{"report_id":"7a36dd2c-6e22-4ce2-ba22-6287fe251473","version":0,"status":"done","tags":[],"date":"2026-07-02T07:47:06Z","url":{"schema":"http","addr":"slon10.cc/","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":0,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"final":{"url":{"schema":"https","addr":"captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"title":"Captcha","dom":{"size":19785,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15073)","md5":"fb832f57843200386d41f06f991d5cf7","sha1":"683fa837fc26a0f52db5b923134be42040a71b97","sha256":"d2a985fd90e97c2fa8e6cf4f2fa6866c07d8b00b5c5690d1f9c40b597cd98c0d","sha512":"4fcbd837b747d47116ee3b41ec30542f7c7e0d252e1c9ecddc9f25d77ba5ab2121a385920a82db374b63158d839a8d58e08c34ac4ffdbac7ad8f8d9ad50c301b","ssdeep":"384:f5pnAnFB01b2Omq+Fb1zsBZjN3vqxXKe7S+NS8Fx:fWFm2O3+J1zw4ZbNS8Fx","tlshash":"ca92af567d8328c52a42d07c67e92a475c8c0817c106e5f87f9d26c88fcb9dd9ab3b4d","dom_hash":"domhashc52374264a31a8db631165d44312f1a3","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"slon10.cc/","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":0,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-06T07:47:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-02","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"slon10.cc/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-02","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"captcha.slon10.cc/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-06-28T22:22:13.875484Z","alert_count":0,"request_count":1,"received_data":10792,"sent_data":533,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"captcha.slon10.cc","ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"domain_registered":"2026-02-11","domain_rank":0,"first_seen":"2026-07-02T07:47:07.517349Z","last_seen":"2026-07-02T07:47:07.517349Z","alert_count":20,"request_count":9,"received_data":537871,"sent_data":7754,"comment":"","tags":null,"fingerprints":null},{"fqdn":"slon10.cc","ip":{"addr":"163.171.134.56","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"domain_registered":"2026-02-11","domain_rank":0,"first_seen":"2026-03-28T04:52:46.384186Z","last_seen":"2026-05-26T18:20:56.780111Z","alert_count":13,"request_count":6,"received_data":262622,"sent_data":3527,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-06-28T22:19:26.805281Z","alert_count":0,"request_count":2,"received_data":68877,"sent_data":1155,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"slon10.cc/_fec_sbu/hxk_fec_16b50213.js","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"163.171.134.56","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","size":254298,"data":"","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-22T06:45:36.63647Z","times_seen":75,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-02","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"slon10.cc/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/_fec_sbu/fec_wrapper.js","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"8246973e58d495706f61b0bc8ef8e296","sha1":"5f4f0fd49e593185b87581a730eceb62e0cc3121","sha256":"6af7b078c123c0005293e83cd7afdded4683e38f39161af492cb68c659803d22","sha512":"014a4bed34b18effea2ec247c0789653855dde3a4dd076409c8a221d758023e8be6d51c50562df812994d63b85d090cfb4872d8fe0141ff00adc7f1619bb67e7","ssdeep":"","tlshash":"62e0ab5bc59e1d1236d1cad3d2fa38b5e8a8e0a5740e8c1168283cd23099182901f19b","size":419,"data":"","first_seen":"2026-07-02T07:47:09.506827Z","last_seen":"2026-07-02T07:47:09.506827Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/_fec_sbu/hxk_fec_16b50213.js","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","size":254298,"data":"","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-22T06:45:36.63647Z","times_seen":75,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-02","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"captcha.slon10.cc/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/_fec_sbu/fec_wrapper.js","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"6aa60bf554e8b1f9db7ecb4c6768fff6","sha1":"108a1de1f43b5047ae3e205b038e74a73f8c3653","sha256":"c2fd79cf69b218d0ebad9c274b15d822dd618d0d94ffcbbd98eac04046402b58","sha512":"7a70259cc7bb9834513ff99e86300d14d3997f1c43833a883d8842d8f41dc93bc5d12a848981f133fd64bdea634fb1f0425ef2929fb27fcd9bce6e466e10195a","ssdeep":"","tlshash":"1be0ab93d4be750af0f5806591ec61fb8418f2b40544458a48e9f1f85144516511712b","size":419,"data":"","first_seen":"2026-07-02T07:47:09.519103Z","last_seen":"2026-07-02T07:47:09.519103Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"slon10.cc/_fec_sbu/fec_wrapper.js","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"163.171.134.56","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"e19f1a293b9a1c871168f9330c5f03a4","sha1":"61c2e6ef8eb0c802b9973062a080e16587c88c26","sha256":"3483e5ae3bdc2a41715f71593b0e1b267c3f649c9929f89649631a66d10a994d","sha512":"26a56f93b197a955fff5634ba89f20554665b623ae3c18c1d6ffe10b560b96261b645b80fe465a65e44bf8901883ade9ab52dd11a4c6f8eb688710809c9795e8","ssdeep":"","tlshash":"32e0f12cd4254d80e9c4469080f6dffbfe0e2662818cf4146a2bed7a99f9620e009531","size":419,"data":"","first_seen":"2026-07-02T07:47:09.522524Z","last_seen":"2026-07-02T07:47:09.522524Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"captcha.slon10.cc/_fec_sbu/fec_wrapper.js","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:44.216Z","timestamp":1782978404216,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET /_fec_sbu/fec_wrapper.js HTTP/1.1\r\nHost: captcha.slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/\r\nCookie: FECW=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; FECWS=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:44 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 VM-ARN-01AFE29:3 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nx-ws-request-id: 6a461764_VM-ARN-01AFE29_21165-36960\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":419,"size_decoded":689,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (361)","md5":"8246973e58d495706f61b0bc8ef8e296","sha1":"5f4f0fd49e593185b87581a730eceb62e0cc3121","sha256":"6af7b078c123c0005293e83cd7afdded4683e38f39161af492cb68c659803d22","sha512":"014a4bed34b18effea2ec247c0789653855dde3a4dd076409c8a221d758023e8be6d51c50562df812994d63b85d090cfb4872d8fe0141ff00adc7f1619bb67e7","ssdeep":"","tlshash":"62e0ab5bc59e1d1236d1cad3d2fa38b5e8a8e0a5740e8c1168283cd23099182901f19b","first_seen":"2026-07-02T07:47:09.506827Z","last_seen":"2026-07-02T07:47:09.506827Z","times_seen":1,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/_fec_sbu/hxk_fec_16b50213.js","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:44.217Z","timestamp":1782978404217,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET /_fec_sbu/hxk_fec_16b50213.js HTTP/1.1\r\nHost: captcha.slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/\r\nCookie: FECW=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; FECWS=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:44 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 VM-ARN-01AFE29:7 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nx-ws-request-id: 6a461764_VM-ARN-01AFE29_21999-15361\r\nCache-Control: no-cache\r\netag: _16b50213\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":254298,"size_decoded":73437,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (36088)","md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-22T06:45:36.63647Z","times_seen":75,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":8,"send":0,"wait":23,"receive":8,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-02","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"captcha.slon10.cc/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/favicon.ico","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:44.400Z","timestamp":1782978404400,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: captcha.slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/\r\nCookie: FECWS=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; FECAS=2JpujsQrTfAWee7lwNxfxVSPe7s+6lU/YuHzezi/wt3TbGx/WtaRH6z7Bp0ms5bHmIHMfQXMFSuKK2Ej2c9mG3vjC0bzVzCGTA1Sp8O2u0UWN/jCrIhkb9/NpozMKA0kvUREWRl2y/3DFX6wh3BA9C8uZEi/ycFklA8PqcopdpRV3ucXM09Al4KrBS2/3Bodad\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:44 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nAge: 30317\r\nx-ws-request-id: 6a461764_VM-ARN-01AFE29_21999-15362\r\nvia: 1.1 VM-ARN-01AFE29:7 (W)\r\nX-Px: ht VM-ARN-01AFE29ARN\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":247,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T23:24:29.742848Z","times_seen":17463020,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-02T07:46:44.446Z","timestamp":1782978404446,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET /?ref=slon10.cc\u0026shop2go=/ HTTP/1.1\r\nHost: captcha.slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/\u0026ws_referrer_origin=http%3A%2F%2Fslon10.cc%2F\r\nCookie: FECWS=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; FECAS=2JpujsQrTfAWee7lwNxfxVSPe7s+6lU/YuHzezi/wt3TbGx/WtaRH6z7Bp0ms5bHmIHMfQXMFSuKK2Ej2c9mG3vjC0bzVzCGTA1Sp8O2u0UWN/jCrIhkb9/NpozMKA0kvUREWRl2y/3DFX6wh3BA9C1tNYwP3YdWf5mJAL6UsHlnURYnVCZ93etRviJC2A75ad\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Thu, 02 Jul 2026 07:46:44 GMT\r\nContent-Type: text/html;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nSet-Cookie: route=6; Expires=Fri, 03-Jul-2026 07:35:08 GMT; Path=/\nserver_id=csrv_17\nuser_id=\r\nContent-Language: en-US\r\nvia: 1.1 VM-ARN-01AFE29:7 (W)\r\nX-Px: ms VM-ARN-01AFE29ARN(origin)\r\nx-ws-request-id: 6a461764_VM-ARN-01AFE29_21999-15364\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":19795,"size_decoded":13605,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15074)","md5":"d2f9fa075b746a42ecbb5499060b7a5a","sha1":"ead1d981c8ad51da17bb925d6fe94879d45adfdf","sha256":"86bb7d127d35078a97d477cdfd029d4e8ca9b8a8ab32c125b2fc9329a5603293","sha512":"88e21f0eaf5ca0f63d454cf9cce595ed90ff93d0ccf44993cf34ba8e352af231f6af9aa65629c57eec3c0907104ecbcc4b3ebf6f95c33dcb5b82e563b866f048","ssdeep":"384:RjAnAnFB01b2Omq+Fb1zsBZjN3vqxXKe7S+W8JFc:RTFm2O3+J1zw4ZbW8JFc","tlshash":"bb92af567c8328c52a42d07c27e92a475c8c0417c206e5f87f9d25d88fcb9dd9ab3b4d","first_seen":"2026-07-02T07:47:09.510421Z","last_seen":"2026-07-02T07:47:09.510421Z","times_seen":1,"resource_available":true,"data":null}},"time_used":115,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/css/normalize.css","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:44.843Z","timestamp":1782978404843,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET /css/normalize.css HTTP/1.1\r\nHost: captcha.slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/\r\nCookie: FECWS=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; FECAS=2JpujsQrTfAWee7lwNxfxVSPe7s+6lU/YuHzezi/wt3TbGx/WtaRH6z7Bp0ms5bHmIHMfQXMFSuKK2Ej2c9mG3vjC0bzVzCGTA1Sp8O2u0UWN/jCrIhkb9/NpozMKA0kvUREWRl2y/3DFX6wh3BA9CwuqOcZvQldhiDl6H+39iPh7TBOdCZP001FPoMqRlTX9d; route=6; server_id=csrv_17; user_id=\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:44 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nLast-Modified: Sat, 18 Apr 2026 15:43:37 GMT\r\nAccept-Ranges: bytes\r\nAge: 30968\r\nx-ws-request-id: 6a461764_VM-ARN-01AFE29_21999-15368\r\nvia: 1.1 VM-ARN-01AFE29:7 (W)\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":4461,"size_decoded":1771,"mime_type":"text/css","magic":"ASCII text","md5":"aab74d6ca10a0902b9fac0e304c4be13","sha1":"7cc28584e1cd4acf258f32322b198faa19e2c47c","sha256":"6b1e238b3810eef313f24f098db4d880175b3ed1168f0c9faaaff9b53089c2fa","sha512":"8908ebef958dec57ec62f0841a1631bfa992ce53e13a55fe00686f1c3ecabedfb662d50d5e567c69c03b0470de149c2bddeaa1a9f9903cfce4bdccfc5ffe1d27","ssdeep":"48:z2Gaml89fIcJq7e/BQLQ1nrnccRjXdmnm/IZvJzXsacPaQfk:KM89fI6z/tTnWHO1c","tlshash":"549151651b604f11522b4e38339beb1533188233895d38ececa199edcf8675bd6d17ca","first_seen":"2023-04-18T10:14:13Z","last_seen":"2026-07-22T17:23:02.6637Z","times_seen":1259,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon10.cc/","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"163.171.134.56","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-02T07:46:43.352Z","timestamp":1782978403352,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 406 Not Acceptable\r\nDate: Thu, 02 Jul 2026 07:46:43 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 VM-ARN-01AFE29:2 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nx-ws-request-id: 6a461763_VM-ARN-01AFE29_20978-62178\r\nCache-Control: no-store\r\nSet-Cookie: FECW=6194560772753a51f8cd6e9f60f9d083028bb14d369058675be3f5e01a6e7aa5457c48b1a82b9332eefc2e5f3f3b655f9522418628e7e97ca836580080b343a43c8721c89c5349e0d5cd486f1234578158; Expires=Sun, 29-Jun-36 07:46:43 GMT; Path=/; Secure\nFECWS=6194560772753a51f8cd6e9f60f9d083028bb14d369058675be3f5e01a6e7aa5457c48b1a82b9332eefc2e5f3f3b655f9522418628e7e97ca836580080b343a43c8721c89c5349e0d5cd486f1234578158; Expires=Sun, 29-Jun-36 07:46:43 GMT; Path=/; Secure; SameSite=None\r\n\r\n","headers":null,"cookies":null,"status_code":"406","status_text":"Not Acceptable","fingerprints":null,"data":{"size":595,"size_decoded":1372,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (397)","md5":"c1e6ad2cdd52829cc1238302b315aaae","sha1":"06f800090fce1ef076f76ed9e1f011bc8154ef07","sha256":"e622462e8c724e2c3f66256c941161c00397d5e58f37dd4e51c376230723d9ec","sha512":"019a6d7d61d43aba123fc34a72f15ed1e59f8e2cd0d6386a4b5718831fbca8bc87ac24f82954eaa90ba1106edcd1844061fcfb53cd7d552c02794fd618ce89a0","ssdeep":"","tlshash":"87f0414eca68fa644416da5c7cf1776a04480a9a9690c82133c3a21e239cfe82ec1409","first_seen":"2026-07-02T07:47:09.512404Z","last_seen":"2026-07-02T07:47:09.512404Z","times_seen":1,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":3,"connect":8,"send":0,"wait":13,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"slon10.cc/favicon.ico","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"163.171.242.132","port":80,"asn":54994,"as":"ML-1432-54994","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://slon10.cc/","date":"2026-07-02T07:46:43.913Z","timestamp":1782978403913,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://slon10.cc/\r\nCookie: FECN=6194560772753a51f8cd6e9f60f9d083028bb14d369058675be3f5e01a6e7aa572204177398ee362acdd706d065a36b2abf6e56e13bf5cb60c946b4ab308524d9e762c0907e1d3a5a76307e3d91a175b11; FECG=7t/8xQuj7eDyY1niRT0fZYdbMEbaT/0RnMkrpWRQW+hkvmXDIPYeIIQxxStadrSg2SrFEHhHKfbDltex8q5bzcpPjx/otiIdhtLhMJ5rg0UNK5lEmL9A8bPMNkg0KFGUz/2hzoB59oOdSyZzLtuSvllrs3w9zGd2iw1gXN+dxYXk4Oc7yXGM0xiZrQrvQJAJY3\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:43 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 3870\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nLast-Modified: Tue, 02 Jun 2026 19:32:42 GMT\r\nETag: \"6a1f2fda-f1e\"\r\nAccept-Ranges: bytes\r\nAge: 21995\r\nx-ws-request-id: 6a461763_PSdgflkfFRA1pa237_13982-52452\r\nvia: 1.1 PSdgflkfFRA1pa237:21 (W)\r\nX-Px: ht PSdgflkfFRA1pa237FRA\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3870,"size_decoded":4248,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 4 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 32 bits/pixel, 24x24 with \n- PNG image data, 24 x 24, 8-bit colormap, non-interlaced, 32 bits/pixel","md5":"c92b85a5b907c70211f4ec25e29a8c4a","sha1":"1120538c77ad1f28a89243b4b53fe2ac16cc3bc6","sha256":"3d10f7da6c603178340081668c4ac5b3ae9743ca9a262ab0fcd312fbb9f48bdd","sha512":"d792613e3c31d3aea08ae9ce51a26498afed8b48c93290640c64d0a23edc85e524bc1d090b5ba3fa161b3f2f7d31f9d1da5db77b14189fc3f8ed81ff830fa70c","ssdeep":"","tlshash":"26815cb31b994539e5cb0317fa069036d8f1d11e09b5493e1a938c05ad2fe99c26a36e","first_seen":"2023-04-12T20:45:07Z","last_seen":"2026-07-22T22:22:33.859543Z","times_seen":11253,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"slon10.cc/","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"163.171.242.132","port":80,"asn":54994,"as":"ML-1432-54994","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-02T07:46:43.953Z","timestamp":1782978403953,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://slon10.cc/?ws_referrer_origin=ws_referrer_delete\r\nCookie: FECN=6194560772753a51f8cd6e9f60f9d083028bb14d369058675be3f5e01a6e7aa572204177398ee362acdd706d065a36b2abf6e56e13bf5cb60c946b4ab308524d9e762c0907e1d3a5a76307e3d91a175b11; FECG=7t/8xQuj7eDyY1niRT0fZYdbMEbaT/0RnMkrpWRQW+hkvmXDIPYeIIQxxStadrSg2SrFEHhHKfbDltex8q5bzcpPjx/otiIdhtLhMJ5rg0UNK5lEmL9A8bPMNkg0KFGUz/2hzoB59oOdSyZzLtuSvlleOib+fMtG35yTEUpu1mQ6brq4ZnTU09TTiTIZrTsI+3\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nDate: Thu, 02 Jul 2026 07:46:44 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nLocation: https://captcha.slon10.cc?ref=slon10.cc\u0026shop2go=/\r\nSet-Cookie: server=;Max-Age=1\ncaptcha_uid=;Max-Age=1\r\nvia: 1.1 PSdgflkfFRA1pa237:21 (W)\r\nX-Px: ms PSdgflkfFRA1pa237FRA(origin)\r\nx-ws-request-id: 6a461763_PSdgflkfFRA1pa237_13982-52454\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Moved Temporarily","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T23:24:29.742848Z","times_seen":17463020,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-02T07:46:44.084Z","timestamp":1782978404084,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET /?ref=slon10.cc\u0026shop2go=/ HTTP/1.1\r\nHost: captcha.slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://slon10.cc/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 406 Not Acceptable\r\nDate: Thu, 02 Jul 2026 07:46:44 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 VM-ARN-01AFE29:3 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nx-ws-request-id: 6a461764_VM-ARN-01AFE29_21165-36959\r\nCache-Control: no-store\r\nSet-Cookie: FECW=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; Expires=Sun, 29-Jun-36 07:46:44 GMT; Path=/; Secure\nFECWS=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; Expires=Sun, 29-Jun-36 07:46:44 GMT; Path=/; Secure; SameSite=None\r\n\r\n","headers":null,"cookies":null,"status_code":"406","status_text":"Not Acceptable","fingerprints":null,"data":{"size":637,"size_decoded":1414,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (397)","md5":"3cfdb762d93c83ccbc3efa97c9e077fe","sha1":"3106885c864051645d248a7a5b83aba7840398a3","sha256":"17528ee393ea66e3873c9df697de13e17fe3d5c3b5194e74240fa0f589d9a073","sha512":"1a2f1462256f4d7e61b5be4395ed40158c10f6bdb3e34227931c59e636183e3a318b7bb6a51b898cd858ccd333ba709044b4e5522c4c241807a458cee0f3e4b3","ssdeep":"","tlshash":"bbf0b71fc464f7a89384ad5d78f894a7c6411191d5a18903efc56206a7dc7ec8f41604","first_seen":"2026-07-02T07:47:09.51588Z","last_seen":"2026-07-02T07:47:09.51588Z","times_seen":1,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":0,"dns":3,"connect":8,"send":0,"wait":13,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/_fec_sbu/hxk_fec_16b50213.js","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:44.619Z","timestamp":1782978404619,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET /_fec_sbu/hxk_fec_16b50213.js HTTP/1.1\r\nHost: captcha.slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/\r\nCookie: FECWS=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; FECAS=2JpujsQrTfAWee7lwNxfxVSPe7s+6lU/YuHzezi/wt3TbGx/WtaRH6z7Bp0ms5bHmIHMfQXMFSuKK2Ej2c9mG3vjC0bzVzCGTA1Sp8O2u0UWN/jCrIhkb9/NpozMKA0kvUREWRl2y/3DFX6wh3BA9CwuqOcZvQldhiDl6H+39iPh7TBOdCZP001FPoMqRlTX9d; route=6; server_id=csrv_17; user_id=\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:44 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 VM-ARN-01AFE29:3 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nx-ws-request-id: 6a461764_VM-ARN-01AFE29_21165-36964\r\nCache-Control: no-cache\r\netag: _16b50213\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":254298,"size_decoded":73437,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (36088)","md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-22T06:45:36.63647Z","times_seen":75,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-02","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"captcha.slon10.cc/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:45.016Z","timestamp":1782978405016,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:01 GMT","end":"Mon, 07 Sep 2026 08:41:00 GMT"},"fingerprint":{"sha1":"01:31:A1:A6:4F:08:45:E1:F0:0B:CE:B1:B8:D8:61:D7:D1:70:ED:6F","sha256":"29:C5:5D:01:47:6E:72:F7:2C:CC:0B:96:BB:67:BA:39:CC:03:11:EB:7B:47:F5:3F:CC:DE:12:AC:68:07:A1:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://captcha.slon10.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 26 Jun 2026 18:21:45 GMT\r\nexpires: Sat, 26 Jun 2027 18:21:45 GMT\r\ncache-control: public, max-age=31536000\r\nage: 480300\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":18720,"size_decoded":19533,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-07-22T23:42:37.596721Z","times_seen":10982,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":30,"dns":0,"connect":0,"send":0,"wait":21,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"slon10.cc/_fec_sbu/hxk_fec_16b50213.js","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"163.171.242.132","port":80,"asn":54994,"as":"ML-1432-54994","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://slon10.cc/","date":"2026-07-02T07:46:43.678Z","timestamp":1782978403678,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /_fec_sbu/hxk_fec_16b50213.js HTTP/1.1\r\nHost: slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://slon10.cc/\r\nCookie: FECN=6194560772753a51f8cd6e9f60f9d083028bb14d369058675be3f5e01a6e7aa572204177398ee362acdd706d065a36b2abf6e56e13bf5cb60c946b4ab308524d9e762c0907e1d3a5a76307e3d91a175b11\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:43 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 PSdgflkfFRA1pa237:21 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht PSdgflkfFRA1pa237FRA\r\nx-ws-request-id: 6a461763_PSdgflkfFRA1pa237_13982-52434\r\nCache-Control: no-cache\r\netag: _16b50213\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":254298,"size_decoded":73447,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (36088)","md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-22T06:45:36.63647Z","times_seen":75,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":20,"send":0,"wait":31,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-02","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"slon10.cc/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/_fec_sbu/fec_wrapper.js","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:44.618Z","timestamp":1782978404618,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET /_fec_sbu/fec_wrapper.js HTTP/1.1\r\nHost: captcha.slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/\r\nCookie: FECWS=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; FECAS=2JpujsQrTfAWee7lwNxfxVSPe7s+6lU/YuHzezi/wt3TbGx/WtaRH6z7Bp0ms5bHmIHMfQXMFSuKK2Ej2c9mG3vjC0bzVzCGTA1Sp8O2u0UWN/jCrIhkb9/NpozMKA0kvUREWRl2y/3DFX6wh3BA9CwuqOcZvQldhiDl6H+39iPh7TBOdCZP001FPoMqRlTX9d; route=6; server_id=csrv_17; user_id=\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:44 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 VM-ARN-01AFE29:7 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nx-ws-request-id: 6a461764_VM-ARN-01AFE29_21999-15366\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":419,"size_decoded":689,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (361)","md5":"6aa60bf554e8b1f9db7ecb4c6768fff6","sha1":"108a1de1f43b5047ae3e205b038e74a73f8c3653","sha256":"c2fd79cf69b218d0ebad9c274b15d822dd618d0d94ffcbbd98eac04046402b58","sha512":"7a70259cc7bb9834513ff99e86300d14d3997f1c43833a883d8842d8f41dc93bc5d12a848981f133fd64bdea634fb1f0425ef2929fb27fcd9bce6e466e10195a","ssdeep":"","tlshash":"1be0ab93d4be750af0f5806591ec61fb8418f2b40544458a48e9f1f85144516511712b","first_seen":"2026-07-02T07:47:09.519103Z","last_seen":"2026-07-02T07:47:09.519103Z","times_seen":1,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon10.cc/favicon.ico","fqdn":"captcha.slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:45.007Z","timestamp":1782978405007,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slon10.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 09:53:22 GMT","end":"Wed, 23 Sep 2026 09:53:21 GMT"},"fingerprint":{"sha1":"9C:62:86:D5:10:2E:87:65:12:DF:B6:71:7A:F2:6B:79:7D:6F:3E:FA","sha256":"92:AE:D3:6A:B8:69:4A:9B:CB:C2:BD:64:6F:3E:1D:49:8D:9D:2D:70:F6:F3:DE:87:48:7C:28:65:28:62:A6:0E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: captcha.slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/\r\nCookie: FECWS=42e7cc548efc42641a9f5ea463f6979b95c752d53f1d6d83e32b4236d7b500190f6fa91c9f7076315f6a7d55c5abda398644d7e5eb43bbbd88da57dcb34c50bcf78a3cd05cfd75c053ef2c5be5ab42ab69; FECAS=2JpujsQrTfAWee7lwNxfxVSPe7s+6lU/YuHzezi/wt3TbGx/WtaRH6z7Bp0ms5bHmIHMfQXMFSuKK2Ej2c9mG3vjC0bzVzCGTA1Sp8O2u0UWN/jCrIhkb9/NpozMKA0kvUREWRl2y/3DFX6wh3BA9CyVY/XuVbXzUUF+bKNro4ZGvK4UURRZhkZ4UgMOR3zyDd; route=6; server_id=csrv_17; user_id=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:45 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nAge: 30318\r\nx-ws-request-id: 6a461765_VM-ARN-01AFE29_21165-36966\r\nvia: 1.1 VM-ARN-01AFE29:3 (W)\r\nX-Px: ht VM-ARN-01AFE29ARN\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":247,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T23:24:29.742848Z","times_seen":17463020,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"captcha.slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:45.014Z","timestamp":1782978405014,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:01 GMT","end":"Mon, 07 Sep 2026 08:41:00 GMT"},"fingerprint":{"sha1":"01:31:A1:A6:4F:08:45:E1:F0:0B:CE:B1:B8:D8:61:D7:D1:70:ED:6F","sha256":"29:C5:5D:01:47:6E:72:F7:2C:CC:0B:96:BB:67:BA:39:CC:03:11:EB:7B:47:F5:3F:CC:DE:12:AC:68:07:A1:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://captcha.slon10.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 02 Jul 2026 01:48:31 GMT\r\nexpires: Fri, 02 Jul 2027 01:48:31 GMT\r\ncache-control: public, max-age=31536000\r\nage: 21494\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49344,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-22T23:29:08.993954Z","times_seen":242921,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":32,"send":0,"wait":17,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"slon10.cc/","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"163.171.242.132","port":80,"asn":54994,"as":"ML-1432-54994","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-02T07:46:43.517Z","timestamp":1782978403517,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 406 Not Acceptable\r\nDate: Thu, 02 Jul 2026 07:46:43 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 PSdgflkfFRA1pa237:21 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht PSdgflkfFRA1pa237FRA\r\nx-ws-request-id: 6a461763_PSdgflkfFRA1pa237_13982-52424\r\nCache-Control: no-store\r\nSet-Cookie: FECN=6194560772753a51f8cd6e9f60f9d083028bb14d369058675be3f5e01a6e7aa572204177398ee362acdd706d065a36b2abf6e56e13bf5cb60c946b4ab308524d9e762c0907e1d3a5a76307e3d91a175b11; Expires=Sun, 29-Jun-36 07:46:43 GMT; Path=/\r\n\r\n","headers":null,"cookies":null,"status_code":"406","status_text":"Not Acceptable","fingerprints":null,"data":{"size":595,"size_decoded":1137,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (397)","md5":"615803c16fe6dae41f4c56b814d8edf5","sha1":"b89db46f1e4b8945d4908a0d2c71f081b68d5859","sha256":"33108dc28974b4568169f73e1f683f11d99df41f06a16737d22e778f93af9a30","sha512":"19ed56ca6bfb09ad12fbd7cd85e8934b506dba5c950cbee6ce7460727ae5240b329d0709c6b43eee5b20d5bee57a60573a1a4d5282198c3ca11d4088af15c1a7","ssdeep":"","tlshash":"38f0024d8894a445824448f86cfca07e8c805644dfc085a57ad5a0a1bb967fc2d04208","first_seen":"2026-07-02T07:47:09.521286Z","last_seen":"2026-07-02T07:47:09.521286Z","times_seen":1,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":16,"connect":19,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"slon10.cc/_fec_sbu/fec_wrapper.js","fqdn":"slon10.cc","domain":"slon10.cc","tld":"cc"},"ip":{"addr":"163.171.242.132","port":80,"asn":54994,"as":"ML-1432-54994","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://slon10.cc/","date":"2026-07-02T07:46:43.673Z","timestamp":1782978403673,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /_fec_sbu/fec_wrapper.js HTTP/1.1\r\nHost: slon10.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://slon10.cc/\r\nCookie: FECN=6194560772753a51f8cd6e9f60f9d083028bb14d369058675be3f5e01a6e7aa572204177398ee362acdd706d065a36b2abf6e56e13bf5cb60c946b4ab308524d9e762c0907e1d3a5a76307e3d91a175b11\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 02 Jul 2026 07:46:43 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 PSdgflkfFRA1pa237:21 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht PSdgflkfFRA1pa237FRA\r\nx-ws-request-id: 6a461763_PSdgflkfFRA1pa237_13982-52431\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":419,"size_decoded":699,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (361)","md5":"e19f1a293b9a1c871168f9330c5f03a4","sha1":"61c2e6ef8eb0c802b9973062a080e16587c88c26","sha256":"3483e5ae3bdc2a41715f71593b0e1b267c3f649c9929f89649631a66d10a994d","sha512":"26a56f93b197a955fff5634ba89f20554665b623ae3c18c1d6ffe10b560b96261b645b80fe465a65e44bf8901883ade9ab52dd11a4c6f8eb688710809c9795e8","ssdeep":"","tlshash":"32e0f12cd4254d80e9c4469080f6dffbfe0e2662818cf4146a2bed7a99f9620e009531","first_seen":"2026-07-02T07:47:09.522524Z","last_seen":"2026-07-02T07:47:09.522524Z","times_seen":1,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-02","alert":"Sinkholed","trigger":"slon10.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@300;400;500;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://captcha.slon10.cc/?ref=slon10.cc\u0026shop2go=/","date":"2026-07-02T07:46:44.837Z","timestamp":1782978404837,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:02 GMT","end":"Mon, 07 Sep 2026 08:41:01 GMT"},"fingerprint":{"sha1":"FD:DA:E1:3E:1F:AC:E0:96:14:ED:37:58:30:0F:ED:9D:B4:5E:F1:EF","sha256":"7D:36:0C:A4:14:F6:05:8D:F4:E1:CD:BF:84:A7:03:AD:3F:C4:93:AE:B3:D6:7E:99:CB:92:D7:1F:29:A1:49:A4"}}},"request":{"raw":"GET /css2?family=Inter:wght@300;400;500;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon10.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Thu, 02 Jul 2026 07:46:44 GMT\r\ndate: Thu, 02 Jul 2026 07:46:44 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":1446,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"1be305145d51ecbeb52ba67f2208dea9","sha1":"6f97fc00e9d6771004cb17d53c7ff7d62011e78e","sha256":"5fb68a19bfedc1331144c73515b5cc021af26ac8605c62e73a31771a0e19ee62","sha512":"b3a73238231bbeeaf01907f0e3a78d4221d24b50de71345c66a6d6a4ff6afb5fd8d88b242a57ba35d37f0466edc6d3a19c7e02dfd4563d2ee565ca2cc06182c6","ssdeep":"192:wNA1cO3lnxirNNIxO34OxDENOPCO3/Nx8ONEhYO3RrxGx:8KYXuM1+4","tlshash":"dd227792002ba400ab971dc233cf7f3aaece10896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-11T03:25:11.707221Z","last_seen":"2026-07-22T17:23:02.660568Z","times_seen":3975,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":34,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}