloudflare\r\nlast-modified: Thu, 10 Jul 2025 18:14:21 GMT\r\netag: \"687002fd-2dc80\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rh%2FzTtrB92kG8NTegKdLlnj2FDJGEE%2BOP%2FgG02%2FORcm4CAxOtJ9k7uoZRsn7oPGAgX%2FbnABA9ek1rdPFqYv%2BU1nC75CiOTXxBA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef1fad8902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":187520,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 187520, version 331.-31392","md5":"3665861ef3926b56170a92f12d1c40f9","sha1":"a77d466f5ab5ca35379c29d84f22c1602b32e631","sha256":"774c3f1eec2330687ff300942799fb467faf4aae6d0f97c9e49004dccd6abd31","sha512":"a81107fb2b9be3f84a70a983f559ee1b566065c76289c131694b0e12a845d604690e74508957647aff44509fe0fa9b7d94c672239ec34cbcc23119c63190d3e6","ssdeep":"3072:WRI2en9ofwDPyT7k+rt4bTmSGBYwP6LuIbViB2AuboSxcfntxauvy7eZnbNWFgV:WRI2SKfwDy7RxF/Bv6qIMSBxc10uv4el","tlshash":"3804229dc2a8858f8795b7b11d6352233a8d1c425234e0c5fbfbfe47179dfaa3618604","first_seen":"2023-05-07T21:39:51Z","last_seen":"2026-04-04T15:50:00.052379Z","times_seen":541,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mc.acint.net/match?dp=126\u0026euid=6325f496-d49f-4583-5b53-c771edaea876\u0026aid=0900007FFBCD9A692C0908B0027F75F8","fqdn":"mc.acint.net","domain":"acint.net","tld":"net"},"ip":{"addr":"193.3.184.27","port":443,"asn":50214,"as":"QWARTA LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.403Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.acint.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 23:34:52 GMT","end":"Fri, 17 Apr 2026 23:34:51 GMT"},"fingerprint":{"sha1":"35:A8:27:67:78:F8:62:D1:AE:7F:FF:67:52:6F:6F:8E:76:60:E8:D5","sha256":"F0:D0:F6:8E:83:04:8E:C8:EE:0B:C4:04:A6:D5:23:AB:52:72:1C:29:C5:76:13:3B:07:F4:8C:6A:29:52:FA:25"}}},"request":{"raw":"GET /match?dp=126\u0026euid=6325f496-d49f-4583-5b53-c771edaea876\u0026aid=0900007FFBCD9A692C0908B0027F75F8 HTTP/1.1\r\nHost: mc.acint.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: test_cookie=CheckForPermission; aid=fwAACWmazfuwCAks+HV/Ahav4PgmNM6x8YWKaNslRlNT7txu; cSyncDp126v3=1771752955\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: openresty\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/html\r\ncontent-length: 154\r\nlocation: https://ads.betweendigital.com/match?bidder_id=35313\u0026external_user_id=0900007FFBCD9A692C0908B0027F75F8\u0026callback_url=https%3A%2F%2Fmc.acint.net%2Fmatch%3Fdp%3D107%26euid%3D%24%7BUSER_ID%7D%26aid%3D0900007FFBCD9A692C0908B0027F75F8\r\nset-cookie: cSyncDp107v2=1771752955; expires=Tue, 24-Mar-26 09:35:55 GMT; path=/; Secure; SameSite=None; domain=.acint.net\r\nexpires: Wed, 19 Apr 2000 11:43:00 GMT\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=Adtou1ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=ece8b3d1-70e5-6f70-89c0-a3caf2ec4aa8","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.875Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=Adtou1ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=ece8b3d1-70e5-6f70-89c0-a3caf2ec4aa8 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1583\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"21wiz.com/s.js?v=e379f03305e679091e67a2347ff53d50","fqdn":"21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.655Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /s.js?v=e379f03305e679091e67a2347ff53d50 HTTP/1.1\r\nHost: 21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0\r\npragma: no-cache\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AoMxiqerXglD48Ll4clSiEJhn4YcrRmcrSgLW2pGqaF7toiTFxDNiI3S6GgmSSxMUlLHFyyiRr4NUkZ2GeYDk%2BMtKVNL5zak6A%3D%3D\"}]}\r\ncf-ray: 9d1d7ef24cceea60-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4235,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (4234)","md5":"ab39ffeed8028aea9efb03a894b768cc","sha1":"2ed0d3d41411827f50d292d9a79d93313d645d62","sha256":"4d8904b5807d24fe1b294eb70c433c299f683ac79b3402cea0642e2ef3a4a1d1","sha512":"2fedfb7c73d66f978080339bfbc4c907a6151779be9e6fe6b0c2d38aa6a801b078ac231903d7d0656dfe6e94191c4d48dc91373a796402d36bf31926897911ca","ssdeep":"96:56bCf4hHM7EwF+/KvTpGgqCvTpGWDHWcZ72RnyQPJ:4ueH+3GGGWDHWc92RyQh","tlshash":"2891a56e5f2e0d52ab77a08b0c8fc44db76f907915f500e3f540f1ab679aa62168261c","first_seen":"2026-02-22T09:36:24.925481Z","last_seen":"2026-02-22T09:36:24.925481Z","times_seen":1,"resource_available":true,"data":null}},"time_used":115,"timings":{"blocked":33,"dns":12,"connect":8,"send":0,"wait":35,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=tfmg\u0026rnd=1771752954","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.656Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=tfmg\u0026rnd=1771752954 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-length: 0\r\nlocation: https://cc.cloudad.icu/images/1px-matching-wizads.gif?id=4a677b54-8482-09d0-43af-c1ee5ba0a7e4\r\nset-cookie: sky_uuid=4a677b54-8482-09d0-43af-c1ee5ba0a7e4; max-age=157680000; path=/; HttpOnly; secure; SameSite=None\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.239:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mc.acint.net/match?dp=450\u0026euid=BHjoFMmspYBR5WjtJZXygGD24s","fqdn":"mc.acint.net","domain":"acint.net","tld":"net"},"ip":{"addr":"193.3.184.27","port":443,"asn":50214,"as":"QWARTA LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.acint.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 23:34:52 GMT","end":"Fri, 17 Apr 2026 23:34:51 GMT"},"fingerprint":{"sha1":"35:A8:27:67:78:F8:62:D1:AE:7F:FF:67:52:6F:6F:8E:76:60:E8:D5","sha256":"F0:D0:F6:8E:83:04:8E:C8:EE:0B:C4:04:A6:D5:23:AB:52:72:1C:29:C5:76:13:3B:07:F4:8C:6A:29:52:FA:25"}}},"request":{"raw":"GET /match?dp=450\u0026euid=BHjoFMmspYBR5WjtJZXygGD24s HTTP/1.1\r\nHost: mc.acint.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: openresty\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/html\r\ncontent-length: 154\r\nlocation: /match?dp=450\u0026tc=1\u0026euid=BHjoFMmspYBR5WjtJZXygGD24s\r\nexpires: Wed, 19 Apr 2000 11:43:00 GMT\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\nset-cookie: test_cookie=CheckForPermission; path=/; Secure; SameSite=None; domain=.acint.net; expires=Sun, 22-Feb-26 09:45:55 GMT\naid=fwAACWmazfuwCAks+HV/Ahav4PgmNM6x8YWKaNslRlNT7txu; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.acint.net; path=/; Secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":279,"timings":{"blocked":125,"dns":57,"connect":27,"send":0,"wait":28,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=udffot1y_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=8b4d26cd-1647-ac82-ca5b-a7225608c8e0","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=udffot1y_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=8b4d26cd-1647-ac82-ca5b-a7225608c8e0 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,2365\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exchange.buzzoola.com/cookiesync/dsp/sape-banner?set_buzzoola_cookie=t\u0026uid=0900007FFBCD9A692C0908B0027F75F8\u0026url=https%3A%2F%2Fmc.acint.net%2Fmatch%3Fdp%3D126%26euid%3D%24%7BUUID%7D%26aid%3D0900007FFBCD9A692C0908B0027F75F8","fqdn":"exchange.buzzoola.com","domain":"buzzoola.com","tld":"com"},"ip":{"addr":"45.138.161.82","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.336Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"buzzoola.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Dec 2025 06:11:29 GMT","end":"Mon, 09 Mar 2026 06:11:28 GMT"},"fingerprint":{"sha1":"6D:1A:28:D1:AB:8D:18:D1:38:1A:55:28:34:A1:03:2A:BC:7A:1C:5A","sha256":"AB:C0:F2:6B:07:6C:D6:89:63:34:97:78:29:CD:C6:D1:2A:75:3D:C0:7C:E0:05:94:11:71:82:6B:67:8C:2D:36"}}},"request":{"raw":"GET /cookiesync/dsp/sape-banner?set_buzzoola_cookie=t\u0026uid=0900007FFBCD9A692C0908B0027F75F8\u0026url=https%3A%2F%2Fmc.acint.net%2Fmatch%3Fdp%3D126%26euid%3D%24%7BUUID%7D%26aid%3D0900007FFBCD9A692C0908B0027F75F8 HTTP/1.1\r\nHost: exchange.buzzoola.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uuid=6325f496-d49f-4583-5b53-c771edaea876\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 143\r\nlocation: https://mc.acint.net/match?dp=126\u0026euid=6325f496-d49f-4583-5b53-c771edaea876\u0026aid=0900007FFBCD9A692C0908B0027F75F8\r\nserverid: TODO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=hbrdcookie2\u0026rnd=1771752968","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=hbrdcookie2\u0026rnd=1771752968 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:08 GMT\r\ncontent-length: 0\r\nlocation: https://dm-eu.hybrid.ai/match?id=185\u0026burl=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dhbrdcookie2%26bid%3D%24%7BVID%7D\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.215:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dm-eu.hybrid.ai/match?id=185\u0026burl=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dhbrdcookie2%26bid%3D%24%7BVID%7D","fqdn":"dm-eu.hybrid.ai","domain":"hybrid.ai","tld":"ai"},"ip":{"addr":"37.230.131.16","port":443,"asn":200197,"as":"Hybrid Adtech Sp.z.o.o.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.hybrid.ai","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 22 Sep 2025 00:00:00 GMT","end":"Sun, 04 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:21:9E:FA:EF:FF:FF:F2:8D:68:A8:F9:EB:ED:53:32:CC:17:9B:ED","sha256":"C9:20:9A:53:1E:FA:35:C7:29:64:1F:C3:7B:1E:34:73:C8:15:87:43:EA:35:06:B8:8D:86:E5:11:19:2A:60:FC"}}},"request":{"raw":"GET /match?id=185\u0026burl=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dhbrdcookie2%26bid%3D%24%7BVID%7D HTTP/1.1\r\nHost: dm-eu.hybrid.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 22 Feb 2026 09:33:14 GMT\r\ncache-control: no-cache, no-store\r\npragma: no-cache\r\nexpires: -1\r\np3p: CP=\"NOI DSP COR CUR ADMa DEVo TAIo PSAo PSDo IVAo IVDo OUR IND COM NAV INT STA OTC\"\r\nx-mode: 5071\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: https://goyabu.io\r\naccess-control-allow-credentials: true\r\nserver: Hybrid Web Server\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":145,"timings":{"blocked":60,"dns":3,"connect":22,"send":0,"wait":24,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=exww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=abe72319-fcf3-ee16-b8ad-9fe868179731","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=exww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=abe72319-fcf3-ee16-b8ad-9fe868179731 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,2965\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/jmap?v=e379f03305e679091e67a2347ff53d50\u0026sid=ap\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026it=1\u0026tq=2\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026position=pre\u0026vt=100\u0026ostream=true\u0026isp=0\u0026suri=https%253A%252F%252Fgoyabu.io%252F40488\u0026rnd=1771752955561\u0026raw=yes\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/jmap?v=e379f03305e679091e67a2347ff53d50\u0026sid=ap\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026it=1\u0026tq=2\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026position=pre\u0026vt=100\u0026ostream=true\u0026isp=0\u0026suri=https%253A%252F%252Fgoyabu.io%252F40488\u0026rnd=1771752955561\u0026raw=yes\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-go-country: NO\r\nx-wizads-udata: cache,parsed,1105\r\nx-wizads-plc: 0\r\nx-wizads-ark: true\r\nx-wizads-qmc: NO\r\nx-wizads-rdb: 2\r\nx-wizads-alc: 16\r\nx-wizads-ctvs: 16\r\nserver-timing: validations_1617;dur=0.0000, attachTracking;dur=0.0000, jmapParams;dur=0.0000, keyValidation;dur=0.0000, validations_1633;dur=0.0000, validations_1631;dur=0.0000, validations_1615;dur=0.0000, getJson;dur=0.0000, wmData;dur=0.0000, range_links;dur=1.0000, validations_1599;dur=0.0000, validations_1619;dur=0.0000, optProc;dur=0.0000, getLinks;dur=0.0000, validations_1608;dur=0.0000, queueSort;dur=0.0000, initBuilder;dur=0.0000, validations_1601;dur=0.0000, validations_1606;dur=0.0000, validations_1569;dur=0.0000, validations_1593;dur=0.0000, validations_1622;dur=0.0000, uData;dur=0.0000, qManager;dur=3.0000, getAnyQueue;dur=0.0000, validations_1572;dur=0.0000, queuesMerge;dur=0.0000, corsParams;dur=0.0000, buildTagsQueue;dur=2.0000\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.214:9009\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87625,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"16f1446c778e61826506cac998dd30e9","sha1":"cd062c4996e17011af56e59d64486734906dd715","sha256":"430349795679a74013ed171a2c313b0aa2108492d65ec7e662c86ffb78227471","sha512":"03d023f94e3faf1047e67da66872ea4abae1300189de31838240c4233f1e5c7e1637999253080881780853b40be75a5c109b012edc5533c828f2ab8389d1269c","ssdeep":"1536:fCHQO/J2abCvChAQh5/he2hfRVKqLC7QC/F2eBCYkCWQ//I25Br3C1Qs/r20QF+m:Kc","tlshash":"6983654267fe3a3594c0a48ccfb0efe8c5e554a36c19007edbad115437bcba6ae54a43","first_seen":"2026-02-22T09:36:24.926702Z","last_seen":"2026-02-22T09:36:24.926702Z","times_seen":1,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/uploads/2023/08/68d1b9bc2f01e.webp","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.642Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/uploads/2023/08/68d1b9bc2f01e.webp HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: image/webp\r\ncontent-length: 29560\r\nserver: cloudflare\r\nlast-modified: Tue, 11 Nov 2025 10:54:06 GMT\r\netag: \"691315ce-7378\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b7aMGOD8J6ftEwqhRTpOF20Pc0SKaaNCnplUg4f4%2FRMhbVloJ7b%2FZ2ODIAizpg5ElsomG1J86bYZRCN%2BrdfkDBUp%2F8UMZu%2Fmyg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef1fae2902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29560,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5bbe9450a69765f373dafe00b9c91e57","sha1":"39077c4a986ebb3e42b44902d5c61ea2909656a3","sha256":"4c9b36fbcb2dab7e1c1840819b889ddcc85c6569fd96f20f184459caf6cd5a64","sha512":"f5bfa19778ea6fd8682d4cf003f731adaffdeea086fee013540c6ef6788b34d67cf7924d20c127c74b73b2aa40807ecbe9b94737943b2d05d37494b7197973f5","ssdeep":"768:HiL0t37DkT6fDGoAKXWGZRjCATeqozwia6bCB50VtAaObww1DJN:CLoDk+qKGY4hDbCn0BQN","tlshash":"b8d2f1f42b5e3764e63aad796f36bba43a8c90e2e1d57d48ba040ccb0d06d5c6c13467","first_seen":"2026-02-22T09:36:24.927452Z","last_seen":"2026-02-22T09:36:24.927452Z","times_seen":1,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/bmap?v=e379f03305e679091e67a2347ff53d50\u0026sub_id=ap\u0026fmt_id=4\u0026pl_key=banner\u0026testad=no\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026tanc=\u0026ancs=\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026frnd=yes","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/bmap?v=e379f03305e679091e67a2347ff53d50\u0026sub_id=ap\u0026fmt_id=4\u0026pl_key=banner\u0026testad=no\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026tanc=\u0026ancs=\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026frnd=yes HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-udata: cache,parsed,1466\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.162:9009\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":76486,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"9c9bca58fc7ad8e466b27112de965172","sha1":"8a575fd266d7b4891ac214d32717cf8a7712f499","sha256":"962021afad718c8d1008b7ac83fde1e3ab61c6feb1497907b571c4a8a38ec27e","sha512":"8ce27db7db7868d5fc124f7745bcf81b10325eb89258fc347a13bb914ad8a3657ec1a677492efaf925cc5031694befd6d9fb0bce3b0af236f24372715d4f7759","ssdeep":"1536:I1tIbWgT/UuYzqQg5xiBH8/Vqf2S32whpoGRbBdQJA8fH2Ab4:4SbWn3owB4U","tlshash":"767319c91290f2b568a911f7b93b71e9d3247876600d159ef0089e70b6ed67ffb2c428","first_seen":"2026-02-22T09:36:24.92832Z","last_seen":"2026-02-22T09:36:24.92832Z","times_seen":1,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"logger.21wiz.com/logger?t=prev_session\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026v=e379f03305e679091e67a2347ff53d50\u0026o=","fqdn":"logger.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.865Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /logger?t=prev_session\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026v=e379f03305e679091e67a2347ff53d50\u0026o= HTTP/1.1\r\nHost: logger.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:36:08 GMT\r\npriority: u=4,i=?0\r\nx-logger-tdb: wizads\r\nx-movieads-country: NO\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oIGLmELU%2BQ%2BrEdwmZ6elmyNScLfd655Zp4%2FowE0IIrJLtK0JzZWJCCREeaIOq%2Ff%2FIRdugadA%2ByDMUrvi4WSaZYkXVuhuPda%2Bid81Y2Sdr9o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7f575c10723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=btwww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=abb7e441-a0b8-ed4e-0d0f-4b295b78e8ac","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=btwww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=abb7e441-a0b8-ed4e-0d0f-4b295b78e8ac HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1075\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/csync?cn=tfmg\u0026bid=1452944245466703","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.879Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/csync?cn=tfmg\u0026bid=1452944245466703 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 0\r\nset-cookie: tfmg=1452944245466703; max-age=86400; path=/; HttpOnly; secure; SameSite=None\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.207:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"logger.21wiz.com/logger?t=player_finish\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=\u0026v=e379f03305e679091e67a2347ff53d50\u0026o=","fqdn":"logger.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:57.763Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /logger?t=player_finish\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=\u0026v=e379f03305e679091e67a2347ff53d50\u0026o= HTTP/1.1\r\nHost: logger.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:35:57 GMT\r\npriority: u=4,i=?0\r\nx-logger-tdb: wizads\r\nx-movieads-country: NO\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QBwcMA%2BezovDLINk24yOHSsIxLW09E1fKbtEgtp%2BcLe9%2Fl65o6t6nO6a9Kb%2BQB2QREpTPfjNiwN99%2F3PpNhIkp1cAvajHU2fPc%2BGO5SSlfM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7f120d84723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=bdgfg34_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=3cb72fff-caf7-6379-5a15-859932878ba7","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.879Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=bdgfg34_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=3cb72fff-caf7-6379-5a15-859932878ba7 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,10748\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=hui3_vid_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=85c8fe5c-a9b1-00df-0882-2965f93e1ffb","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.958Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=hui3_vid_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=85c8fe5c-a9b1-00df-0882-2965f93e1ffb HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,235\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"21wiz.com/cs/202602221235.js?v=e379f03305e679091e67a2347ff53d50\u0026_t=1771752952845.845\u0026r=https%3A%2F%2Fgoyabu.io%2F40488","fqdn":"21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.869Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /cs/202602221235.js?v=e379f03305e679091e67a2347ff53d50\u0026_t=1771752952845.845\u0026r=https%3A%2F%2Fgoyabu.io%2F40488 HTTP/1.1\r\nHost: 21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: application/javascript;charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0\r\npragma: no-cache\r\nset-cookie: sky_uuid=8d2b099a-409b-41e8-8a92-79c26f55b5b8; expires=Mon, 22-Feb-2027 09:35:52 GMT; Max-Age=31536000; path=/; SameSite=None;Secure\r\nx-movieads-udata: cache\r\nx-yac-source: Yac\r\nx-movieads-setup: combo\r\nserver-timing: App_toggle;dur=3.67, Bootstrap;dur=0.08, RedisFactory;dur=0.27, LocalRedis;dur=0.65, Redis_get_whichbrowser_11868452804c8a2bb86650b580125ff5;dur=0.31, cfExtPri\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=buHnd4AcBBEyXexntoyQCCKVEaVAw52BAM0dZW5J82t%2BpxASJc9Up%2FbTXyMNRiyFaVt2W6H92iVrApMpabMFrEaj54WawAh80g%3D%3D\"}]}\r\ncf-ray: 9d1d7ef368f2723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":129171,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65286), with no line terminators","md5":"c703be7065ad29e860decd8d29656045","sha1":"349a1245d6a53510a69c78f4e13da89da09503a0","sha256":"1dff63b5b0cbf45cdbeeb0f207814ea4c73e161b0a80a04f1110547c1f7590e7","sha512":"238ce3d1bf8ceb80d7691e2c4d8ffcadf396a0c409650352c0954911f5617274f3171174e6c9a49980ec88275c72cbe80fb09f659de76329b46bf5c1b7c0ffbf","ssdeep":"3072:N2oEVygQmbp5o7XOjySeFKN1LzHjlD5D9Dh:N2oI5o7+jySeFO1LzrJV","tlshash":"84c319523622a8754ef180ea61765702f31a71687482491cf1ecccdbacadd5371fabf8","first_seen":"2026-02-22T09:36:24.929208Z","last_seen":"2026-02-22T09:36:24.929208Z","times_seen":1,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/mstream2.js?ver=13196771243","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /mp_dist/mstream2.js?ver=13196771243 HTTP/1.1\r\nHost: static.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 20 Feb 2026 09:56:12 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: \"69982fbc-2a291\"\r\nx-movieads-country: NO\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-max-age: 1728000\r\ncontent-encoding: gzip\r\nage: 7026\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Fr%2BNua1NH9FqDYeAJFw9lLydK8%2FXOuZXqvmJ2L6Nt8kQy6mccZ1VUqNlqbpVdMrL82DmPbArHr3%2FFBcGM3RpfQJgGn5SPoyplIbOMmapA9Y%3D\"}]}\r\ncf-ray: 9d1d7efe9b03723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":172689,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65071), with no line terminators","md5":"3ba9ba11d0cb003dc53a4e043c157e90","sha1":"688a5b883b559bcd08866d401b1df12031d33c50","sha256":"83d83355f53f328ec023335d6606fb30c14c17ba114599e82ad5f694247978f6","sha512":"41747365aa4911c53c219a9156dc94f504b1a2f712a4b227e619a38f25dd3d740ba51770618aa49a5af1c004a4f07e1b7cf2e75366b656259285c61486ee4131","ssdeep":"3072:isttTVisVPmLoIOzB/PhCC4Jd4FlQs02HNUjg5rq3ZrU5C:ime+Xl3puKlT0MUjprUE","tlshash":"e0f36b761ac264712ba0c2d950780250de3e5a0e708347bcbd6cced7a859953b1bebfc","first_seen":"2026-02-20T12:02:07.192459Z","last_seen":"2026-02-24T08:18:14.718648Z","times_seen":12,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=DaoOut_qps\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=b11b6d9c-9323-8c22-f511-10d473fa46f0","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=DaoOut_qps\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=b11b6d9c-9323-8c22-f511-10d473fa46f0 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,6804\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=medx\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=a108803c-9ece-5132-2ba9-e30495ce5798","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=medx\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=a108803c-9ece-5132-2ba9-e30495ce5798 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,2849\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=strww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=33757e10-c9ca-9914-6bc7-14831ac30f65","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=strww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=33757e10-c9ca-9914-6bc7-14831ac30f65 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1828\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cpscvonbgxn.com/","fqdn":"cpscvonbgxn.com","domain":"cpscvonbgxn.com","tld":"com"},"ip":{"addr":"139.45.197.101","port":443,"asn":9002,"as":"RETN Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:53.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cpscvonbgxn.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 11:04:55 GMT","end":"Fri, 22 May 2026 11:04:54 GMT"},"fingerprint":{"sha1":"89:D2:5F:8C:56:51:E1:79:79:40:65:53:B0:1B:F8:AD:3F:0A:65:A0","sha256":"3F:21:B9:68:60:E0:DA:C8:A6:96:94:0A:33:25:59:D0:9C:AC:E1:9D:BF:F9:7A:1E:DF:2F:EA:A7:F6:DF:AC:F1"}}},"request":{"raw":"HEAD / HTTP/1.1\r\nHost: cpscvonbgxn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/html\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"HEAD"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:53 GMT\r\ncontent-type: text/html\r\nx-t78r33a13c9e44-25i95d67: 00000000000000000000000000000000\r\nvary: Accept-Encoding, Origin\r\naccess-control-allow-origin: https://goyabu.io\r\naccess-control-expose-headers: Link, X-Application-Token, X-Application-Key, X-Tag, X-Auth-Token, X-DirectionPartner-Id, X-ZoneType-Id, X-Hostname\r\naccess-control-allow-credentials: true\r\ntiming-allow-origin: *\r\nexpires: Tue, 11 Jan 1994 10:00:00 GMT\r\ncache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0\r\npragma: no-cache\r\nx-application-key: ln21dVj4cF6en9vx0lvlg\r\nstrict-transport-security: max-age=1\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=kdkd33_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=4c01618a-e6eb-9f1e-a505-6b7389372672","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=kdkd33_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=4c01618a-e6eb-9f1e-a505-6b7389372672 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,2640\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=Hds_t_rtb_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=ce27adeb-8a29-05b8-2f96-9518fa774efe","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=Hds_t_rtb_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=ce27adeb-8a29-05b8-2f96-9518fa774efe HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,6790\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/pixel?v=e379f03305e679091e67a2347ff53d50\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026fmt_id=1\u0026rnd=1771752954.4371","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/pixel?v=e379f03305e679091e67a2347ff53d50\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026fmt_id=1\u0026rnd=1771752954.4371 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 0\r\nx-wizads-udata: cache,parsed,2639\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nset-cookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; max-age=157680000; path=/; HttpOnly; secure; SameSite=None\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.194:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.uuidksinc.net/match/3038/?remote_uid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c","fqdn":"s.uuidksinc.net","domain":"uuidksinc.net","tld":"net"},"ip":{"addr":"31.220.27.155","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uuidksinc.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 23:22:16 GMT","end":"Sat, 28 Mar 2026 23:22:15 GMT"},"fingerprint":{"sha1":"A3:04:43:DF:E7:27:A9:50:C2:BB:1F:85:9F:88:08:C5:EC:23:CE:9C","sha256":"0A:4A:19:47:D5:5B:1B:87:C8:B1:25:95:05:A5:F0:D5:1F:A1:A0:DE:36:53:90:85:15:21:1A:64:2B:18:4B:F0"}}},"request":{"raw":"GET /match/3038/?remote_uid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c HTTP/1.1\r\nHost: s.uuidksinc.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: jcsuuid=eyhRfrEUI7ExW56HvDWe\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.23.2\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 74\r\naccess-control-allow-headers: X-Requested-With, Cache-Control, Content-Type\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\nset-cookie: jcsuuid=eyhRfrEUI7ExW56HvDWe; expires=Mon, 22 Feb 2027 09:36:09 GMT; domain=uuidksinc.net; path=/; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.23.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced","md5":"9e24e19b024c44b778301d880bd8e6f4","sha1":"d2b1b39cb4434d34c22c2cf52cbbe9967b1b688e","sha256":"01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb","sha512":"4957e24a00b7ff54b350c33392560937e69ee5accf2e439781e27b4ac506eeeddef3bebd5d911185add175d648f4636dc5116e311b9c6c6ed34b842153e0b124","ssdeep":"","tlshash":"1ba022e22380fcbccc220033002003b0ceb0802808208e0f0c2c8c3a0800a0880cc383","first_seen":"2023-04-06T20:02:01Z","last_seen":"2026-04-04T21:36:05.148262Z","times_seen":6214,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":38,"dns":1,"connect":18,"send":0,"wait":24,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad-eu-bid.veonadx.com/match/wizadsbanner?id=ed08c16a-0632-6950-0b8a-67c2e22a5be1\u0026otcm_check=1771752954","fqdn":"ad-eu-bid.veonadx.com","domain":"veonadx.com","tld":"com"},"ip":{"addr":"88.211.224.220","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.veonadx.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R6 AlphaSSL CA 2023","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 24 Mar 2025 02:42:59 GMT","end":"Sat, 25 Apr 2026 02:42:58 GMT"},"fingerprint":{"sha1":"50:C5:5A:F2:E2:90:B4:1C:A4:9E:7F:B9:FC:02:BC:C4:53:DB:19:AE","sha256":"A3:D5:81:6A:A2:7D:32:EC:B9:D8:89:1B:21:DF:F0:36:DA:70:D7:B0:28:F8:5C:76:85:DD:8F:00:4B:3B:27:E6"}}},"request":{"raw":"GET /match/wizadsbanner?id=ed08c16a-0632-6950-0b8a-67c2e22a5be1\u0026otcm_check=1771752954 HTTP/1.1\r\nHost: ad-eu-bid.veonadx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: mpid=Njk5YWNkZmE2NDY4MjllYw==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx/1.27.1\r\nDate: Sun, 22 Feb 2026 09:35:54 GMT\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nSet-Cookie: mpid=Njk5YWNkZmE2NDY4MjllYw==; Path=/; Domain=veonadx.com; Max-Age=31536000; Secure; SameSite=None\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.27.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sync.vqserve.com/match/stream?tid=d6dcruisp4jq8tsvsuc0\u0026rid=BHjoFMmspYBR5WjtJZXygGD24s","fqdn":"sync.vqserve.com","domain":"vqserve.com","tld":"com"},"ip":{"addr":"77.223.121.118","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vqserve.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R6 AlphaSSL CA 2025","organization":"GlobalSign nv-sa"},"validity":{"start":"Thu, 09 Oct 2025 14:40:31 GMT","end":"Tue, 10 Nov 2026 14:40:30 GMT"},"fingerprint":{"sha1":"A4:92:98:C8:27:24:5D:7F:47:C2:95:B7:EA:29:80:E9:84:20:4C:CE","sha256":"89:89:8A:AA:8C:19:7D:FA:1B:28:C0:47:CA:04:E7:8E:56:63:49:DD:96:1D:20:94:92:1D:1C:BD:95:E9:99:FF"}}},"request":{"raw":"GET /match/stream?tid=d6dcruisp4jq8tsvsuc0\u0026rid=BHjoFMmspYBR5WjtJZXygGD24s HTTP/1.1\r\nHost: sync.vqserve.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: rid=BHjoFMmspYBR5WjtJZXygGD24s\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx/1.29.3\r\nDate: Sun, 22 Feb 2026 09:35:54 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: https://mc.acint.net/match?dp=450\u0026euid=BHjoFMmspYBR5WjtJZXygGD24s\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.29.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/cache/fonts/1/google-fonts/css/d/d/4/11e72c6eb2f90d0c0cb8fe1651263.css","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.644Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/cache/fonts/1/google-fonts/css/d/d/4/11e72c6eb2f90d0c0cb8fe1651263.css HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sat, 21 Feb 2026 18:47:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6999fdae-7369\"\r\nexpires: Sun, 22 Feb 2026 13:23:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 29553\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HrlwYj6UWRvJ3jUA39cazWFjjLc6mOR08nwD7xa28bUeN20eFXRZwQRP96ET7OnB37P8KFPYfzZDO9q70xMqEcFN0ARvQcSgdQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef1faf5902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29545,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1572)","md5":"f01de92fbafedabd33e8f941551d077d","sha1":"29f92752ff57f5c9b4a80ff008ca32db401fd60a","sha256":"4ccfed0eb3420069e8766bda56db7a095568b258ecb91fdcba05a456b0a1560b","sha512":"150e5f62348cbd921a550f12962077aca780e66269fcd884e251008c11d3c2c195c0d021e48797446c9768a4dc949ab2b2233320f075af48b61fcd133a23704f","ssdeep":"384:+fOxkgyl/qY4P5Z+fNKXbym/qY4cySTfIfCGy7/qY4hHn5fC1I8yh/qY479dPfsa:QZ7ut3SVqTx","tlshash":"6bd232a10407010097938ce633c97f35fd5e92087142d2b9abfc572baedbc5553a93ae","first_seen":"2026-02-22T09:36:24.930864Z","last_seen":"2026-04-04T12:24:21.45717Z","times_seen":2,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.uuidksinc.net/match/3038/?remote_uid=8162a005-63a0-8bfc-57db-b0b1cd0b84d3","fqdn":"s.uuidksinc.net","domain":"uuidksinc.net","tld":"net"},"ip":{"addr":"31.220.27.155","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.749Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uuidksinc.net","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 23:22:16 GMT","end":"Sat, 28 Mar 2026 23:22:15 GMT"},"fingerprint":{"sha1":"A3:04:43:DF:E7:27:A9:50:C2:BB:1F:85:9F:88:08:C5:EC:23:CE:9C","sha256":"0A:4A:19:47:D5:5B:1B:87:C8:B1:25:95:05:A5:F0:D5:1F:A1:A0:DE:36:53:90:85:15:21:1A:64:2B:18:4B:F0"}}},"request":{"raw":"GET /match/3038/?remote_uid=8162a005-63a0-8bfc-57db-b0b1cd0b84d3 HTTP/1.1\r\nHost: s.uuidksinc.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.23.2\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-type: image/png\r\ncontent-length: 74\r\naccess-control-allow-headers: X-Requested-With, Cache-Control, Content-Type\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\nset-cookie: jcsuuid=eyhRfrEUI7ExW56HvDWe; expires=Mon, 22 Feb 2027 09:35:54 GMT; domain=uuidksinc.net; path=/; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.23.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced","md5":"9e24e19b024c44b778301d880bd8e6f4","sha1":"d2b1b39cb4434d34c22c2cf52cbbe9967b1b688e","sha256":"01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb","sha512":"4957e24a00b7ff54b350c33392560937e69ee5accf2e439781e27b4ac506eeeddef3bebd5d911185add175d648f4636dc5116e311b9c6c6ed34b842153e0b124","ssdeep":"","tlshash":"1ba022e22380fcbccc220033002003b0ceb0802808208e0f0c2c8c3a0800a0880cc383","first_seen":"2023-04-06T20:02:01Z","last_seen":"2026-04-04T21:36:05.148262Z","times_seen":6214,"resource_available":true,"data":null}},"time_used":129,"timings":{"blocked":55,"dns":11,"connect":17,"send":0,"wait":17,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"logger.21wiz.com/logger?v=e379f03305e679091e67a2347ff53d50\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026t=player_init\u0026a=\u0026m=%7B%22vis%22%3A100%2C%22dv%22%3Atrue%2C%22jmap%22%3A13%2C%22blen%22%3A1%2C%22bounds%22%3A%7B%22x%22%3A0%2C%22y%22%3A0%2C%22width%22%3A480%2C%22height%22%3A305%2C%22top%22%3A0%2C%22right%22%3A480%2C%22bottom%22%3A305%2C%22left%22%3A0%7D%7D\u0026o=\u0026s2=2","fqdn":"logger.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /logger?v=e379f03305e679091e67a2347ff53d50\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026t=player_init\u0026a=\u0026m=%7B%22vis%22%3A100%2C%22dv%22%3Atrue%2C%22jmap%22%3A13%2C%22blen%22%3A1%2C%22bounds%22%3A%7B%22x%22%3A0%2C%22y%22%3A0%2C%22width%22%3A480%2C%22height%22%3A305%2C%22top%22%3A0%2C%22right%22%3A480%2C%22bottom%22%3A305%2C%22left%22%3A0%7D%7D\u0026o=\u0026s2=2 HTTP/1.1\r\nHost: logger.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\npriority: u=4,i=?0\r\nx-logger-tdb: wizads\r\nx-movieads-country: NO\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GFobvzTcrEEwb0sO%2FT96RT9xMFuLZXb8h83cRvPsnQxnYFEGlY%2FGxx%2Fi4hXBITLdFY7%2BxLzpwGgdZsM1pOz%2BjlVJOtKASsm73FKuGRknln8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7f048bd2723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=veon_bn_snc\u0026rnd=1771752954","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.647Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=veon_bn_snc\u0026rnd=1771752954 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-length: 0\r\nlocation: https://ad-eu-bid.veonadx.com/match/wizadsbanner?id=ed08c16a-0632-6950-0b8a-67c2e22a5be1\r\nset-cookie: sky_uuid=ed08c16a-0632-6950-0b8a-67c2e22a5be1; max-age=157680000; path=/; HttpOnly; secure; SameSite=None\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.236:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"logger.21wiz.com/logger?v=e379f03305e679091e67a2347ff53d50\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026t=player_init\u0026a=\u0026m=%7B%22vis%22%3A100%2C%22dv%22%3Atrue%2C%22jmap%22%3A13%2C%22blen%22%3A1%2C%22bounds%22%3A%7B%22x%22%3A0%2C%22y%22%3A0%2C%22width%22%3A480%2C%22height%22%3A305%2C%22top%22%3A0%2C%22right%22%3A480%2C%22bottom%22%3A305%2C%22left%22%3A0%7D%7D\u0026o=\u0026s2=1","fqdn":"logger.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.855Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /logger?v=e379f03305e679091e67a2347ff53d50\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026t=player_init\u0026a=\u0026m=%7B%22vis%22%3A100%2C%22dv%22%3Atrue%2C%22jmap%22%3A13%2C%22blen%22%3A1%2C%22bounds%22%3A%7B%22x%22%3A0%2C%22y%22%3A0%2C%22width%22%3A480%2C%22height%22%3A305%2C%22top%22%3A0%2C%22right%22%3A480%2C%22bottom%22%3A305%2C%22left%22%3A0%7D%7D\u0026o=\u0026s2=1 HTTP/1.1\r\nHost: logger.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\npriority: u=4,i=?0\r\nx-logger-tdb: wizads\r\nx-movieads-country: NO\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J78yS5yhedmGo3A94mvdKL52nEPFqdZQlpIaQRasMe4JX5wjuQwot2L7Gav%2BvQTYJpTRoFzJtiMnHvdonkUbyhe2lR%2BPPYM6fUtOu9NLfl4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7f5d9c93723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/cache/min/1/wp-content/themes/cronos-design/assets/css/episodio.css?ver=1769967648","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/cache/min/1/wp-content/themes/cronos-design/assets/css/episodio.css?ver=1769967648 HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sun, 01 Feb 2026 17:40:48 GMT\r\nvary: Accept-Encoding\r\netag: \"697f9020-1e75\"\r\nexpires: Sun, 22 Feb 2026 16:49:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 17168\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bAyjUrP%2Bz9rTM4m9IkvKkmB3CqDbntLFZY0FnBh7vzP7kPrLBebIcwd4Wbj8Z1Kv50WqY9U1%2BhE0t7GgUYZhejb9YRHFeZ9mww%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef1fb17902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7797,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (7797), with no line terminators","md5":"1183705bab88ec29b24a88877f3570a9","sha1":"1e3a43a53dffd0a29721112d176ddd2008091db4","sha256":"dc026456e5b9c18f3e6d712afc9e3c134dac66114779a54a391166543bca9b12","sha512":"0a8ff052ba62efee942618c4f817038406fb000a90d81935f66fa3260dbb0d220032e028474f291659cce14b92ffa811ad846bf3c6ae1143439ba7055bbf5f73","ssdeep":"96:Mzzjp3oacoNbpgg7Xr1BYxfzDCbhQOHmQX0kgpBueVvd7+z:Mzzjp3oavpfpByff+hQOHmQX0kgpBaz","tlshash":"1df18233b154713c90a35296a8e1b2bc223cc081e7262feef558bb7d87ae0c757b5491","first_seen":"2025-12-11T01:54:40.461819Z","last_seen":"2026-02-22T09:36:24.931749Z","times_seen":17,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-includes/css/dist/block-library/style.min.css?ver=6.3.7","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.645Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-includes/css/dist/block-library/style.min.css?ver=6.3.7 HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Tue, 08 Aug 2023 22:43:32 GMT\r\nvary: Accept-Encoding\r\netag: \"64d2c514-19824\"\r\nexpires: Sun, 22 Feb 2026 16:49:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 17168\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BkyAfO%2BEX3J7VZragF9YKfcNsSrRpRcqeoRVhUj5eOPMSoBHTgIIlMLlPcEZQf8adFmWnbmDYq8AoCS3Q7pDCSP%2FHv55qT9Rxw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef1fafa902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":104484,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (53449)","md5":"03c0f2128c8dd615b1691c168f1d4456","sha1":"defa44bed1f35ec899cfd358ca911390bca53e67","sha256":"67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694","sha512":"01485475aec2d490e75dc76aea6e011541edcff527e85a773644accf101175b619e10b4d3a5cdb5926669559782bc33df483fe9cc3de9d3431e08123ce5d0853","ssdeep":"1536:6LeJFfvhk2u5SOV+UQ3Zo/xHHbweEEQze:6LeJjk2u5SOV+UQ3Zo/xH7weTQze","tlshash":"bda3505413b0dcf939ffa73a5e5ee248a513aa41c64a9be7e076d190614ca490cf3b0f","first_seen":"2023-08-08T23:54:07Z","last_seen":"2026-04-04T21:34:01.284547Z","times_seen":16658,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"logger.21wiz.com/logger?t=cdiv\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=51\u0026v=e379f03305e679091e67a2347ff53d50\u0026o=","fqdn":"logger.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /logger?t=cdiv\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=51\u0026v=e379f03305e679091e67a2347ff53d50\u0026o= HTTP/1.1\r\nHost: logger.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\npriority: u=4,i=?0\r\nx-logger-tdb: wizads\r\nx-movieads-country: NO\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3aJCMJZD7R58hLFiSAb5CtHzNY1UPr6Tldbn0N0NxAxXR7XGHiXxJg%2FCJNNYM3sks1F58VkafIwDEwzHXOyoGxGTlp%2BjRdAv6ybIJFxtXqY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7efe3af2723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=bdgfg34_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=6bb7bba3-a76c-762f-e127-9a499b4a79ee","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.624Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=bdgfg34_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=6bb7bba3-a76c-762f-e127-9a499b4a79ee HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1569\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sync.vqserve.com/match/stream","fqdn":"sync.vqserve.com","domain":"vqserve.com","tld":"com"},"ip":{"addr":"77.223.121.118","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.676Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vqserve.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R6 AlphaSSL CA 2025","organization":"GlobalSign nv-sa"},"validity":{"start":"Thu, 09 Oct 2025 14:40:31 GMT","end":"Tue, 10 Nov 2026 14:40:30 GMT"},"fingerprint":{"sha1":"A4:92:98:C8:27:24:5D:7F:47:C2:95:B7:EA:29:80:E9:84:20:4C:CE","sha256":"89:89:8A:AA:8C:19:7D:FA:1B:28:C0:47:CA:04:E7:8E:56:63:49:DD:96:1D:20:94:92:1D:1C:BD:95:E9:99:FF"}}},"request":{"raw":"GET /match/stream HTTP/1.1\r\nHost: sync.vqserve.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx/1.29.3\r\nDate: Sun, 22 Feb 2026 09:35:54 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: http://sync.vqserve.com/match/stream?tid=d6dcruisp4jq8tsvsuc0\u0026rid=BHjoFMmspYBR5WjtJZXygGD24s\r\nSet-Cookie: rid=BHjoFMmspYBR5WjtJZXygGD24s; expires=Wed, 25 Mar 2026 09:35:54 GMT; domain=vqserve.com; path=/; HttpOnly; secure; SameSite=None\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.29.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":358,"timings":{"blocked":155,"dns":25,"connect":30,"send":0,"wait":30,"receive":0,"ssl":115},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"logger.21wiz.com/logger?t=player_frame_loaded_new\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=0\u0026v=e379f03305e679091e67a2347ff53d50\u0026o=","fqdn":"logger.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /logger?t=player_frame_loaded_new\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=0\u0026v=e379f03305e679091e67a2347ff53d50\u0026o= HTTP/1.1\r\nHost: logger.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\npriority: u=4,i=?0\r\nx-logger-tdb: wizads\r\nx-movieads-country: NO\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DE4MfFQu1k3wBujkg1dJjx7h1tZqICUoImP19wDs59lS75MDMNUuLSgRyzMwFhJDV5uiQy9sbXMHcI78oi8bNmdLCEyLHLIaPjeTaid8hiY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7efe7aff723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=strn_snc_2\u0026rnd=1771752968","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=strn_snc_2\u0026rnd=1771752968 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:08 GMT\r\ncontent-length: 0\r\nlocation: https://us.shb-sync.com/87d04d89-acd3-4a7c-9fe9-df65db01461a.gif?puid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026redir=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dstrn_snc_2%26bid%3D%24%7Buuid%7D\u0026gdpr={gdpr_exist}\u0026gdpr_consent={gdpr_string}\u0026ccpa=\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.165:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us.shb-sync.com/87d04d89-acd3-4a7c-9fe9-df65db01461a.gif?puid=bb650636-b376-e594-e723-3de11b0cecfb\u0026redir=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dstrn_snc_2%26bid%3D%24%7Buuid%7D\u0026gdpr={gdpr_exist}\u0026gdpr_consent={gdpr_string}\u0026ccpa=","fqdn":"us.shb-sync.com","domain":"shb-sync.com","tld":"com"},"ip":{"addr":"8.2.110.33","port":443,"asn":46636,"as":"NATCOWEB","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.747Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.shb-sync.com","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Wed, 12 Mar 2025 13:55:50 GMT","end":"Thu, 12 Mar 2026 12:58:04 GMT"},"fingerprint":{"sha1":"BE:FE:32:25:E7:53:23:5B:09:3B:71:13:34:E3:2E:96:7C:B6:60:7B","sha256":"CD:30:48:AC:8A:1C:79:81:9F:5B:4C:2E:36:03:87:94:03:00:AB:BC:EF:CD:1A:27:4F:50:E4:86:2F:9A:D9:7D"}}},"request":{"raw":"GET /87d04d89-acd3-4a7c-9fe9-df65db01461a.gif?puid=bb650636-b376-e594-e723-3de11b0cecfb\u0026redir=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dstrn_snc_2%26bid%3D%24%7Buuid%7D\u0026gdpr={gdpr_exist}\u0026gdpr_consent={gdpr_string}\u0026ccpa= HTTP/1.1\r\nHost: us.shb-sync.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx\r\nDate: Sun, 22 Feb 2026 09:35:55 GMT\r\nConnection: keep-alive\r\nSet-Cookie: smart_usr=c53bcfd7-ba76-476a-94d7-89a9ff317fd5; path=/; domain=.shb-sync.com; expires=Sun, 13 Sep 2026 09:35:55 GMT;SameSite=None;Secure\nsmart_r=36062; path=/; domain=.shb-sync.com; expires=Sun, 13 Sep 2026 09:35:55 GMT;SameSite=None;Secure\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nExpires: 0\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":690,"timings":{"blocked":297,"dns":10,"connect":88,"send":0,"wait":92,"receive":0,"ssl":200},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"e7cod.com/wrr?z=8033056\u0026p_rid=84931971-1a41-4f61-94ba-f4eb98b5718d\u0026rb=HneAUlrtia1-0Q4h9o97HIci7vZUCnWq6OPz62FwdJzaACbcL6xCt8ii2ZBbOI9Ep8jZA6kZ6oHWZJH1AJcaeodF-D9Zc38CQ6hAhNrK714xqqwE7B6QV3mDyLzs3AyltWJKLfO3UHpv6TFdFkUI5etDhWBu3TSzPY5AgaHwlfJ07dmllfYi2rZ4OBOp7mPgJg1NHOvcPnT4GMmQTE4Nf1F7jHKstoVJVpzeZVmNPB6hUu1ulKQ3dk9vKP0lRrAh8Wl8hLTEnMc3X3941KFgu5Y4tJ2w-nkJbS_Sag==\u0026dmn=e7cod.com\u0026userId=0082e578a8bb4baae83c101d6d8036fc\u0026tspl=1316\u0026cslt=61","fqdn":"e7cod.com","domain":"e7cod.com","tld":"com"},"ip":{"addr":"139.45.197.233","port":443,"asn":9002,"as":"RETN Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.367Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e7cod.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Dec 2025 06:11:13 GMT","end":"Mon, 09 Mar 2026 06:11:12 GMT"},"fingerprint":{"sha1":"E1:3E:8E:13:F8:CC:FC:0E:0E:77:77:99:F6:A9:A9:84:D8:7F:C1:C2","sha256":"92:21:C3:31:91:DB:58:BC:FB:3F:B5:6A:7B:02:EF:B3:44:1C:76:01:56:DF:A3:00:0E:B5:98:72:97:00:8C:7A"}}},"request":{"raw":"POST /wrr?z=8033056\u0026p_rid=84931971-1a41-4f61-94ba-f4eb98b5718d\u0026rb=HneAUlrtia1-0Q4h9o97HIci7vZUCnWq6OPz62FwdJzaACbcL6xCt8ii2ZBbOI9Ep8jZA6kZ6oHWZJH1AJcaeodF-D9Zc38CQ6hAhNrK714xqqwE7B6QV3mDyLzs3AyltWJKLfO3UHpv6TFdFkUI5etDhWBu3TSzPY5AgaHwlfJ07dmllfYi2rZ4OBOp7mPgJg1NHOvcPnT4GMmQTE4Nf1F7jHKstoVJVpzeZVmNPB6hUu1ulKQ3dk9vKP0lRrAh8Wl8hLTEnMc3X3941KFgu5Y4tJ2w-nkJbS_Sag==\u0026dmn=e7cod.com\u0026userId=0082e578a8bb4baae83c101d6d8036fc\u0026tspl=1316\u0026cslt=61 HTTP/1.1\r\nHost: e7cod.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/json\r\nContent-Length: 3374\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: OAID=0082e578a8bb4baae83c101d6d8036fc; oaidts=1771752953\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":3374,"data":"{\"sync\":\"TBtSUh8cJhwUBWcfHEsSAwEFUA5MXwMBbAIlKz9KWUBcHAtKQ1AVSQZbGgxbGwkEVkYLASoQTktDDVBGTBkCRExXBAEfFA4eFkpPUhRLDk4+HQY0BV0ZMkBQW2kNHCYfDD1RESZOBwkxGBNcMR5fZkBBJRcYHyoBTzYaUUNQX0dQQB0yU1xHUxkQHAxXWAhFW1MSHw9JSARCT1lJbEYeRkNZWUBQABUbW1tCSQddCk8NCB8UHhYfSk9TFEsJVUNQXkdQWglPDQkfFA4eW1JEVRRLF1tDUF5HUFoPHRUDAxpYFA1KT1IUSxxPAAZMUUMYTAVUGwkHVkYdBVdYCEVbSxUeTFFDGEwOX2ZcVBBGQ1hZQFYeJk4FSFRbXhYBHlRJRhRAVVVKHQtcDRxXQ1BeR1BXBjJYW1lpEwodDQ1AAllVGxYDADQZURceaFVWWB0QEUpPUBRLGlYNBRw0FlEeGV8bCQZWRg8NGwZXG1sDUUZMDBNZCx1WXUAUQFVVShsOZwcVSkNQXkdQVwEBWEtsURsJDBxXWApFW0kHBkxRQhhMDkRQEQxKSFsLGRYaU0kVQwAdG1AOXkEVSV1CWF5IRFcSVhsaG1taQkkCWA8ZUVZBWyUAHBwQAUwGCxtbW19HUFoLHhUDAAAHSFsaHEACSxVVFwceAgJRTEEVS0UUQEY0DQYDGkVbSxEaTFFBGEwZTVYRDEpIWx8CQAJYSwFRRkwcGhZUXAcLBxpYExAfV1gJW0EJTUgZAhoWVFwHCwcaWBMBSk9SFEsOQENQXkdQXRZPDQkfFA0CGkpPUBRLClgJSFRaQgZaQRVKWxRAVUlaQU4aGg4bW1tcU0IYTB5WThEMS1ZBWFlATBomXQQeCwgGUQpPDQkfFBAXDAlXWBokFkMIBgIKXQFAXRcRZF8UABYfBkJ2PVkIUUReUFJjBwMBDQgWAlJNU1UQTlNIClVEXkJScwsOXFYcBEpVSVhEUglJP1ATDwgEChtfXgMXAxRWRhcYV1gJRVtJBUhUSRtaGghFV1JaVxQdDlgUUQwOXBNQBxgifVUEWU1WRBQFFUUFBl5ED1AEHQsZSF0dPX4CWlgOAQsGFA4VGR1fTBwHDgVRHFdeSmN/QQ0XHBAQVggVFBEOCEYEXQsaUksJXwk0MFMcDEwMC1cABkMbFlJDG15cRFMIXhAbJSsDS1UbCQMCSUgFQk9CUFcUQAoMBBlOGg0LX0NQTEleFh4BFQMRXg4QCRtPTRcOFkAACBtFG1tBWQcNCw5YSFsGEkACWVUbFRBMUVBhOi4VFRFYGEZDWVlAVggJG1tIOQIcB1xPGxtDQlheSURXB04IFRtbWVlHUFwNTw0NCxpYABRKT08JRVtLFR5MUV8FQk9UUWxZGA5bUkVOGgcOG1tbQkkFUExXUVhfRR9IWwcGAUgcWwNDJgcFB0xOFQ8PbABORlVKHQtcDRxXQ1AICh5HC0EVWltpFQYTNxwMXAwBG1tHX0dQQwcDaFJWTwk7FQ0bBUwBWwNTXl1HUFcBAVhLbFIfFA0AV1gKXVUbFw8ADx1GTFcVGx8UHQUUDQUDXBpbA1FGTAUeFlRPUlceYylGVUobDktLQxsEBEM+IRgLAxUVEVUVCBYaKgVZBAxNQ1BMGABTDE8bG0NQFkZDSldOGgoVTUNQFRZeFgQeRxsJB1ZGCQYBQAJZVRsRBBwIUA5eQRVJX1cOAhYaGD1cDA1cAh4BGVAOFU9eSmxXFAALBxwGGlMfWA0ZC0dQXR0yQ0taUh8KDUpPBFkFClxNSAcYLVcGH1hUWkMXO0FeKg1KNhdcFg8cSUhSDwFEXB8UExcmCx0QVwQQTAxIVA0TWB0IGxtaRSUBHQ8QQAIPGFUSD0JJG0cxClJaWFlYXg0aAAcUSxBKPh0LCS1fBxkVA1VXFhccRFcLSzYOXAM1BQIGa1hdAWZcRCUKHB8QEBpTH1gNGQtHUF0dMlNcQF0OCwk3BgNeCAtQQ1AICh5HC0EVUEBpGQwLBxgLTQQmVhEPHApQDggMW0pWS1ZGFw0GQAJLSw1YXlxdRgddXBUVEVUWDRwGAT1RDVsDQx8AABxbGQMVFRFXHAIQBBwDTAwmUAVIVElQGEwZRVhVUBMHJhsaF0oKHGYIDkxRUBZCT1ZdRVMIEBAbEBBnAB0bW0hMR1BXDwBHWFpRFDsQDFdYGktVGwIfHR8dWTEEU2YCFEBGW0RXAU0aDVYMNQcPLQZMVxUbHxQZCBALHj1RDVsDQ0hCSRFbHRkVAxEUVkYUDQEKVw1bA0MAHR8TU0xBFUtsQxMAW1JXQBRLFlg+AwpJSBZMQRVYV1ITEBAHGwNUNhBdEkhUMC9J\",\"async\":\"TBtXQwgXW1IOQFoIDRtbW0JJGl0AGUQbCQRWRhsEAQoaU0gVQwIHDxZRADJeX0FXFwFbUkdTFEsNVhULAklIBlwQGxtRVw5GQxNXC0s2G1gVSFRbXhYNBVZLVF8UA1tSRU4aChFYEw0HBRVrGgRaXBEMSkhbDBwRWwEYSwYDAAwtQAcAUhsJBlZGFQ0DB1RLQwkcRkwDG1oaHhUDSEtWRhsEAQoaUwIbEh8eGx1GGghTGwlQGwgKDVlAWR8YUA0LDAcXFlQLVlVAU1ZGCw0UEVcHWwNDBAFGHFUYBFBYR1kISRsEAAdMBhZNCUgTR1BcBwlTXF1pEwILCRgHGlNJFUMJAgIXWhoyXl0RDFgRFwMbDU8HWxVDCwgNG1gHDENcbF8eRkNKV04aHQtYBwwHCC1HARhFWlZpEwBbUldAFEsYXRcPHB8bRwsfaFBXFEBGW0RXAVkECVgIDQA0G1BMVxUbHxQZEQocGg9nAB1mUEhUSVAYTA5CSkdZFzsQDCpQGlNbG01IDQcbVwUyXl0RDFhGVUoWDUsdWwNDSEJJH1EaBVhdEQxYDgocFAUaRVtLPh8HD1AOTE8bG1xXJQ0dSk9AGkVbWAUOBx8bWwAMW2ZaUglGQzMoHw==\",\"quality_options\":{\"hil\":1,\"jsp\":1,\"ng\":false,\"ix\":false,\"pt\":false,\"np\":true,\"nw\":true,\"nb\":true,\"sw\":1280,\"sh\":1024,\"pl\":\"https://goyabu.io/40488\",\"wy\":0,\"wx\":0,\"ww\":1280,\"wh\":1024,\"cw\":1280,\"wiw\":1280,\"wih\":1024,\"wfc\":3,\"sah\":1024,\"navlng\":\"en-US\",\"drf\":\"\",\"wgl\":\"llvmpipe\",\"tb\":false,\"btz\":\"UTC\",\"bto\":0,\"pnt\":0,\"pnrc\":0,\"bml\":0,\"bmi\":false,\"vsbl\":true},\"client_hints\":{}}"}},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\naccept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version\r\naccess-control-allow-origin: https://goyabu.io\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon\r\naccess-control-max-age: 86400\r\npragma: no-cache\r\ncache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0\r\nexpires: Tue, 11 Jan 1994 10:00:00 GMT\r\nstrict-transport-security: max-age=1\r\nx-content-type-options: nosniff\r\ntiming-allow-origin: *, *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-21","alert":"Sinkholed","trigger":"e7cod.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/bmap?v=e379f03305e679091e67a2347ff53d50\u0026sub_id=ap\u0026fmt_id=4\u0026pl_key=banner\u0026testad=no\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026tanc=\u0026ancs=\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026frnd=yes\u0026rel=true\u0026rnd=1771752966784\u0026cnt=1","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:07.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/bmap?v=e379f03305e679091e67a2347ff53d50\u0026sub_id=ap\u0026fmt_id=4\u0026pl_key=banner\u0026testad=no\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026tanc=\u0026ancs=\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026frnd=yes\u0026rel=true\u0026rnd=1771752966784\u0026cnt=1 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:07 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-udata: cache,parsed,5785\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.195:9009\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":76486,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"3a86014a2087c7fedad56a56944a261a","sha1":"78bce555aec4df9fc312a84105494733a6f3e955","sha256":"7a234d1b6102510325bc6a41ccacef75c865cdae2aa7176f3713cee2a2e1381d","sha512":"2f63cd3a22a3e2f5fa354d3485a5fe1c4d1c1e4c94a54471cec16e9c2142f752e94e6a309a9650e92f60470d51731182345ece9961b41d4db4d0a394ffd83fd1","ssdeep":"1536:I1tIbWgT/QeIjcuYdfCTbsn9uf03632whpoGRbBdQJA8fH2Ab4:4SbWYW3owB4U","tlshash":"967319c91290f2b568a951f7b93b71e9d3247876210d159ef0089e70b6ec67ffb2c428","first_seen":"2026-02-22T09:36:24.932681Z","last_seen":"2026-02-22T09:36:24.932681Z","times_seen":1,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ad-eu-bid.veonadx.com/match/wizadsbanner?id=6b1dd97a-1ec0-35bd-2c34-a428f41d652c","fqdn":"ad-eu-bid.veonadx.com","domain":"veonadx.com","tld":"com"},"ip":{"addr":"88.211.224.212","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.veonadx.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R6 AlphaSSL CA 2023","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 24 Mar 2025 02:42:59 GMT","end":"Sat, 25 Apr 2026 02:42:58 GMT"},"fingerprint":{"sha1":"50:C5:5A:F2:E2:90:B4:1C:A4:9E:7F:B9:FC:02:BC:C4:53:DB:19:AE","sha256":"A3:D5:81:6A:A2:7D:32:EC:B9:D8:89:1B:21:DF:F0:36:DA:70:D7:B0:28:F8:5C:76:85:DD:8F:00:4B:3B:27:E6"}}},"request":{"raw":"GET /match/wizadsbanner?id=6b1dd97a-1ec0-35bd-2c34-a428f41d652c HTTP/1.1\r\nHost: ad-eu-bid.veonadx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: mpid=Njk5YWNkZmE2NDY4MjllYw==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx/1.27.1\r\nDate: Sun, 22 Feb 2026 09:36:09 GMT\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nSet-Cookie: mpid=Njk5YWNkZmE2NDY4MjllYw==; Path=/; Domain=veonadx.com; Max-Age=31536000; Secure; SameSite=None\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.27.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":132,"timings":{"blocked":44,"dns":1,"connect":24,"send":0,"wait":26,"receive":1,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cpscvonbgxn.com/","fqdn":"cpscvonbgxn.com","domain":"cpscvonbgxn.com","tld":"com"},"ip":{"addr":"139.45.197.101","port":443,"asn":9002,"as":"RETN Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:53.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cpscvonbgxn.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 11:04:55 GMT","end":"Fri, 22 May 2026 11:04:54 GMT"},"fingerprint":{"sha1":"89:D2:5F:8C:56:51:E1:79:79:40:65:53:B0:1B:F8:AD:3F:0A:65:A0","sha256":"3F:21:B9:68:60:E0:DA:C8:A6:96:94:0A:33:25:59:D0:9C:AC:E1:9D:BF:F9:7A:1E:DF:2F:EA:A7:F6:DF:AC:F1"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: cpscvonbgxn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: HEAD\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://goyabu.io/\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:53 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 0\r\naccess-control-allow-origin: https://goyabu.io\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid\r\naccess-control-max-age: 86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":95,"dns":11,"connect":26,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=push_v_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=ae3414c5-d3f5-c764-c32d-2838cf4a7657","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=push_v_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=ae3414c5-d3f5-c764-c32d-2838cf4a7657 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,2950\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=tfmg\u0026rnd=1771752968","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.898Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=tfmg\u0026rnd=1771752968 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:08 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 0\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.238:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/jmap?v=e379f03305e679091e67a2347ff53d50\u0026sid=ap\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026it=1\u0026tq=2\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026position=pre\u0026vt=100\u0026ostream=true\u0026isp=0\u0026suri=https%253A%252F%252Fgoyabu.io%252F40488\u0026rnd=1771752969815\u0026rel=true\u0026raw=yes\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/jmap?v=e379f03305e679091e67a2347ff53d50\u0026sid=ap\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026it=1\u0026tq=2\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026position=pre\u0026vt=100\u0026ostream=true\u0026isp=0\u0026suri=https%253A%252F%252Fgoyabu.io%252F40488\u0026rnd=1771752969815\u0026rel=true\u0026raw=yes\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-go-country: NO\r\nx-wizads-udata: cache,parsed,1119\r\nx-wizads-plc: 0\r\nx-wizads-ark: true\r\nx-wizads-qmc: NO\r\nx-wizads-rdb: 2\r\nx-wizads-alc: 16\r\nx-wizads-ctvs: 16\r\nserver-timing: uData;dur=0.0000, buildTagsQueue;dur=0.0000, validations_1569;dur=0.0000, validations_1606;dur=0.0000, validations_1617;dur=0.0000, validations_1615;dur=0.0000, validations_1572;dur=0.0000, queuesMerge;dur=0.0000, corsParams;dur=0.0000, initBuilder;dur=0.0000, validations_1622;dur=0.0000, validations_1608;dur=0.0000, attachTracking;dur=0.0000, validations_1631;dur=0.0000, optProc;dur=0.0000, validations_1633;dur=0.0000, queueSort;dur=0.0000, getJson;dur=0.0000, wmData;dur=0.0000, getAnyQueue;dur=0.0000, validations_1619;dur=0.0000, validations_1599;dur=0.0000, jmapParams;dur=0.0000, qManager;dur=1.0000, keyValidation;dur=0.0000, getLinks;dur=0.0000, range_links;dur=0.0000, validations_1601;dur=0.0000, validations_1593;dur=0.0000\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.214:9009\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87625,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"7aebcb851afd503e9981a8fb7e7004bb","sha1":"a3c654ffe5ddc38ed4ce4eafd6066347d3e8c152","sha256":"ef9b465f3a1116684ce6b7de9ca379c72a05fee94766c9e772ae4aab7180f0f6","sha512":"75da8bcaea639bebe11ed69b09bd9ca82f52debc9d8315052a27ba6d3e7409623f39431898b9a787a7627931763f29bb060a30b84df08dff00c45f7d3005aaf1","ssdeep":"1536:31CnQu/p26N9sFChIQhx/hW2h3rYsoqRCQQp/u2P/xfdCiQb/82Vfkkw3C9Qk/jc:pB/f3fPb","tlshash":"2683545167fe3a25a4c0e48cceb0efa8c5e114a76c19007edbbd115837bcba6ae54d43","first_seen":"2026-02-22T09:36:24.933438Z","last_seen":"2026-02-22T09:36:24.933438Z","times_seen":1,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"a.utraff.com/sync?ssp=3769","fqdn":"a.utraff.com","domain":"utraff.com","tld":"com"},"ip":{"addr":"213.171.19.196","port":443,"asn":56694,"as":"LLC Smart Ape","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"utraff.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 04:18:06 GMT","end":"Tue, 12 May 2026 04:18:05 GMT"},"fingerprint":{"sha1":"6E:59:00:5C:35:4D:5D:47:54:80:11:04:57:DD:3C:51:C0:C7:53:47","sha256":"A5:37:11:50:6E:7F:44:6A:D8:F1:91:42:E2:D7:3C:BD:27:28:48:72:58:4D:3E:9C:75:6A:53:85:64:89:BE:20"}}},"request":{"raw":"GET /sync?ssp=3769 HTTP/1.1\r\nHost: a.utraff.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx/1.24.0\r\nDate: Sun, 22 Feb 2026 09:36:09 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\nConnection: keep-alive\r\nSet-Cookie: preutid=1; Expires=Tue, 24 Mar 2026 12:36:09 GMT; Domain=.ussp.io; SameSite=None; Secure; Path=/\npreutid=1; Expires=Tue, 24 Mar 2026 12:36:09 GMT; Domain=.utraff.com; SameSite=None; Secure; Path=/\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\nVary: Origin\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":316,"timings":{"blocked":114,"dns":12,"connect":46,"send":0,"wait":85,"receive":0,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"HEAD /40488 HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"HEAD"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 21 Feb 2026 18:55:31 GMT\r\nstrict-transport-security: max-age=31536000\r\npriority: u=3,i=?0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JBOZXQcQCptlxQBAJ6bOh4ADNoRHwipwKS%2FBLP7TfiJvWSLkXL1vcfOWTjbFWCaQLB1lqciGbuG3D1CxR%2BAiKif5b3GO%2BgAi%2Fw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d1d7ef2fd5f902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/mp_dist/mstream2.js?ver=13196771243","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.910Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /mp_dist/mstream2.js?ver=13196771243 HTTP/1.1\r\nHost: static.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:36:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 20 Feb 2026 09:56:12 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\netag: \"69982fbc-2a291\"\r\nx-movieads-country: NO\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-max-age: 1728000\r\ncontent-encoding: gzip\r\nage: 7040\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9Zc%2F8evR4j4ZglLzwwv7LXh7pMcSpPm3VI1g45aLsto6GjGf8%2BURdY9KV2S9U7QykjnflRNBSVSpxaFVF1DbAUzOwH88lBmAHPyboqc0ndc%3D\"}]}\r\ncf-ray: 9d1d7f579c17723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":172689,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65071), with no line terminators","md5":"3ba9ba11d0cb003dc53a4e043c157e90","sha1":"688a5b883b559bcd08866d401b1df12031d33c50","sha256":"83d83355f53f328ec023335d6606fb30c14c17ba114599e82ad5f694247978f6","sha512":"41747365aa4911c53c219a9156dc94f504b1a2f712a4b227e619a38f25dd3d740ba51770618aa49a5af1c004a4f07e1b7cf2e75366b656259285c61486ee4131","ssdeep":"3072:isttTVisVPmLoIOzB/PhCC4Jd4FlQs02HNUjg5rq3ZrU5C:ime+Xl3puKlT0MUjprUE","tlshash":"e0f36b761ac264712ba0c2d950780250de3e5a0e708347bcbd6cced7a859953b1bebfc","first_seen":"2026-02-20T12:02:07.192459Z","last_seen":"2026-02-24T08:18:14.718648Z","times_seen":12,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=udffot1y_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=d0c3a016-12bd-bbb2-717f-415f7eb81208","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=udffot1y_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=d0c3a016-12bd-bbb2-717f-415f7eb81208 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,56\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/pmap?v=e379f03305e679091e67a2347ff53d50\u0026sub_id=popunder\u0026fmt_id=7\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026w=1280\u0026h=1024\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:53.357Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/pmap?v=e379f03305e679091e67a2347ff53d50\u0026sub_id=popunder\u0026fmt_id=7\u0026r=https%3A%2F%2Fgoyabu.io%2F40488\u0026w=1280\u0026h=1024\u0026maid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:53 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-udata: cache,parsed,1419\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.164:9009\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58706,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (58616), with no line terminators","md5":"3acde1e14c088f569c48716b77475f73","sha1":"4794f87715c169fba0d541c53b37d375c377ceaa","sha256":"135a97778eeda040eff658b285d4462be1e0ae52dac675ace1da016142db722a","sha512":"77e02d1d9c20f8e1bdcecaa37c772adaf756396212c241f2361c9c19d7e3a7c91d6f3a082f1637977cc3404767e5de7e22a40f6f11f82f423c79fb365a87ff00","ssdeep":"768:W0LGQoYAoNc68rDJ4VbknBHtAfHAr79dNXW9PXY++CvcI+aLj0o/poxtUBxTtIYO:KQ5beVJek9zXW2+//LAiPghiHPizd","tlshash":"264385c422d1f0b15a7e16f7a91be4fdd22968bda18e0c5df00e5d92f8b523cf528429","first_seen":"2026-02-22T09:36:24.934272Z","last_seen":"2026-02-22T09:36:24.934272Z","times_seen":1,"resource_available":true,"data":null}},"time_used":151,"timings":{"blocked":66,"dns":8,"connect":17,"send":0,"wait":19,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=Adtou1ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=c3bda37f-c106-b89b-c008-55e69494ca19","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=Adtou1ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=c3bda37f-c106-b89b-c008-55e69494ca19 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1061\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sync.vqserve.com/match/stream","fqdn":"sync.vqserve.com","domain":"vqserve.com","tld":"com"},"ip":{"addr":"77.223.121.118","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vqserve.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R6 AlphaSSL CA 2025","organization":"GlobalSign nv-sa"},"validity":{"start":"Thu, 09 Oct 2025 14:40:31 GMT","end":"Tue, 10 Nov 2026 14:40:30 GMT"},"fingerprint":{"sha1":"A4:92:98:C8:27:24:5D:7F:47:C2:95:B7:EA:29:80:E9:84:20:4C:CE","sha256":"89:89:8A:AA:8C:19:7D:FA:1B:28:C0:47:CA:04:E7:8E:56:63:49:DD:96:1D:20:94:92:1D:1C:BD:95:E9:99:FF"}}},"request":{"raw":"GET /match/stream HTTP/1.1\r\nHost: sync.vqserve.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: rid=BHjoFMmspYBR5WjtJZXygGD24s\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx/1.29.3\r\nDate: Sun, 22 Feb 2026 09:36:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: http://sync.vqserve.com/match/stream?tid=d6dcs22sp4jq8tt2bphg\u0026rid=BHjoFMmspYBR5WjtJZXygGD24s\r\nSet-Cookie: rid=BHjoFMmspYBR5WjtJZXygGD24s; expires=Wed, 25 Mar 2026 09:36:08 GMT; domain=vqserve.com; path=/; HttpOnly; secure; SameSite=None\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.29.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/40488","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-22T09:35:52.292Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /40488 HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 21 Feb 2026 18:55:31 GMT\r\nstrict-transport-security: max-age=31536000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m3AT6bDNFpw98tbdwDsIZLsloelZ3uhNAdAUeMrJwZFVZJVKajtIS0ftCPm4o7fX8vefqBcfNHUiFDEoZW621gZxFbfwW5g44g%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9d1d7ef00dfbc3b8-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"WordPress:6.3.7","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Yoast SEO:22.0","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"WP Rocket","description":"WP Rocket is a caching and performance optimisation plugin to improve the loading speed of WordPress websites.","website":"https://wp-rocket.me","common_platform_enumeration":"","icon":"WP Rocket.png","categories":["Caching","WordPress plugins"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":227089,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (24155)","md5":"afeffaf7556eef997ff51010d89ff08f","sha1":"137ad1cac36b1f2e562c704a7bdcde755c5a5244","sha256":"2f1d8c1156c2949b39acda60e78f8f2fe27ff7ea8854924d7fa652db08300a81","sha512":"35d2b7372d16797de2e01301f3d1c0912b9adea345c4c4b4865e27810e0a5f52367dd68baa4247808b594395aac3bfe9cad5dc3b4d250f6c7700fe61f80f979f","ssdeep":"3072:zMalUAeC7eB7MKV6uNMjIQbbmKYEjFuer61FsFzdVi72:zMalUUsMKV6uNMj9bmbEjFuc","tlshash":"c8243b6536fe202259235178063f721972bd4013a90acf54f95da69c3fcca7882b7fad","first_seen":"2026-02-22T09:36:24.935002Z","last_seen":"2026-02-22T09:36:24.935002Z","times_seen":1,"resource_available":true,"data":null}},"time_used":195,"timings":{"blocked":37,"dns":1,"connect":8,"send":0,"wait":119,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=hbrdcookie2\u0026rnd=1771752954","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.645Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=hbrdcookie2\u0026rnd=1771752954 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-length: 0\r\nlocation: https://dm-eu.hybrid.ai/match?id=185\u0026burl=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dhbrdcookie2%26bid%3D%24%7BVID%7D\r\nset-cookie: sky_uuid=d016e49a-303e-093e-c34a-4595f2a03bb5; max-age=157680000; path=/; HttpOnly; secure; SameSite=None\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.193:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"logger.21wiz.com/logger?v=e379f03305e679091e67a2347ff53d50\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026t=player_loaded\u0026a=\u0026m=%7B%22sub_id%22%3A%22ap%22%2C%22loadTime%22%3A0.648%2C%22version%22%3A%221771581359230%22%2C%22platform_id%22%3A%22%22%2C%22vt%22%3A100%2C%22dv%22%3Atrue%2C%22l%22%3A%22https%3A%2F%2Fgoyabu.io%2F40488%22%2C%22scr%22%3A%7B%22w%22%3A1280%2C%22h%22%3A1024%2C%22c%22%3A24%2C%22iw%22%3A480%2C%22ih%22%3A305%7D%7D\u0026o=\u0026s2=1","fqdn":"logger.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /logger?v=e379f03305e679091e67a2347ff53d50\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026t=player_loaded\u0026a=\u0026m=%7B%22sub_id%22%3A%22ap%22%2C%22loadTime%22%3A0.648%2C%22version%22%3A%221771581359230%22%2C%22platform_id%22%3A%22%22%2C%22vt%22%3A100%2C%22dv%22%3Atrue%2C%22l%22%3A%22https%3A%2F%2Fgoyabu.io%2F40488%22%2C%22scr%22%3A%7B%22w%22%3A1280%2C%22h%22%3A1024%2C%22c%22%3A24%2C%22iw%22%3A480%2C%22ih%22%3A305%7D%7D\u0026o=\u0026s2=1 HTTP/1.1\r\nHost: logger.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\npriority: u=4,i=?0\r\nx-logger-tdb: wizads\r\nx-movieads-country: NO\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N5jUKRlJwpdhKK7lI0TtLLrY9naBg1z9LHmV0Uk%2Fx6lnlKLgCF6BiungmzvpQPrAAdgbktHs%2BYZrtNmBS3LUec%2B2YmsG8rQR6Y13lR7qdro%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7f024ba5723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=btwc\u0026rnd=1771752968","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=btwc\u0026rnd=1771752968 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:08 GMT\r\ncontent-length: 0\r\nlocation: https://ads.betweendigital.com/match?bidder_id=46080\u0026callback_url=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dbtwc%26bid%3D%24%7BUSER_ID%7D\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.236:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dm-eu.hybrid.ai/match?id=185\u0026burl=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dhbrdcookie2%26bid%3D%24%7BVID%7D","fqdn":"dm-eu.hybrid.ai","domain":"hybrid.ai","tld":"ai"},"ip":{"addr":"37.230.131.16","port":443,"asn":200197,"as":"Hybrid Adtech Sp.z.o.o.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.022Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.hybrid.ai","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 22 Sep 2025 00:00:00 GMT","end":"Sun, 04 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:21:9E:FA:EF:FF:FF:F2:8D:68:A8:F9:EB:ED:53:32:CC:17:9B:ED","sha256":"C9:20:9A:53:1E:FA:35:C7:29:64:1F:C3:7B:1E:34:73:C8:15:87:43:EA:35:06:B8:8D:86:E5:11:19:2A:60:FC"}}},"request":{"raw":"GET /match?id=185\u0026burl=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dhbrdcookie2%26bid%3D%24%7BVID%7D HTTP/1.1\r\nHost: dm-eu.hybrid.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 22 Feb 2026 09:33:28 GMT\r\ncache-control: no-cache, no-store\r\npragma: no-cache\r\nexpires: -1\r\np3p: CP=\"NOI DSP COR CUR ADMa DEVo TAIo PSAo PSDo IVAo IVDo OUR IND COM NAV INT STA OTC\"\r\nx-mode: 5071\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: https://goyabu.io\r\naccess-control-allow-credentials: true\r\nserver: Hybrid Web Server\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cc.cloudad.icu/images/1px-matching-wizads.gif?id=4a677b54-8482-09d0-43af-c1ee5ba0a7e4","fqdn":"cc.cloudad.icu","domain":"cloudad.icu","tld":"icu"},"ip":{"addr":"193.200.65.5","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"cc.cloudad.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 08 Feb 2026 21:20:04 GMT","end":"Sat, 09 May 2026 21:20:03 GMT"},"fingerprint":{"sha1":"22:67:AB:37:BB:AF:D9:D6:84:97:A3:DD:2B:15:C5:87:D5:5D:51:2E","sha256":"DE:75:8D:54:D7:C0:21:27:D7:05:40:FF:EA:0B:0C:D7:06:C9:9E:4D:52:ED:80:B8:3D:AB:33:F8:19:0E:A3:18"}}},"request":{"raw":"GET /images/1px-matching-wizads.gif?id=4a677b54-8482-09d0-43af-c1ee5ba0a7e4 HTTP/1.1\r\nHost: cc.cloudad.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx\r\nDate: Sun, 22 Feb 2026 09:35:54 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 99\r\nConnection: keep-alive\r\nLocation: https://code.21wiz.com/go/csync?cn=tfmg\u0026bid=1452944245466703\r\nSet-Cookie: vid=1452944245466703; Path=/; Domain=cloudad.icu; Expires=Tue, 22 Feb 2028 09:35:54 GMT; Max-Age=63072000; Secure; SameSite=None\r\nP3P: CP=\"NON DSP COR CURa TIA\"\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":191,"timings":{"blocked":83,"dns":29,"connect":17,"send":0,"wait":21,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us.shb-sync.com/87d04d89-acd3-4a7c-9fe9-df65db01461a.gif?puid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026redir=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dstrn_snc_2%26bid%3D%24%7Buuid%7D\u0026gdpr={gdpr_exist}\u0026gdpr_consent={gdpr_string}\u0026ccpa=","fqdn":"us.shb-sync.com","domain":"shb-sync.com","tld":"com"},"ip":{"addr":"8.2.110.33","port":443,"asn":46636,"as":"NATCOWEB","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.031Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.shb-sync.com","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Wed, 12 Mar 2025 13:55:50 GMT","end":"Thu, 12 Mar 2026 12:58:04 GMT"},"fingerprint":{"sha1":"BE:FE:32:25:E7:53:23:5B:09:3B:71:13:34:E3:2E:96:7C:B6:60:7B","sha256":"CD:30:48:AC:8A:1C:79:81:9F:5B:4C:2E:36:03:87:94:03:00:AB:BC:EF:CD:1A:27:4F:50:E4:86:2F:9A:D9:7D"}}},"request":{"raw":"GET /87d04d89-acd3-4a7c-9fe9-df65db01461a.gif?puid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026redir=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dstrn_snc_2%26bid%3D%24%7Buuid%7D\u0026gdpr={gdpr_exist}\u0026gdpr_consent={gdpr_string}\u0026ccpa= HTTP/1.1\r\nHost: us.shb-sync.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: smart_usr=c53bcfd7-ba76-476a-94d7-89a9ff317fd5; smart_r=36062\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx\r\nDate: Sun, 22 Feb 2026 09:36:09 GMT\r\nConnection: keep-alive\r\nSet-Cookie: smart_usr=c53bcfd7-ba76-476a-94d7-89a9ff317fd5; path=/; domain=.shb-sync.com; expires=Sun, 13 Sep 2026 09:36:09 GMT;SameSite=None;Secure\nsmart_r=36062; path=/; domain=.shb-sync.com; expires=Sun, 13 Sep 2026 09:36:09 GMT;SameSite=None;Secure\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nExpires: 0\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":461,"timings":{"blocked":181,"dns":1,"connect":87,"send":0,"wait":88,"receive":0,"ssl":100},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=kdkd33_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=4b56bb55-3347-2f01-c90e-6233b5129057","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=kdkd33_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=4b56bb55-3347-2f01-c90e-6233b5129057 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1435\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-HSWBMT9ZNB","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"172.217.19.232","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:39:20 GMT","end":"Mon, 20 Apr 2026 08:39:19 GMT"},"fingerprint":{"sha1":"60:64:B6:72:E4:67:A4:EC:78:B2:F2:B8:3E:17:7A:A6:A8:CE:74:4C","sha256":"3E:71:C0:44:31:9B:1A:8A:23:FF:D9:4F:B9:3F:89:6D:7C:66:33:BE:14:26:CB:01:F2:79:BB:FE:F3:3A:71:98"}}},"request":{"raw":"GET /gtag/js?id=G-HSWBMT9ZNB HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\nexpires: Sun, 22 Feb 2026 09:35:55 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 150765\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":454942,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6033)","md5":"1f5145305846060fe17c81f5d1789169","sha1":"747b664716e90460f1fb43fdc0b676aca89b4638","sha256":"bb98d37de02059e87da09915577c26b3631a4839f91636ca1d76e65cfc82a677","sha512":"9a0c3b7fb03db42d3a89b6457d3b86762e90591c314fc6bae3803cf3a54d2cb015b73da3dcaa20f0a1a9143c6fbd4718d2b4709f64e2dbc25a06de76ad41103d","ssdeep":"6144:UCmO7CW6y273J5NYygLIR8Nyk7pNH08pddlmOrELkS5fenMcm0v:duW6y27dDEIR855VrEff3E","tlshash":"9fa41ace73d670269396f478503f018ba57b29a2b44dc89af189cce42d74a5a4237f7c","first_seen":"2026-02-22T09:36:24.935827Z","last_seen":"2026-02-22T09:36:24.935827Z","times_seen":1,"resource_available":true,"data":null}},"time_used":256,"timings":{"blocked":101,"dns":1,"connect":7,"send":0,"wait":27,"receive":25,"ssl":91},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=kdm_snc\u0026rnd=1771752968","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=kdm_snc\u0026rnd=1771752968 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:08 GMT\r\ncontent-length: 0\r\nlocation: https://s.uuidksinc.net/match/3038/?remote_uid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.171:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"logger.21wiz.com/logger?t=player_frame_loaded_new\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=1\u0026v=e379f03305e679091e67a2347ff53d50\u0026o=","fqdn":"logger.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.904Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /logger?t=player_frame_loaded_new\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=1\u0026v=e379f03305e679091e67a2347ff53d50\u0026o= HTTP/1.1\r\nHost: logger.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:36:08 GMT\r\npriority: u=4,i=?0\r\nx-logger-tdb: wizads\r\nx-movieads-country: NO\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aT2xBA3kiamwCerHxxZ3zWiaJjYo02jMgCjflf0YULGyg34HVOyt%2BwASCZXa0cJDsrmNS63SRkQtSK7OaPaq5tipGf15Pfa9XAnPrLlHVT0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7f578c15723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sync.vqserve.com/match/stream?tid=d6dcs22sp4jq8tt2bphg\u0026rid=BHjoFMmspYBR5WjtJZXygGD24s","fqdn":"sync.vqserve.com","domain":"vqserve.com","tld":"com"},"ip":{"addr":"77.223.121.118","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vqserve.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R6 AlphaSSL CA 2025","organization":"GlobalSign nv-sa"},"validity":{"start":"Thu, 09 Oct 2025 14:40:31 GMT","end":"Tue, 10 Nov 2026 14:40:30 GMT"},"fingerprint":{"sha1":"A4:92:98:C8:27:24:5D:7F:47:C2:95:B7:EA:29:80:E9:84:20:4C:CE","sha256":"89:89:8A:AA:8C:19:7D:FA:1B:28:C0:47:CA:04:E7:8E:56:63:49:DD:96:1D:20:94:92:1D:1C:BD:95:E9:99:FF"}}},"request":{"raw":"GET /match/stream?tid=d6dcs22sp4jq8tt2bphg\u0026rid=BHjoFMmspYBR5WjtJZXygGD24s HTTP/1.1\r\nHost: sync.vqserve.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: rid=BHjoFMmspYBR5WjtJZXygGD24s\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx/1.29.3\r\nDate: Sun, 22 Feb 2026 09:36:09 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: https://a.utraff.com/sync?ssp=3769\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.29.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/themes/cronos-design/assets/fontawesome/webfonts/fa-solid-900.woff2","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/themes/cronos-design/assets/fontawesome/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://goyabu.io/40488\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 140996\r\nserver: cloudflare\r\nlast-modified: Thu, 10 Jul 2025 18:14:21 GMT\r\netag: \"687002fd-226c4\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M0kS4%2FOTC3B3YG1AtUjZsLUSz51QEK5%2Fk%2FWQanynuubao41iosZEYj%2BnuOlCYZEUmqP09PceVm2CQ5QMNCFEpelAfINnRWB2dQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef1eac7902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":140996,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 140996, version 331.-31392","md5":"25d740d42658b6e2c293ce7b3322aac7","sha1":"41cc9ae4b5dd70fd3988059dfb864f20f99ae371","sha256":"8b5a3ff47c2413e0bf3dd3bb7899a25aeef9b390a055847a1185a39ad48a2da2","sha512":"eb92dd22d53765b44d918ecec0105cbaae08fd5e0c7fac1ec8494a32bb553ded03e8b3826a230161ab791d6169eba1d3b384451e002ff0369760206b7775c768","ssdeep":"3072:X8Y40kER3HLOKqHj4HYwoR9G8iSjt1FrLl+JeMU:/4GZHLOtEH3wVdjtyLU","tlshash":"13d3123a6c8961b6fd2e9870bef1fc0949db7852059892c6b3565f6cd97a0031873f09","first_seen":"2023-04-05T13:28:45Z","last_seen":"2026-04-04T21:29:56.969425Z","times_seen":5634,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.21wiz.com/assets/wizads_logo.svg","fqdn":"static.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:53.379Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /assets/wizads_logo.svg HTTP/1.1\r\nHost: static.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:35:53 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 20 Jan 2025 08:53:26 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\netag: \"678e0f06-510\"\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nage: 6981\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f9tx7Tc4VxWfeW5dWpOW3uBXo%2BYrDvxxEakiIreLUyumb2wDmTTVeOKsoGpmD%2F3V1zQ%2BV%2B4sAOiyWFseW2cjBR73KJ51jZ3nPeugChAUG3E%3D\"}]}\r\ncf-ray: 9d1d7ef6a983723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1296,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"362b61f4e44b0452b21a4f6e997373d7","sha1":"9f3d17c0f58842efadbbeb52e20b4c1ac99e8dda","sha256":"e019bb79601efc16c9f74047990049d5a4dd8a1b4244e5d124d41cf33256342a","sha512":"db8578d1077d35504003b35f84deec5a6a38c5be3ebabee4aab90a4623513dfcfd2a441d7c3fed4e18f8092d4ec252096cc69ea44cef0de37f9d67827dc6bf1f","ssdeep":"","tlshash":"732110191329da3cd183808ade285083665070d3e17cb0ccf9ef28626f0b9f0a861bf4","first_seen":"2025-01-23T17:26:41.918554Z","last_seen":"2026-04-04T12:24:21.451548Z","times_seen":235,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":6,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=bet24\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=4c12f5c2-43ba-fb1a-f10a-c4ebfd53442d","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=bet24\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=4c12f5c2-43ba-fb1a-f10a-c4ebfd53442d HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,221\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/uploads/2025/12/logo-min.webp","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.652Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/logo-min.webp HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9976\r\nserver: cloudflare\r\nlast-modified: Mon, 01 Dec 2025 21:15:17 GMT\r\netag: \"692e0565-26f8\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 1176\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OC2p1Cs%2BuoaUuq7TYOi0ab5HzaYA%2B1adycPh6%2BXjGorrwBylUksE6qUZr1VIBIEKXrz3Ku1sPvbgrfsIJGNYIcb%2BIunpeUy%2F1Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef1fb1a902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9976,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bd21cd364e5c24dcb2e01fe4e5a21050","sha1":"edc1b75f8c1c1689634bdc1330c3ba9facf23eb8","sha256":"2cf24212a3bd20692a261ca7a0b997d91fe2362747bdcccc6dccae76da04a808","sha512":"21a207d335d1f4a5ddb8d429f85c3d87edb552f2494e17894158a39cdeeaa4989ee63cb601d3efd0f3b03dd2d239569783c3ffcfbfb5b3849db5b4c4149b4b86","ssdeep":"192:+hrTbHrNq/uuHBVJnfJ8yYHrlE4Yuu8HBXTiAnj8/0VbemhuqYDvc1gBfYa:+VTDr0/DH5nxoLlVYP8HlTie8/2CmdYF","tlshash":"2522c0126ec813c6d281238246dd37b9a0eb5b1c477b6a6c165293f5b5219ccffa0be1","first_seen":"2025-12-11T01:54:40.455722Z","last_seen":"2026-04-04T12:24:21.479135Z","times_seen":42,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ad-eu-bid.veonadx.com/match/wizadsbanner?id=ed08c16a-0632-6950-0b8a-67c2e22a5be1","fqdn":"ad-eu-bid.veonadx.com","domain":"veonadx.com","tld":"com"},"ip":{"addr":"88.211.224.220","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.746Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.veonadx.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R6 AlphaSSL CA 2023","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 24 Mar 2025 02:42:59 GMT","end":"Sat, 25 Apr 2026 02:42:58 GMT"},"fingerprint":{"sha1":"50:C5:5A:F2:E2:90:B4:1C:A4:9E:7F:B9:FC:02:BC:C4:53:DB:19:AE","sha256":"A3:D5:81:6A:A2:7D:32:EC:B9:D8:89:1B:21:DF:F0:36:DA:70:D7:B0:28:F8:5C:76:85:DD:8F:00:4B:3B:27:E6"}}},"request":{"raw":"GET /match/wizadsbanner?id=ed08c16a-0632-6950-0b8a-67c2e22a5be1 HTTP/1.1\r\nHost: ad-eu-bid.veonadx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx/1.27.1\r\nDate: Sun, 22 Feb 2026 09:35:54 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 108\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nLocation: /match/wizadsbanner?id=ed08c16a-0632-6950-0b8a-67c2e22a5be1\u0026otcm_check=1771752954\r\nSet-Cookie: mpid=Njk5YWNkZmE2NDY4MjllYw==; Path=/; Domain=veonadx.com; Max-Age=31536000; Secure; SameSite=None\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.27.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":385,"timings":{"blocked":179,"dns":24,"connect":28,"send":0,"wait":24,"receive":0,"ssl":125},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exchange.buzzoola.com/cookiesync/dsp/sape-banner?uid=0900007FFBCD9A692C0908B0027F75F8\u0026url=https%3A%2F%2Fmc.acint.net%2Fmatch%3Fdp%3D126%26euid%3D%24%7BUUID%7D%26aid%3D0900007FFBCD9A692C0908B0027F75F8","fqdn":"exchange.buzzoola.com","domain":"buzzoola.com","tld":"com"},"ip":{"addr":"45.138.161.82","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"buzzoola.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Dec 2025 06:11:29 GMT","end":"Mon, 09 Mar 2026 06:11:28 GMT"},"fingerprint":{"sha1":"6D:1A:28:D1:AB:8D:18:D1:38:1A:55:28:34:A1:03:2A:BC:7A:1C:5A","sha256":"AB:C0:F2:6B:07:6C:D6:89:63:34:97:78:29:CD:C6:D1:2A:75:3D:C0:7C:E0:05:94:11:71:82:6B:67:8C:2D:36"}}},"request":{"raw":"GET /cookiesync/dsp/sape-banner?uid=0900007FFBCD9A692C0908B0027F75F8\u0026url=https%3A%2F%2Fmc.acint.net%2Fmatch%3Fdp%3D126%26euid%3D%24%7BUUID%7D%26aid%3D0900007FFBCD9A692C0908B0027F75F8 HTTP/1.1\r\nHost: exchange.buzzoola.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 244\r\nlocation: /cookiesync/dsp/sape-banner?set_buzzoola_cookie=t\u0026uid=0900007FFBCD9A692C0908B0027F75F8\u0026url=https%3A%2F%2Fmc.acint.net%2Fmatch%3Fdp%3D126%26euid%3D%24%7BUUID%7D%26aid%3D0900007FFBCD9A692C0908B0027F75F8\r\nset-cookie: uuid=6325f496-d49f-4583-5b53-c771edaea876; Path=/; Domain=buzzoola.com; Expires=Tue, 24 Mar 2026 09:35:55 GMT; Max-Age=2592000; Secure; SameSite=None\r\nserverid: TODO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":242,"timings":{"blocked":106,"dns":25,"connect":30,"send":0,"wait":30,"receive":0,"ssl":48},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=medx\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=222cf706-731f-7d0b-d3a5-fa0ceca916de","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.881Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=medx\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=222cf706-731f-7d0b-d3a5-fa0ceca916de HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,384\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/cache/min/1/wp-content/themes/cronos-design/assets/fontawesome/css/used.min.css?ver=1769967648","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/cache/min/1/wp-content/themes/cronos-design/assets/fontawesome/css/used.min.css?ver=1769967648 HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sun, 01 Feb 2026 17:40:48 GMT\r\nvary: Accept-Encoding\r\netag: \"697f9020-3b65\"\r\nexpires: Sun, 22 Feb 2026 13:23:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 29553\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q78xIhlZ%2FilPMGZ9cUWKVQM9dJ3FiKYxw4vI0xgtvmoSo8Csx6BEnxOSMunSr0yNKzKt0hspqBcHJIFftQ%2FeOSB5GMpCXzGkKg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef1fb12902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15205,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (15062)","md5":"0ac3f632bde6fbe36285fd8ac1670323","sha1":"f8c5872e6a63010c7a61c2631e35c4011be14a87","sha256":"153aa753b0fe9e7ec37bb57576a7e47495e2b2d1f2df9de456573aee835ca354","sha512":"2816227fbc7d435833301f6b6d3d45b6b65f910873fb58aa4bddb4c80318bb3b8604f5bfd99097943b4171c77d59a0dca1f98f884be89dfa532a8a753acf5beb","ssdeep":"192:mP005lyIPCwvfdYMy2QNIGs4mNvnSk7H7Tvw:qy5AfdYr6Gs4mNvnSk74","tlshash":"49628b75803d30c62316c50f6784be76ab79ff29ba501f5ae18e4c3d0de2f990285b99","first_seen":"2025-12-11T01:54:40.450954Z","last_seen":"2026-04-04T12:24:21.465805Z","times_seen":23,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=btwc\u0026rnd=1771752954","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=btwc\u0026rnd=1771752954 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-length: 0\r\nlocation: https://ads.betweendigital.com/match?bidder_id=46080\u0026callback_url=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dbtwc%26bid%3D%24%7BUSER_ID%7D\r\nset-cookie: sky_uuid=cb02f07f-a894-648a-2c05-dda716d936d1; max-age=157680000; path=/; HttpOnly; secure; SameSite=None\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.207:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=DaoOut_qps\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=e74b098e-b460-2a34-9676-25a9a6c812f5","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=DaoOut_qps\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=e74b098e-b460-2a34-9676-25a9a6c812f5 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1105\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=kdm_snc\u0026rnd=1771752954","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.659Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=kdm_snc\u0026rnd=1771752954 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-length: 0\r\nlocation: https://s.uuidksinc.net/match/3038/?remote_uid=8162a005-63a0-8bfc-57db-b0b1cd0b84d3\r\nset-cookie: sky_uuid=8162a005-63a0-8bfc-57db-b0b1cd0b84d3; max-age=157680000; path=/; HttpOnly; secure; SameSite=None\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.163:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=exww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=2bac49dd-df93-bcbc-38f2-6d551938676d","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=exww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=2bac49dd-df93-bcbc-38f2-6d551938676d HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,2421\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=veon_bn_snc\u0026rnd=1771752968","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:08.889Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=veon_bn_snc\u0026rnd=1771752968 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:08 GMT\r\ncontent-length: 0\r\nlocation: https://ad-eu-bid.veonadx.com/match/wizadsbanner?id=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.194:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"my.rtmark.net/gid.js?userId=0082e578a8bb4baae83c101d6d8036fc","fqdn":"my.rtmark.net","domain":"rtmark.net","tld":"net"},"ip":{"addr":"104.18.41.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:53.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"my.rtmark.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 21 Feb 2026 19:28:29 GMT","end":"Fri, 22 May 2026 20:28:25 GMT"},"fingerprint":{"sha1":"36:C6:D1:CA:01:47:A4:1B:73:8E:62:DB:CB:24:79:4D:06:01:3B:B5","sha256":"11:41:34:A5:A1:10:2F:10:C6:7F:8A:F2:77:75:66:AA:39:99:F9:E7:00:8D:1E:EE:4E:30:42:B7:A3:82:28:31"}}},"request":{"raw":"GET /gid.js?userId=0082e578a8bb4baae83c101d6d8036fc HTTP/1.1\r\nHost: my.rtmark.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:53 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: https://goyabu.io\r\naccess-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE\r\naccess-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token\r\naccess-control-expose-headers: Authorization\r\naccess-control-allow-credentials: true\r\nset-cookie: ID=0082e578a8bb4baae83c101d6d8036fc; expires=Mon, 22 Feb 2027 09:35:53 GMT; secure; SameSite=None\r\nstrict-transport-security: max-age=1\r\nx-content-type-options: nosniff\r\ntiming-allow-origin: *\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncf-ray: 9d1d7ef83e1f4e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"05867710d30a763a811a077f57e3d10b","sha1":"df18f7e26899823a2180212603ca26d9cc9b65fc","sha256":"e596a4e6feb5ac0f481892fc926ff4ede4a3a9399b7df576b13eee7227967a76","sha512":"32daa7802975dd5262da39e66fb8e3bee960956c656f3567b514ac4941aa0f1885f5412c0c74885076dd8ef737cfa1ce909409b39d669b9aad82e2d2aa4f3f59","ssdeep":"","tlshash":"09a02222280083cc00c0032a0baecfc2000200800c00baa002cc828300c30ccc80b200","first_seen":"2026-02-22T09:36:24.938723Z","last_seen":"2026-02-22T09:36:24.938723Z","times_seen":1,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":31,"dns":14,"connect":1,"send":0,"wait":56,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.moviead55.ru/madstyle.css","fqdn":"code.moviead55.ru","domain":"moviead55.ru","tld":"ru"},"ip":{"addr":"87.242.110.166","port":443,"asn":50340,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:53.210Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.moviead55.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 10 Feb 2026 09:36:12 GMT","end":"Mon, 11 May 2026 09:36:11 GMT"},"fingerprint":{"sha1":"EC:3E:C2:09:CF:28:FF:C5:E2:17:1A:67:1B:0C:73:E6:8A:CF:56:6B","sha256":"B6:5F:1D:4B:0D:8C:64:9B:7A:A8:2E:61:C2:F1:36:54:BF:76:CF:86:30:97:7E:1C:07:44:81:92:3E:6A:EA:47"}}},"request":{"raw":"GET /madstyle.css HTTP/1.1\r\nHost: code.moviead55.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:53 GMT\r\ncontent-type: text/css;charset=UTF-8\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\naccess-control-max-age: 86400\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\netag: W/\"28021-7Ba9Gb9K6bwuIzasQJpQO7varK0\"\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":195,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"6ed143290670ef96588679ebd4a13c7a","sha1":"93af57a027dde75be51ba10173daf9ef4d5d3f46","sha256":"df205a1409917a454871a3b48e4f1f9807d7fed7e0e886ce2100488a31199644","sha512":"af8acf35c6f995228f7154cd60bf29f6395710732fc63cc61ed4ba0e1ac74e4da3148363d20304281426c733a919cecac2e82f91c692d897e090298018c91955","ssdeep":"","tlshash":"efd012c15c8e254157e586a7a95db7245b38d0508c60ce52cd4777b853da51f0070bc8","first_seen":"2026-02-22T09:36:24.939526Z","last_seen":"2026-02-22T09:36:24.939526Z","times_seen":1,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":87,"dns":24,"connect":26,"send":0,"wait":27,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=hui3_vid_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=cd837476-f2bb-e088-0e4f-6ff98f6d49e6","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.719Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=hui3_vid_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=cd837476-f2bb-e088-0e4f-6ff98f6d49e6 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1318\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/cache/min/1/wp-content/themes/cronos-design/style.css?ver=1769967648","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.647Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/cache/min/1/wp-content/themes/cronos-design/style.css?ver=1769967648 HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sun, 01 Feb 2026 17:40:48 GMT\r\nvary: Accept-Encoding\r\netag: \"697f9020-a430\"\r\nexpires: Sun, 22 Feb 2026 16:49:43 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 17168\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qxaxkGESBix9B1SfXnixgt4WoYr%2B2qdZ2flm3esqIzXlpN3ukKRDU1ZfcF75RqOHoPs%2F4pfPBpAxzwbrL6qP%2BpnJox1Nlqa4KA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef1fafe902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42032,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (42030), with no line terminators","md5":"ed291559dc6b81efe2b6743f50162a4f","sha1":"fe5f3d9303634146fa05c4cdab11ead904dd1ea8","sha256":"0199d0b17b74fca254e51028a92980e7509dde8703f78a822ae1bd80c37cd9a4","sha512":"9c88b209922f3b0cf4fc085b747380518f909305e66b4152cf1ce54260d786b9f146329b180188e032ed27e457582c55f5215704f295fdee89771c1df967e0b4","ssdeep":"768:JeQNatfqB/z1mt3M8gTsqHa06NRQTHyhljgcQdU0dysRcpo0E:JZdIW+qnT","tlshash":"3b1397517118303ea4b7f22b6bd8a68f256ce801ea1347ad7c51633d8ac72f70672e5c","first_seen":"2025-12-11T01:54:40.458196Z","last_seen":"2026-04-04T12:24:21.471968Z","times_seen":23,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e7cod.com/5/8033056","fqdn":"e7cod.com","domain":"e7cod.com","tld":"com"},"ip":{"addr":"139.45.197.233","port":443,"asn":9002,"as":"RETN Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:53.353Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e7cod.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Dec 2025 06:11:13 GMT","end":"Mon, 09 Mar 2026 06:11:12 GMT"},"fingerprint":{"sha1":"E1:3E:8E:13:F8:CC:FC:0E:0E:77:77:99:F6:A9:A9:84:D8:7F:C1:C2","sha256":"92:21:C3:31:91:DB:58:BC:FB:3F:B5:6A:7B:02:EF:B3:44:1C:76:01:56:DF:A3:00:0E:B5:98:72:97:00:8C:7A"}}},"request":{"raw":"GET /5/8033056 HTTP/1.1\r\nHost: e7cod.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:53 GMT\r\ncontent-type: application/javascript\r\nx-trace-id: 91abd2082e1bf71daecab58419069973\r\nlink: \u003chttps://my.rtmark.net\u003e; rel=\"preconnect dns-prefetch\"\r\naccept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon\r\naccess-control-max-age: 86400\r\ntiming-allow-origin: *\r\nset-cookie: OAID=0082e578a8bb4baae83c101d6d8036fc; expires=Mon, 22 Feb 2027 09:35:53 GMT; path=/; secure; SameSite=None\noaidts=1771752953; expires=Mon, 22 Feb 2027 09:35:53 GMT; path=/; secure; SameSite=None\nsyncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT\r\npragma: no-cache, no-cache\r\ncache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0\r\nexpires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119331,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a32f43f29762dc28dd011c5e6012e68a","sha1":"00f4403ac8a9b9ea0da79893a7741c603b3f3af2","sha256":"392cb36bc7e19d13ed3124d35f69e512f43bac62b5322e240fe70b83a92575bb","sha512":"5380b9fcc201926ab1fefb57e8fed01670648f1e8611b379c7f2799d662ccfd614ab2af910a1d75f0c726da2a00132f9d18bb434259d4d70c322532962929d0a","ssdeep":"1536:XLBJ4Znp4eTSNrC675V6mYZP2rH9kZrYx4ODiUakktqha5qLwutBiJgq1oB44a83:VJuvWH75V0/ZrYx4ODMZUgUbi5E5f3","tlshash":"1bc32b6073d1781652bfb12c0c2ac52d655a4ed0084d8afbd2e9a876e4a531cc3bbff5","first_seen":"2026-02-22T09:36:24.940703Z","last_seen":"2026-02-22T09:36:24.940703Z","times_seen":1,"resource_available":true,"data":null}},"time_used":203,"timings":{"blocked":72,"dns":12,"connect":26,"send":0,"wait":59,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-21","alert":"Sinkholed","trigger":"e7cod.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/uploads/2025/12/cropped-goyabu-favicon-32x32.png","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/cropped-goyabu-favicon-32x32.png HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: image/png\r\ncontent-length: 899\r\nserver: cloudflare\r\nlast-modified: Mon, 08 Dec 2025 00:45:15 GMT\r\netag: \"69361f9b-383\"\r\nexpires: Wed, 11 Mar 2026 00:21:13 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 1156479\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PQ2AMcetV3YzKmFHXFOvwGp5x5eTFb9U3VxmSg4c4DkB5aF1%2BnBBbDdaSaEtqGhS2ViPWysKlNGnOK5MYxwjy08F%2B0oOA0Pxow%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef4283c902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":899,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"e50f6c157cfa9bab7d3007c724247e2d","sha1":"edea8473f07be7aa373eefd23cc513c9b8997f65","sha256":"9cc41815e61e6ba939d29ad134afc218402e42966553da08f6744cc7ff198faa","sha512":"3c3abda1b829c1debb6f006733f847fceea9559687df724e656bcdc759fcc70217e7c4f5dfc6d1cb5a2e2915c567785663798f458a9e95a841dec85703260b2b","ssdeep":"","tlshash":"16116744b8ef56b2783402f3e48ab050763651e8852ab9e11a426b476ff683638552dd","first_seen":"2025-12-11T01:54:40.448926Z","last_seen":"2026-04-04T12:24:21.464739Z","times_seen":42,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=btwww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=e6c29997-80cf-b8ea-dadc-eec5facc3f64","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=btwww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=01648f9b-5eae-57ad-2c00-20db2aede39f\u0026trid=e6c29997-80cf-b8ea-dadc-eec5facc3f64 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1466\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=Hds_t_rtb_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=8ccab40a-fae0-0ad8-43da-634d70bae109","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.911Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=Hds_t_rtb_ww\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=8ccab40a-fae0-0ad8-43da-634d70bae109 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1075\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=bet24\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=77a47dc7-7b9b-fe45-0440-2a379de6a2c1","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:36:09.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /vast2?key=e379f03305e679091e67a2347ff53d50\u0026sid=autoplay\u0026cp.adsource=bet24\u0026cp.adtype=pre\u0026vt=100\u0026fp=[fp]\u0026w=480\u0026h=305\u0026vid=\u0026fpro=\u0026ma=6b1dd97a-1ec0-35bd-2c34-a428f41d652c\u0026suri=https%3A%2F%2Fgoyabu.io%2F40488\u0026cp.session=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026cp.referer=https%253A%252F%252Fgoyabu.io%252F40488\u0026cp.cb=0a11159b-48e8-37ef-35a0-ca8748ea79a6\u0026trid=77a47dc7-7b9b-fe45-0440-2a379de6a2c1 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nCookie: sky_uuid=6b1dd97a-1ec0-35bd-2c34-a428f41d652c; tfmg=1452944245466703\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:36:09 GMT\r\ncontent-type: text/xml;charset=UTF-8\r\nvary: Accept-Encoding\r\nx-wizads-cors-qex: Referer\r\nx-wizads-path: /\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://goyabu.io\r\nx-wizads-udata: cache,parsed,1119\r\nx-wizads-referrer: https://goyabu.io/\r\nx-cache-source: Rist\r\nx-movieads-country: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40,"size_decoded":0,"mime_type":"text/xml; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"e14fa30e70e70a973a008289bd383f1e","sha1":"341950a9f112b4264027ce13bdac1e2adda2d690","sha256":"c32461dca8a6432846be880d65f599e5947de3cc7a6fdd4566bfa8c1ecf715b6","sha512":"07ae4ac3b76f2682bb8aeb8fddc3f7830988e50ab10df1afc146ad1b947f524412876b5b216fc2ee4faa8c158dcfe32fe816bbb7762005ce56dfc3773bac01f0","ssdeep":"","tlshash":"1c900451f305143f71d13117131140401454117df435c571f0d47015f44cd10f400443","first_seen":"2025-05-20T11:59:27.372581Z","last_seen":"2026-04-04T12:24:21.441717Z","times_seen":33,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"goyabu.io/wp-content/uploads/2025/12/cropped-goyabu-favicon-192x192.png","fqdn":"goyabu.io","domain":"goyabu.io","tld":"io"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:52.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"goyabu.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 19:19:59 GMT","end":"Mon, 27 Apr 2026 20:17:41 GMT"},"fingerprint":{"sha1":"2E:41:D5:DF:9D:87:E6:B0:38:3E:AF:98:6D:DF:DD:0A:E8:50:9C:98","sha256":"50:05:AD:85:DC:7A:34:43:6C:07:F6:1E:8C:BC:3A:71:D1:D8:93:05:C0:95:05:B6:8A:2C:38:4C:10:D7:BC:0E"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/cropped-goyabu-favicon-192x192.png HTTP/1.1\r\nHost: goyabu.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/40488\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 22 Feb 2026 09:35:52 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Mon, 08 Dec 2025 00:45:15 GMT\r\nvary: Accept-Encoding\r\netag: \"69361f9b-1675\"\r\nexpires: Sat, 14 Mar 2026 21:18:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 821865\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3wT2IZ7uXd%2B14FzyP1W19n5FJGIfiDRa31gMT%2FJbD%2BD6NlKqrpAGlvcMbuobKxw3xi63rSm0buQdQCCE3fd1f%2BDyXgSVVR5FoA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef42839902d-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5749,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"73074506d291a52e7c9bb98db4778a50","sha1":"615f03b4aced700578f57b5f4f4123813ba94b54","sha256":"5f12328b19b4cd467edeae5984488cce68919d6519c8382e22dfccc0a3e15cac","sha512":"23600bbb1879d594c03d54d2039221e85f262c84660346e3d434b9ace598327686ca7b321a143e19acecc39324871fd1d710d8ca70e37b9e6b8e59c570d7780d","ssdeep":"96:960CkrTwSZYgJ/kcTke/ovKYtyfzmT5ZIdmIx0aH9455ptDrhTYK+6:ccrTwU/hfTj/iK5zm9Z+Hc5pFrhTYi","tlshash":"4fc1afc592f0accc9acd96a0d2a14ffba8d133142675aac9f74c4a4474f030d5db998b","first_seen":"2025-12-11T01:54:40.459265Z","last_seen":"2026-04-04T12:24:21.449143Z","times_seen":42,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-22","alert":"Sinkholed","trigger":"goyabu.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"e7cod.com/wrr?z=8033056\u0026p_rid=84931971-1a41-4f61-94ba-f4eb98b5718d\u0026rb=HneAUlrtia1-0Q4h9o97HIci7vZUCnWq6OPz62FwdJzaACbcL6xCt8ii2ZBbOI9Ep8jZA6kZ6oHWZJH1AJcaeodF-D9Zc38CQ6hAhNrK714xqqwE7B6QV3mDyLzs3AyltWJKLfO3UHpv6TFdFkUI5etDhWBu3TSzPY5AgaHwlfJ07dmllfYi2rZ4OBOp7mPgJg1NHOvcPnT4GMmQTE4Nf1F7jHKstoVJVpzeZVmNPB6hUu1ulKQ3dk9vKP0lRrAh8Wl8hLTEnMc3X3941KFgu5Y4tJ2w-nkJbS_Sag==\u0026dmn=e7cod.com\u0026userId=0082e578a8bb4baae83c101d6d8036fc\u0026tspl=1316\u0026cslt=61","fqdn":"e7cod.com","domain":"e7cod.com","tld":"com"},"ip":{"addr":"139.45.197.233","port":443,"asn":9002,"as":"RETN Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.275Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"e7cod.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 09 Dec 2025 06:11:13 GMT","end":"Mon, 09 Mar 2026 06:11:12 GMT"},"fingerprint":{"sha1":"E1:3E:8E:13:F8:CC:FC:0E:0E:77:77:99:F6:A9:A9:84:D8:7F:C1:C2","sha256":"92:21:C3:31:91:DB:58:BC:FB:3F:B5:6A:7B:02:EF:B3:44:1C:76:01:56:DF:A3:00:0E:B5:98:72:97:00:8C:7A"}}},"request":{"raw":"OPTIONS /wrr?z=8033056\u0026p_rid=84931971-1a41-4f61-94ba-f4eb98b5718d\u0026rb=HneAUlrtia1-0Q4h9o97HIci7vZUCnWq6OPz62FwdJzaACbcL6xCt8ii2ZBbOI9Ep8jZA6kZ6oHWZJH1AJcaeodF-D9Zc38CQ6hAhNrK714xqqwE7B6QV3mDyLzs3AyltWJKLfO3UHpv6TFdFkUI5etDhWBu3TSzPY5AgaHwlfJ07dmllfYi2rZ4OBOp7mPgJg1NHOvcPnT4GMmQTE4Nf1F7jHKstoVJVpzeZVmNPB6hUu1ulKQ3dk9vKP0lRrAh8Wl8hLTEnMc3X3941KFgu5Y4tJ2w-nkJbS_Sag==\u0026dmn=e7cod.com\u0026userId=0082e578a8bb4baae83c101d6d8036fc\u0026tspl=1316\u0026cslt=61 HTTP/1.1\r\nHost: e7cod.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://goyabu.io/\r\nOrigin: https://goyabu.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\naccept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version\r\naccess-control-allow-origin: https://goyabu.io\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon\r\naccess-control-max-age: 86400\r\npragma: no-cache\r\ncache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0\r\nexpires: Tue, 11 Jan 1994 10:00:00 GMT\r\nstrict-transport-security: max-age=1\r\nx-content-type-options: nosniff\r\ntiming-allow-origin: *, *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":63,"dns":1,"connect":26,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-21","alert":"Sinkholed","trigger":"e7cod.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.21wiz.com/go/cinit?cn=strn_snc_2\u0026rnd=1771752954","fqdn":"code.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"193.200.65.163","port":443,"asn":6681,"as":"Giveme Cloud Sp Z O O","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:54.652Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.21wiz.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 07:07:41 GMT","end":"Mon, 23 Feb 2026 07:07:40 GMT"},"fingerprint":{"sha1":"94:64:9A:71:33:5E:C9:F2:2E:90:E3:52:58:FC:E8:A5:B7:B5:2A:38","sha256":"19:84:7D:25:A8:A0:EA:4E:1E:8E:F5:38:FD:F1:48:A6:CC:3A:C7:A2:3C:58:A4:8D:D1:59:8C:6C:0B:6C:44:43"}}},"request":{"raw":"GET /go/cinit?cn=strn_snc_2\u0026rnd=1771752954 HTTP/1.1\r\nHost: code.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\nserver: nginx\r\ndate: Sun, 22 Feb 2026 09:35:54 GMT\r\ncontent-length: 0\r\nlocation: https://us.shb-sync.com/87d04d89-acd3-4a7c-9fe9-df65db01461a.gif?puid=bb650636-b376-e594-e723-3de11b0cecfb\u0026redir=https%3A%2F%2Fcode.21wiz.com%2Fgo%2Fcsync%3Fcn%3Dstrn_snc_2%26bid%3D%24%7Buuid%7D\u0026gdpr={gdpr_exist}\u0026gdpr_consent={gdpr_string}\u0026ccpa=\r\nset-cookie: sky_uuid=bb650636-b376-e594-e723-3de11b0cecfb; max-age=157680000; path=/; HttpOnly; secure; SameSite=None\r\nx-movieads-country: NO\r\nx-upstream-addr: 192.168.110.162:9009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"logger.21wiz.com/logger?t=target_country_load\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=%7B%22browser%22%3A%22%7B%5C%22name%5C%22%3A%5C%22firefox%5C%22%2C%5C%22version%5C%22%3A%5C%22134%5C%22%7D%22%2C%22isMobile%22%3Afalse%2C%22format%22%3A%22new%22%7D\u0026v=e379f03305e679091e67a2347ff53d50\u0026o=","fqdn":"logger.21wiz.com","domain":"21wiz.com","tld":"com"},"ip":{"addr":"104.21.93.189","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:53.014Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"21wiz.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 13 Feb 2026 07:31:20 GMT","end":"Thu, 14 May 2026 08:29:50 GMT"},"fingerprint":{"sha1":"93:82:A1:04:F3:83:36:BF:EA:6D:B3:07:16:9C:73:8D:62:8A:2B:8A","sha256":"D3:3D:EF:29:DB:1E:41:40:EA:0C:B7:36:0A:81:ED:8B:28:38:0D:B3:58:75:C5:EB:F7:62:E6:ED:A0:FD:63:76"}}},"request":{"raw":"GET /logger?t=target_country_load\u0026c=4fce3417-3928-4c2c-bd80-c7cb3a3932f1\u0026a=\u0026m=%7B%22browser%22%3A%22%7B%5C%22name%5C%22%3A%5C%22firefox%5C%22%2C%5C%22version%5C%22%3A%5C%22134%5C%22%7D%22%2C%22isMobile%22%3Afalse%2C%22format%22%3A%22new%22%7D\u0026v=e379f03305e679091e67a2347ff53d50\u0026o= HTTP/1.1\r\nHost: logger.21wiz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://goyabu.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 22 Feb 2026 09:35:53 GMT\r\npriority: u=4,i=?0\r\nx-logger-tdb: wizads\r\nx-movieads-country: NO\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yylz2uLfCys2qCi1rw3EdiAZh7h8Zym4q%2FbBCvRcrG3lAOWMRuuRTSnF0XqC0jQhJKPkwInIC3iDJSBFBu5hy%2BjyF%2BEe%2FBlLnEZag%2BO4nBU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d1d7ef46913723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mc.acint.net/match?dp=450\u0026tc=1\u0026euid=BHjoFMmspYBR5WjtJZXygGD24s","fqdn":"mc.acint.net","domain":"acint.net","tld":"net"},"ip":{"addr":"193.3.184.27","port":443,"asn":50214,"as":"QWARTA LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://goyabu.io/40488","date":"2026-02-22T09:35:55.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.acint.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 23:34:52 GMT","end":"Fri, 17 Apr 2026 23:34:51 GMT"},"fingerprint":{"sha1":"35:A8:27:67:78:F8:62:D1:AE:7F:FF:67:52:6F:6F:8E:76:60:E8:D5","sha256":"F0:D0:F6:8E:83:04:8E:C8:EE:0B:C4:04:A6:D5:23:AB:52:72:1C:29:C5:76:13:3B:07:F4:8C:6A:29:52:FA:25"}}},"request":{"raw":"GET /match?dp=450\u0026tc=1\u0026euid=BHjoFMmspYBR5WjtJZXygGD24s HTTP/1.1\r\nHost: mc.acint.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: test_cookie=CheckForPermission; aid=fwAACWmazfuwCAks+HV/Ahav4PgmNM6x8YWKaNslRlNT7txu\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: openresty\r\ndate: Sun, 22 Feb 2026 09:35:55 GMT\r\ncontent-type: text/html\r\ncontent-length: 154\r\nlocation: https://exchange.buzzoola.com/cookiesync/dsp/sape-banner?uid=0900007FFBCD9A692C0908B0027F75F8\u0026url=https%3A%2F%2Fmc.acint.net%2Fmatch%3Fdp%3D126%26euid%3D%24%7BUUID%7D%26aid%3D0900007FFBCD9A692C0908B0027F75F8\r\nset-cookie: cSyncDp126v3=1771752955; expires=Tue, 24-Mar-26 09:35:55 GMT; path=/; Secure; SameSite=None; domain=.acint.net\r\nexpires: Wed, 19 Apr 2000 11:43:00 GMT\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T22:47:04.158538Z","times_seen":13349726,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}