{"report_id":"7f590787-6c75-4d80-b8be-c3d7f7a79039","version":6,"status":"done","tags":[],"date":"2025-12-08T00:59:21Z","url":{"schema":"http","addr":"pahe.mewcdn.online/UBFaK","fqdn":"pahe.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"kwik.mewcdn.online/f/7HUhhvFhV7eN","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"title":"AnimePahe_One_Piece_-_1152_1080p_SubsPlease.mp4 :: Kwik","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"pahe.mewcdn.online/UBFaK","fqdn":"pahe.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-12T00:59:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":20}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-12-08T00:58:59Z","timestamp":1765155539,"ip_dst":{"addr":"13.216.152.137","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.16","port":59622,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Commonly Actor Abused Domain (image .thum .io in TLS SNI)","source":"{\"timestamp\":\"2025-12-08T00:58:59.810815+0000\",\"flow_id\":1862150227457711,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":59622,\"dest_ip\":\"13.216.152.137\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2055845,\"rev\":1,\"signature\":\"ET INFO Observed Commonly Actor Abused Domain (image .thum .io in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_09_13\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\",\"TA_Abused_Service\"],\"updated_at\":[\"2024_09_13\"]}},\"tls\":{\"sni\":\"image.thum.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":3168,\"start\":\"2025-12-08T00:58:59.620207+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"cr.fretumlimpsey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"cr.fretumlimpsey.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"cr.fretumlimpsey.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"pahe.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"recordedthereby.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"recordedthereby.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"recordedthereby.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"recordedthereby.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"professionaltrafficmonitor.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-01-23","domain_rank":16376,"first_seen":"2025-01-25T08:56:07.448138Z","last_seen":"2025-11-30T19:30:07.64166Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":459,"comment":"","tags":null,"fingerprints":null},{"fqdn":"static.cloudflareinsights.com","ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-08-30","domain_rank":4073,"first_seen":"2019-09-24T14:34:56Z","last_seen":"2025-12-07T22:18:21.627912Z","alert_count":0,"request_count":1,"received_data":20344,"sent_data":514,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"pahe.mewcdn.online","ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":17262,"sent_data":492,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"recordedthereby.com","ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2024-05-08","domain_rank":58199,"first_seen":"2024-05-08T15:24:45Z","last_seen":"2025-11-29T09:26:56.194788Z","alert_count":4,"request_count":1,"received_data":85957,"sent_data":417,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cr.fretumlimpsey.com","ip":{"addr":"188.42.241.189","port":443,"asn":7979,"as":"SERVERS-COM","country":"Luxembourg","country_code":"LU"},"domain_registered":"2025-06-23","domain_rank":0,"first_seen":"2025-07-20T06:57:41.030564Z","last_seen":"2025-08-25T18:25:57.04925Z","alert_count":3,"request_count":1,"received_data":1424,"sent_data":435,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"4e","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":0,"sent_data":469,"comment":"","tags":null,"fingerprints":null},{"fqdn":"flushpersist.com","ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2025-07-01","domain_rank":23810,"first_seen":"2025-07-08T10:43:12.76905Z","last_seen":"2025-12-03T06:32:40.66545Z","alert_count":3,"request_count":1,"received_data":530,"sent_data":769,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"voraciousinfosag.com","ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-10-21","domain_rank":4823768,"first_seen":"2025-12-02T15:47:42.676854Z","last_seen":"2025-12-02T15:47:55.686775Z","alert_count":8,"request_count":2,"received_data":1071,"sent_data":1048,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-12-07T22:25:46.118111Z","alert_count":0,"request_count":2,"received_data":257303,"sent_data":918,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"e1","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-07-24T20:03:27.16602Z","last_seen":"2025-07-24T20:03:27.16602Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":435,"comment":"","tags":null,"fingerprints":null},{"fqdn":"kwik.mewcdn.online","ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":14,"received_data":775949,"sent_data":12827,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}]},{"fqdn":"pahe.win","ip":{"addr":"172.67.202.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-04-16","domain_rank":93392,"first_seen":"2020-04-16T13:12:36Z","last_seen":"2025-11-22T22:22:38.783626Z","alert_count":5,"request_count":5,"received_data":508795,"sent_data":2188,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"plausible.io","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2018-12-30","domain_rank":8565,"first_seen":"2019-02-01T08:53:03Z","last_seen":"2025-12-01T03:53:01.154294Z","alert_count":0,"request_count":2,"received_data":4405,"sent_data":909,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"protrafficinspector.com","ip":{"addr":"18.198.241.35","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2025-06-18","domain_rank":614186,"first_seen":"2025-07-25T22:45:21.95813Z","last_seen":"2025-12-02T19:40:58.517983Z","alert_count":0,"request_count":1,"received_data":427,"sent_data":452,"comment":"","tags":null,"fingerprints":null},{"fqdn":"capaciousdrewreligion.com","ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2023-11-07","domain_rank":81073,"first_seen":"2023-11-27T12:27:45Z","last_seen":"2025-11-30T19:30:07.707848Z","alert_count":5,"request_count":1,"received_data":377,"sent_data":431,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/js/vendor/jquery.min.js","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-09-28T14:50:20.619545Z","times_seen":506433,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/f/7HUhhvFhV7eN","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4d5c739621d4dbdaf97b3d2303ece85f","sha1":"7d3d61fa7b7e87c6ce45fc7a9842fe209a8748ec","sha256":"2f95c4f90d6d0706b1acbfa0d4c878d385f15250224b3c7d726aa9a93fcfe4f8","sha512":"14edcc663dc2932164946d32bbabf1bab43003c6793ef5921d05ed70931bcf8a53de55f7f92118b40dbd8c1eb8c8dfdd56e9d7cf112aa7f87b6a2d61b70f34b7","ssdeep":"1536:4d/Xkv7A/8z4hER2jaLS/QEWUh/lJBMCtVCyxGu74cZvXicv1fbCJouw0JckG0Zk:tOERY/CyrvXicv1fbGhW","tlshash":"8fc3c84c7fa1f06cc2ba60bb232f541be0566e42555cd948f1a3f4e02f5634afa3ea54","size":125873,"data":"","first_seen":"2025-12-02T15:47:50.813328Z","last_seen":"2025-12-13T13:23:17.508409Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/hls.js@0.12.4/dist/hls.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4a3e249823c65d6c3cf865cf9d30188d","sha1":"512d1f25ead08d0d74bb19242079c948bbc295a7","sha256":"0290f0d61a6b94aca37bd874640ee172d86ec3743f3c0a611063036261074f92","sha512":"a936d61e65c8d5978701bed91454f66781b248b64b6b24efe7ee246ebe01f553661d5fc42a3180f9ffd24e67fd1c7c98b71eeeffa963e09fe719fe2816234012","ssdeep":"3072:mzJDa6zxs2g85/4NFMspf7ekTRH/9DaAV9ioPF:mzJa6tgc4NFMsJLRHdaAVxF","tlshash":"a8342ca97bb4b425438361e5403f020b733aac1db409d0bcb796e9ea1db584da53bf74","size":253140,"data":"","first_seen":"2023-03-07T01:15:08Z","last_seen":"2026-09-04T23:08:15.115509Z","times_seen":378,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a2c40942d6760132aeb848d3d14bb8b","sha1":"0daf8cf003b74a203d82f1f56982ba5f5550965d","sha256":"70003b4b1c293751ef0c4416395f8cfcfb1224e20d6868cf47d927360f6486c0","sha512":"c8e474cc636ef0bd7ed178a2eaf9754f20825d7c78d5873b19ed5473fe52afd2a6457d9196fedfffb12a3d482f9634c0b8068871f9e0fb03c53ad14835f5995d","ssdeep":"192:/AZ0e/4MS2FuzBhKEIqhh9dMRrhBpea/NCXXZggb:/4t/4kuzBhbLhLMPNqX2W","tlshash":"1322f8ce7d08301c6277306210bbf9f76029de896288dec596b2bc67aa35f781515f84","size":10342,"data":"","first_seen":"2025-12-08T00:59:29.50233Z","last_seen":"2025-12-08T01:17:03.321451Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pahe.mewcdn.online/UBFaK","fqdn":"pahe.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"846378eaef0c9fe3f5ac8f4f1d843cdf","sha1":"fabc09c385c96c79050cd8cc0a347c40d9be09c0","sha256":"fe6c293c5e83645262dea4dcbeaa32501c31167ea263bdbd713daa5e05f896bd","sha512":"5d303531691f44de306888b6d300ed16abb93a8dabc6557d623fe9c9b38273e6ad812b87cef94f9b637e9d4b5c4f4822e18aa7d25288045ca5bdb0cca9b52bbe","ssdeep":"","tlshash":"8ad05b671754a19dfd2875dc6476180d60633c07b46ed59a124c1df059d57007017aae","size":269,"data":"","first_seen":"2025-12-08T00:59:29.519514Z","last_seen":"2025-12-08T00:59:29.519514Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"6df0126af794e755cac52d9db4a5d79b","sha1":"f3496d79459dccbf1db6f605f46e7298c70e92c6","sha256":"473f99ef38a6f9b1b430ecef3210c6dd9669c1df84382951c131d85e15fb926c","sha512":"6b38bbd4e9ea3a4ce0943f81f3809219b0647ad13e77212b64e69c1ead52d646133550c3d1d341672388ab5423a0637c2edc9209f46a9b0d4a73ab4ec0b00983","ssdeep":"","tlshash":"14d023952d7689306598024770b9e3dc3f7124507711a700d1dccdaf5e11fd315b1d5c","size":217,"data":"","first_seen":"2025-12-08T00:59:29.520434Z","last_seen":"2025-12-08T00:59:29.520434Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pahe.mewcdn.online/UBFaK","fqdn":"pahe.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"8bf07f897a1f8abd2706b2497ceae4b2","sha1":"5ee10a2063fa41caec7c98ab6bd0a6ac64be0a7b","sha256":"1870640b05463895a0ab5778acc6a4845f744597be2b39a04d736cb3b2b61024","sha512":"f67d5c5552a1739a4d4932941682807a08587ca28ce0960892504fadbc7f9ccf2713af1add11ba1596ad7b93b26fa1f6a2cf43ba99010b96c1b0764052b27e9a","ssdeep":"","tlshash":"5cf0c05b4362b641dd3502913df7489a1b1d6b865863a1c49c1d50cf45d348204e08aa","size":509,"data":"","first_seen":"2025-12-02T15:47:50.827063Z","last_seen":"2025-12-13T13:23:17.510492Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plausible.io/js/script.js","fqdn":"plausible.io","domain":"plausible.io","tld":"io"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"25b5b48c4c1efed79da2c557576bff85","sha1":"f441809be456048d32225ae0d47efaf1006efbe5","sha256":"a34d5ce3e989b828c42fe4994c8c1e21693c311db3b076fcbf5202cdc505e5ac","sha512":"7e68bb787c024fb14042a4ab95b7ad5d81750b357404865fab281d16e925a0f5e5149fc46f32549f73d57fd17052ff10ce323b28eefe34cf231f29457b00aac2","ssdeep":"","tlshash":"80512db96a02757909b9d167b62fb3163a3366263116b401542cd9c13e28eefc323ecd","size":3005,"data":"","first_seen":"2025-10-28T15:34:03.371103Z","last_seen":"2026-09-28T11:40:27.034777Z","times_seen":6716,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/js/vendor/plyr.min.js","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9902ef44d0bfd3a740ecda81c569e0bf","sha1":"cb0f5c177f6cc2bbdb2dea4f17cfa78aa4a0f98e","sha256":"2c8fa9900e0d787961edb7885b11d40eb47db093155ad83fa77097d46adc28fc","sha512":"0fe4a35541bb4c291f733436dc5b47217100e2b6f13d624396d1e739b3d19c4205f2e19e77d576c816a6f3d180c437888a21fe2a5d0fff00fe1cdef3cdbe4d96","ssdeep":"1536:8posEEOZBeswPoxZ2nXKSTjq178G7Cep0lm5+7/550O3sJoP+UWkL++bekSDOBW+:8e2onChDk5UdNsVUocS9cNpf5","tlshash":"e2b3e8c3331af63281a659cee024021675398b9a7405c26cfc3cedde6968d4275b7f7a","size":109193,"data":"","first_seen":"2024-02-11T17:15:23Z","last_seen":"2026-07-10T12:00:56.280225Z","times_seen":38,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cr.fretumlimpsey.com/rQd62lQoHNRz5AjM/128435","fqdn":"cr.fretumlimpsey.com","domain":"fretumlimpsey.com","tld":"com"},"ip":{"addr":"188.42.241.189","port":443,"asn":7979,"as":"SERVERS-COM","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"848667c49f5d3aef59cd65ed276cd7ae","sha1":"bd12c0ca2dfaa249586f1b9b8d48b02a1b9e3763","sha256":"cc5a5851251dd8052292557ba0231c51363ff1474f60b7a4af3be144cb1327c8","sha512":"4248ad0e684224ba8503b1e73517aae6ffe4431cd16b7633d2ccbf4b96f845e318dbee175d19cd4676ca37353f53add2231ed167ad6c4aa0d9fe185f7359238c","ssdeep":"","tlshash":"f23000000000000000cc00000000000000000000c000000000000000000000003c0000","size":5,"data":"","first_seen":"2025-04-24T10:17:49.831301Z","last_seen":"2026-09-28T13:30:22.018817Z","times_seen":21796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"recordedthereby.com/sfp.js","fqdn":"recordedthereby.com","domain":"recordedthereby.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","size":85379,"data":"","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-09-03T10:37:11.15018Z","times_seen":27836,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"loveplumbertailor.com/c2/3c/ce/c23cce7e1ae0d23292c80bcc7276b59b.js","fqdn":"loveplumbertailor.com","domain":"loveplumbertailor.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"45fd28c4961428c3eb6dcb20ae0279da","sha1":"047c834e5cea7dd81f3ed19d7fd54d37304c307c","sha256":"2224953686d240d88cedb84118e6660af36e875ecf3a569371bfbded01e7d58d","sha512":"b240fd2dd6b08d8cb278b155373a67ae2285a02dc6b4d82cbe4db395176cea221e6e251a6e46587886e0a8c1d2c2d410b6ebaf6a5097858ed2021b3bcaeea190","ssdeep":"1536:EpOvTY8Afd1ow5ZEUjHzQSF63R2LbqKYmEqMTd01yLVH2WQgPrNQCld5h4s9imfY:qXLD33COgu+bAKjc","tlshash":"f2a3cad97f40f06d4271607a113fa00af25b0e46688cd59ce117f6a42fa865fe57ef28","size":106678,"data":"","first_seen":"2025-12-08T00:59:29.522251Z","last_seen":"2025-12-08T00:59:29.522251Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"loveplumbertailor.com/85/15/05/8515056285c72b8de772e6ef70defca8.js","fqdn":"loveplumbertailor.com","domain":"loveplumbertailor.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"ac6684fca24d7e15eac75f6a370f5faf","sha1":"d585fb358cd55484d6bd2d0de61609ad4ad927ec","sha256":"069ba032bd95aebb55cd365852a9d8b52b4915e2a2432e286e908259e1ab8cb8","sha512":"27e17e23d0e174c1a7a30b5b7120e1411ec7b915d118728c30677600d4e46ca9a6590306aa9364842a93cfaff47fc5596738de9a17a410f788e51bfed9260a32","ssdeep":"1536:h3Zs5j4xaqmOxAsZ0ob3meMv6Iqyi/+9ReO:h3Acx//xAsofv6VOn","tlshash":"3d83c88d7f99f1ac03527072722fa21ef0290d126098d1a4e253f5fdaf78729e976b14","size":81930,"data":"","first_seen":"2025-12-08T00:59:29.523066Z","last_seen":"2025-12-08T00:59:29.523066Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/f/7HUhhvFhV7eN","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"882619bca522b1c4498b395a75a35fe1","sha1":"b1ad4938da84b3c78cf691b42537548b65d43663","sha256":"008ef54237de82a2af4c74c9e15c3c62c6ca5dd3616960d6c994a7ab9d893062","sha512":"6cc84c592c830ab3ba524d6dcb7c6c058a0e642ecf7ee254c59b28338e21f47ddda6f1e00f4ec209d942b054cb56a973dae4eefdc55e3ef89074702ae093d2a3","ssdeep":"","tlshash":"7d01f92eb36f5470062b72e516cf5104213a101b3449c9963a5d46445f76ea4c1a2bde","size":756,"data":"","first_seen":"2025-12-02T15:47:50.808606Z","last_seen":"2025-12-13T13:23:17.506283Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/js/downstream.js","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1bafb19b63f8d4df9df4b37ee98181ce","sha1":"c65d58b17925b5b1f709a7996129f33eb206479f","sha256":"a748fa0745603a994e1d242efe1f91e0e3955919f788558b6c3ebc7d18d3a9bd","sha512":"413614fcdd2832e22d01877fa8b14070ff9dca8863939dffc4153d8ca757628f6be94e5aa7f3489e56b2322d1c4a8e032653a11f016d1c8961574380b36c5289","ssdeep":"96:uXnomNNgRKriZMfj4pWy4lbY6INg/FHhSg1MxUAHA/iU4mf47MUZmI6kvekC6QeP:uXom0UjOyU1g9BSg1MxUAHA/isA7MRI1","tlshash":"e2c1981c79f91870013f317a1a6f694e3a7ed047018ace41b8fd96d40fa055856b79fe","size":5990,"data":"","first_seen":"2025-01-20T03:46:45.42764Z","last_seen":"2026-07-10T12:00:56.276861Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/f/7HUhhvFhV7eN","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"44f0da2357954adff887068d6120f794","sha1":"39028f6f766274a61ebbe862607609e8f3f6c2bb","sha256":"7c4d45577c0f35bdf8f37678c0b5d4ae51d93fc7e2688f7fe758fc7691d1e8b3","sha512":"b1ddf66eb746874333ab42862155c2ba0f5e1021a766341ea0597854c1d588c7078036876b00b71d899a20ea32149e7b3110336ab6ea2ddee872a420d1f1d570","ssdeep":"","tlshash":"ea216368ce5b2d40c778a15533df9cc4288ea34420f25ecd904dcc8cd589d9935ee1e4","size":1277,"data":"","first_seen":"2025-12-02T15:47:50.81618Z","last_seen":"2025-12-13T13:23:17.511121Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","size":19948,"data":"","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-09-28T02:35:11.414285Z","times_seen":337705,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pahe.mewcdn.online/UBFaK","fqdn":"pahe.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"830f6120d4e0c3dd141da5ff598a360d","sha1":"ab1a6f801b3f4c06643ec9f59cc0e4401294e476","sha256":"774af5dc1e2a2715ceea2c369343db40c3086174f48293ec3ae83a63fbb687e8","sha512":"8a5af2236ce6753a7c40a01746c7809cb778b61cc4d93d44a223ba6d3a2e96de7eed789965a50e2e11b16f3ca42ae0af239e9d993d6e362ab58a16af412ba120","ssdeep":"","tlshash":"4ee068a11c21a078475740d3450ba04078ff2017b4c5c5d1ca9e85152eb26bdd8dbbee","size":364,"data":"","first_seen":"2025-12-02T15:47:50.81859Z","last_seen":"2025-12-13T13:23:17.512592Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/f/7HUhhvFhV7eN","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a43a5ad3b2b310fc79c7290ddc254dc9","sha1":"27649416417fd43a268c731262a5b4f4a7e61553","sha256":"498791fbf672c66e4a414910e80c43c886707af9cffb6f298285fd9eda4d87f5","sha512":"21ac1f3721e27bad9bb973bd9c0a237ccf090797b28c029b7993b79b5f22b22059a5059b2fcd0fdc4d18e8ee832fe06e62e9139444384bc9e7ad81d261344721","ssdeep":"192:GniBRNA5MVtJ8+f9+f7+fI+fD+f++fb8zi8qi8fi8/i8Zi8Li8dJf1AtV:G02eu+l+D+Q+b+m+D+iLiui6iMiKigA","tlshash":"2932aee3dde25b229b4c5becd70b13140b473f2ae2dd1b5ec066a583b542095b3237a5","size":10924,"data":"","first_seen":"2025-12-08T00:59:29.527093Z","last_seen":"2025-12-08T00:59:29.527093Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/js/vendor/plyr.min.js","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.238Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /app/js/vendor/plyr.min.js HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\nlast-modified: Mon, 15 Jan 2024 07:24:18 GMT\r\nexpires: Thu, 22 Oct 2026 01:12:01 GMT\r\ncache-control: max-age=31536000\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 276710\r\ncf-cache-status: HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ROhh%2FqyNhGl0461RNEZ8sYAzFh%2BCgwOo9o381swTgL2XdSvtouMFVMPrkaY%2FuYpJheadKi9oJ4HUgNDiX0OQk7eOQ92udOE%3D\"}]}\r\ncf-ray: 9aa8514e6b69568e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":109193,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"9902ef44d0bfd3a740ecda81c569e0bf","sha1":"cb0f5c177f6cc2bbdb2dea4f17cfa78aa4a0f98e","sha256":"2c8fa9900e0d787961edb7885b11d40eb47db093155ad83fa77097d46adc28fc","sha512":"0fe4a35541bb4c291f733436dc5b47217100e2b6f13d624396d1e739b3d19c4205f2e19e77d576c816a6f3d180c437888a21fe2a5d0fff00fe1cdef3cdbe4d96","ssdeep":"1536:8posEEOZBeswPoxZ2nXKSTjq178G7Cep0lm5+7/550O3sJoP+UWkL++bekSDOBW+:8e2onChDk5UdNsVUocS9cNpf5","tlshash":"e2b3e8c3331af63281a659cee024021675398b9a7405c26cfc3cedde6968d4275b7f7a","first_seen":"2024-02-11T17:15:23Z","last_seen":"2026-07-10T12:00:56.280225Z","times_seen":38,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.291Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflareinsights.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 22 Oct 2025 06:18:58 GMT","end":"Tue, 20 Jan 2026 07:18:54 GMT"},"fingerprint":{"sha1":"C7:F8:82:22:3E:BC:9D:F4:7B:0A:EF:A0:EE:C2:C2:D1:34:7E:55:1D","sha256":"EA:85:37:F0:6A:CB:4D:61:4B:3D:2C:58:4B:FF:E5:CE:3C:33:94:71:D8:11:77:5A:C1:99:2F:94:1F:D2:FD:F1"}}},"request":{"raw":"GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1\r\nHost: static.cloudflareinsights.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://kwik.mewcdn.online\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400\r\netag: W/\"2024.6.1\"\r\nlast-modified: Thu, 06 Jun 2024 15:52:56 GMT\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 9aa8514eeb435691-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19948,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19948), with no line terminators","md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-09-28T02:35:11.414285Z","times_seen":337705,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":16,"dns":1,"connect":2,"send":0,"wait":15,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cr.fretumlimpsey.com/rQd62lQoHNRz5AjM/128435","fqdn":"cr.fretumlimpsey.com","domain":"fretumlimpsey.com","tld":"com"},"ip":{"addr":"188.42.241.189","port":443,"asn":7979,"as":"SERVERS-COM","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cr.fretumlimpsey.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Nov 2025 14:01:58 GMT","end":"Sat, 31 Jan 2026 14:01:57 GMT"},"fingerprint":{"sha1":"D9:92:FC:6F:91:EB:4C:5E:08:6C:72:8D:BB:FD:32:01:24:DB:3D:76","sha256":"89:86:45:F6:5D:E7:5C:89:46:C9:7A:A0:C2:8B:C0:9B:76:67:CA:82:54:E8:44:0E:37:E9:91:66:8E:AE:F9:C4"}}},"request":{"raw":"GET /rQd62lQoHNRz5AjM/128435 HTTP/1.1\r\nHost: cr.fretumlimpsey.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\naccept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: https://kwik.mewcdn.online\r\naccess-control-allow-headers: content-type, gyfr29qt4j80vdr0zhsj, x-forwarded-for, x-requested-with, cache-control, pragma, expires\r\naccess-control-max-age: 600\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\nset-cookie: GL_UI4=eJw9jc1OhDAcB%2FkGddnkl%2FAA%2BwgtUtKrF1%2FBI2npn7UKdFMqq28v8eBtDjOZKIqSpka8FyekX0rgwrnsZSdaybpRqlZr2feCaSEZb8U0CTzYbQhKzxQyVNuifBjCniHXXq2mRr44Q3ONUnt338g3KbJVLYTy1Xqa3PdhqA%2FnkfLn7mC7HhwzJG5r0nOF8s2u5ijPj0g4O5%2BKCE%2B3WYXJ%2BWWwpoiRX70yhPgF1agCXZ3%2FQWlo%2BwzuBrjZDP%2F%2B3zi9c4bC0G5HQu7CO%2FlfoWNCFg%3D%3D; expires=Tue, 09-Dec-2025 00:59:00 GMT; Max-Age=86400; path=/; secure; SameSite=None\nGL_GI10=eJwViD0LglAYRu99ESGS4gGHRpdW0VLBJSTndGhoaBILEcRXrtrH1F9pb4r%2BVWtTWzacA%2BcIIcicgsoGRujaoWN7C9v1PcgClKSgvIaesDpnV0gFcpYgVWOcthVbMfd1N%2Fwc2r8hS0zWVXmxtlz1Xcl1CxoYxawaVll3hGx0Cer47%2FZgCsiTPgNVmRFtPu9Xcf8OwUY0vz33u9UD1LTQHD8IfrcSKq4%3D; expires=Tue, 09-Dec-2025 00:59:00 GMT; Max-Age=86400; path=/; secure; SameSite=None\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=1\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"848667c49f5d3aef59cd65ed276cd7ae","sha1":"bd12c0ca2dfaa249586f1b9b8d48b02a1b9e3763","sha256":"cc5a5851251dd8052292557ba0231c51363ff1474f60b7a4af3be144cb1327c8","sha512":"4248ad0e684224ba8503b1e73517aae6ffe4431cd16b7633d2ccbf4b96f845e318dbee175d19cd4676ca37353f53add2231ed167ad6c4aa0d9fe185f7359238c","ssdeep":"","tlshash":"f23000000000000000cc00000000000000000000c000000000000000000000003c0000","first_seen":"2025-04-24T10:17:49.831301Z","last_seen":"2026-09-28T13:30:22.018817Z","times_seen":21796,"resource_available":true,"data":null}},"time_used":400,"timings":{"blocked":189,"dns":148,"connect":20,"send":0,"wait":20,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"cr.fretumlimpsey.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"cr.fretumlimpsey.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"cr.fretumlimpsey.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/hls.js@0.12.4/dist/hls.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/hls.js@0.12.4/dist/hls.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 0.12.4\r\nx-jsd-version-type: version\r\netag: W/\"3dcd4-US0fJerQjQ10uxkkIHnJSLvClac\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 2243269\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\nx-served-by: cache-fra-eddf8230171-FRA, cache-hel1410024-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 71533\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":253140,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65533), with no line terminators","md5":"4a3e249823c65d6c3cf865cf9d30188d","sha1":"512d1f25ead08d0d74bb19242079c948bbc295a7","sha256":"0290f0d61a6b94aca37bd874640ee172d86ec3743f3c0a611063036261074f92","sha512":"a936d61e65c8d5978701bed91454f66781b248b64b6b24efe7ee246ebe01f553661d5fc42a3180f9ffd24e67fd1c7c98b71eeeffa963e09fe719fe2816234012","ssdeep":"3072:mzJDa6zxs2g85/4NFMspf7ekTRH/9DaAV9ioPF:mzJa6tgc4NFMsJLRHdaAVxF","tlshash":"a8342ca97bb4b425438361e5403f020b733aac1db409d0bcb796e9ea1db584da53bf74","first_seen":"2023-03-07T01:15:08Z","last_seen":"2026-09-04T23:08:15.115509Z","times_seen":378,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":26,"dns":0,"connect":14,"send":0,"wait":14,"receive":19,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"e1/01/0e/e1010ee4b61613b1b253d71d1c531c2e.js","fqdn":"e1","domain":"e1","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.285Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /01/0e/e1010ee4b61613b1b253d71d1c531c2e.js HTTP/1.1\r\nHost: e1\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/gh/itspro-dev/project_files@master/player/pahe-page.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.290Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /gh/itspro-dev/project_files@master/player/pahe-page.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: master\r\nx-jsd-version-type: branch\r\netag: W/\"a36-cQZPQZeW41XGK4Ome6HgccLQOik\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 35068\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\nx-served-by: cache-fra-eddf8230136-FRA, cache-hel1410024-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 929\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2614,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (2613)","md5":"dbb4e0811c4b7d629e3a92038482a1ae","sha1":"71064f419796e355c62b83a67ba1e071c2d03a29","sha256":"a214fea1926b1f992ee3da9fc16e2483c48ab8b5d16a7bccb175eb98a669cb5a","sha512":"4eeff50be02075b65083f252ceb08eb39a1888b9169af5b4e53eeb8a56c297f25ac1b38dda331a34214114f7c904b1118dfa833afffa8beae6343a3e2329c906","ssdeep":"","tlshash":"cf515671a644090cb01bd76a79e0afa931784411e127033ef1277271ef9a05f2a73749","first_seen":"2025-12-02T15:47:50.791176Z","last_seen":"2025-12-13T13:23:17.498001Z","times_seen":3,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/cdn-cgi/challenge-platform/h/g/jsd/oneshot/5eaf848a0845/0.40097214179666746:1765153305:vqGTqusa12HxExUQMAEINzxjy0Sz2brPvTLVLHm1t5Q/9aa8514d98322383","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.776Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/g/jsd/oneshot/5eaf848a0845/0.40097214179666746:1765153305:vqGTqusa12HxExUQMAEINzxjy0Sz2brPvTLVLHm1t5Q/9aa8514d98322383 HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 12199\r\nOrigin: https://kwik.mewcdn.online\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0; pp_show_on_4e5e04716f26fd21bf611637f4fb8a46=1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":12199,"data":"yxwW-osSrL+fsfsHXdAsNjLjXUjRjYWU7iWr2jaWtNr0NQ70FjDWyNWnQjqjJJj2XJSje4rzq$Oirc0IOijzAAsoWsPtruNsVLtCNZ0$EoLws1RCE1n+a4WjQaM$lWWxZjN9uTS0jsFnEzowGjtE6luw0wqncMWrXhOIsfXkZwFkawZ8jLoE6nane$jjOJE3n2aFGvWAX6$WjPFijpWrIZfNjgdTLTIryvcmUpNIYDTUcpvWjfOijkvMaQVqVN94jDtTVEDa0GjjuJjeWiojj0ddiOosgwWs0M2xoc5gVwvWjIOaWMEanSz0bRoxqijAT4wCO2djj2UXU3wK6iTQiTLiij7w8jl$a4ijworhzPSSY8isTTUNVYbNwDYFYYvsy2NMUP+vi3J8Qki88WMYCkjjEo0h4jWQAo06HWjZAQ6bYxWQxlbUfQAvkAmC93JA57SMQPyUjSp7wjjVLu1dglYoSlo$HW-D+SHuaeoqJgPAVRNvvQIIc$9cOXpI2Agj2-s-EeNwzjM26xWajH4y9muNMTZQ2nPkiQkg09EG+Ed2FhLUZq4r1bDxQQUDHJ2VU2d8I9CS9yJQ9j+QD4IzXfbIv5Of+Tq+Cf3bw3w0RE8jCsXzEiRQTEE4awITikuDn$DsJEj1LvhiqovU5CCD4C8ED+bnP4q4G6aNXs1c-Qubh6SAA3aMMgj9sYJG4bRQ2z8DJqKx2vgzEIKUrXzFGanWiq28ZPO-a$kfgEOCGm8Dsc9wP22-$iKXteM0fGrQwiSWjqn9IwfEL2x1rUrLv2Ik02jrWnDx92j3dmwxVZbWupNkz8WC22NYonjzXEp2xLooqANrJk8lrA23E4xj4bYnuA2Znww3oa2xJsLk4MrUtAhoctACraE4ZsktxJsr2jA4oUwioEs0qs0Y4N+fIwwuMYrcQWrLxuQuwUTap8WaWs9R4o2xM3HSJXI4Q7PjokwkaWywWT5Y604GpwMrQk8dIaIADHAEYAvS$Ww3ry4$iow1bHGT1woPcAUVcLyLIx-1xVdAyqjFRo0IQyi0j4FiGTrATEpWzyQgPTQsoGDPMoPpfjpae1MAJr3iC4C81rSkwpVLXPz3Lkw9AmX5lVAU77aFq6hTysiH15ijdPiKJWr9SdWPrWoxqiFs024ipLw60siV+SLw9dcWd2+ULoQ4MrRYJ$sZ8iFriC84HfH6ZtU16t3Q3$Ty5e4JrU2jwwSaVcdQsFPASsF7rhHja$UgwWCAMYZ+o7rA002QRarNiPgry-wo9Sv3ZObWcdxG+A4tExN+3SdwjYw5-IRwUAvS2jz3JuxNrU+f8Adkw9wgUNHJF-fFJgurQp4CPpQXLN0Lif1xpsmj8lpakIvSUwUZW-foAM$WAOAYxzPLk80utp8X-lcioSWLTRJXk8hmXrrf3qgjMqcLiq+Xxi$rrLMKLxruzoXrLzotDMvDybvw6164Wi$VWh16LN2ot+tYcItrSV-n0nb-nIQv-gukYIYu1sZqpgPDKKYyPIjFEkqls5p6viUp1wcWMhr$hMM8gPwShT5Kmjt5txx+++w-xW+-7nsjRwLj6j9rh1lvl-mJy13gkWTCa4gPNY8EjkR$ih6fYjE4aWVqwj5ocYzYlU4zfHjVURzJIwZD$Nj+T0jok8C8+8QZnZA+1dWuZFjH+9-92i1XgSgFZWLww-OdLvu1m$obIZ1r77HrU2oAWIQS+E4QA$wIrarrorWT6ta8ZJenY6fYDSP9d+0rx2T2xJQRWb3X2N1ogxasq-GsJy3$o6vfgLri3cMdEIGufJrtiPWoZ$rg-Nsm0j4iidr$WrEA$S$3MoerUZTAXv-mITQ+8UWz+FLIIjpEH$IsYEwa9EZZ8qd9pP0CSU2$wo7uurwHNNs5nX4OeUYw0s58oz8yTIWKd4IQ4VFUk4AINJWUxt5l2pJ4zaug-oHg2AyuUUQy9KiaiueLrUyFqgJDyRma4kfN45aQnDIfPYNOFAqdxUgkkcaogACSY0YfFEIg44SMOs6Qj9Eng4z8tr$8z9a+KrHzTLFjsFUiQZ8O7uJtYSud$oQGsqd8c0vJlEptVOSx4sgpOt2rqiAiOPgn7yf-OTYErOkQUyYQunRI0X3V9t$Uz$y3Jn2ZsbuUyTZspTwtPAcTIXJF+GI9pUA8IAjrf1CYi7zTIec$d+682OtjY5N4pMLc$ppglo1uluoIDYzlgDxOP8vfU1Jy8vUz4vaLJM-vzzMZs92WZskZ8dSa4nFb-k8RIvF8k1yIpN2U9tkY7gVGHA+vdIgw8vhOe$Gp-SYA6+O592$6-1y3W9Zt6H-peGVdsZzseJ$JSXmTWsDfw8T6w7CW4H$Wi9JLajI+QUluPmASju8F8UNys4dWaOySfPwivZsh-FigQAeRwFP29zgVyJj$jS3NuLbyeTypltZrDAeiQz2rjRarx2wsMZYrD2jNiqVzjF47K2nFUna+9OgU46gR$lngvHS249QPwiu-GXcnUeVdjfIL2HvPYDO+63ZZf7gK3$zJ2uftTJMRlTU3EowuNJj3QTF4E0OgNj4gXMDowlD0s+miv9rNAWQTbzmLwq0bJ$U4jkUnO$NyC+0Yc+GT0WdoLgOoPXc9Jd5fzeZvGHAWjo0++einijItsE4fqKVxiRuha$XOAwhJDjcpwIY86s9WfwYgJ+ZFLV7u4MPE4pLSy52XjsPulQzRVHoy4eg$yPJz4nwx$0KrubTLV+7iWWa11hqTRokIM1oCyfZ2mJdeTK1cs9dwFW4zmLxsZpr3+8AZr9q-Pa34p4cbhtvrDiwangOmkQaVuGA3EAPjqEVIy7LHM9yr3ohjh9Zs-pdD9+Zngjv2ejkXQ8-sfdttIxT2ORvmutU8xGZJa6$xo0OAAlEVjPLepNKRIis4GJ0UQr4v4gps07u9nZZzn1fn7mNjptf5XwRsFzUwYWHC$Rl+SE6-iYHJCmkQ2EzVG$LobUxlrs7CAUT-whAzzVQOF$iCNQw+zeWDrQlsvDONoX4+hpQLUEW0jv7C-fFSFzHpOjMt6xObVAtvLELODAVknqFtgrhP+Ui617s5E5oeVLw$HL8PF7UAd7ZPPeNM$aD80s6J5uvSNsd0kCvYyYezuAxEp8IFPK3JRVuhQ+u2Ag5FsDTnA4cUwp3kTUl9c5az8e1O$zQwE$612wW9vQPJf$Ly4dkEotGCuf+Z$QLJuHX9FgdjZECDl-aARazRqJw9yis5$bstUR9jJzi4TIXFS7$VAce$0zn7Gyyd1wW7SWjg7wa$iJnd$fck7Naekyj224HA3ykLRZ2cVxy5DfC7tqhZepQ4RJ$NLsU+M87JyW1GKHJcKeZ-05jCx7so7--oJc1S1iHorWSsmfvz2m$ZtrTq7qQSqHk0SsEnKAdckwZeq4gN2vwih1pOOO9tvfjj8G$+0r27n7fEKsvtS1KZYQ9FKqwKtZpZrkyQGJEfNYlr9Q+qrFitaqk0-scKVQ9C8tawGo4tRqXPgKHqTvEPtO3FgWkOAf0qEFyOi-+swqiUrrEv7kqCsfTZ9qTWpkSj6sZJZoiSAvTogrsKhJewyF1WyrIzIFYULjyLp2xo9rvwTOtjso9w6-lPTj5-8fjzjpMZr-NL4uVf2QCQgKrsuJu84ZiLofwWbCeUbdLwiqRLUqxUrukZVrpFOvrFwk4rV-7u4SqJEJZzW$4a-rjAMFiDj$EKw8yOtF8lArfoLEJyTP8X5LcOCQJO$-ruMFwQEs+JUd7uRqkFzrHO3wXqkzrk9F4jJ+e0lZ$ElzdfqZmZFwAd+JuoGK8QVyrq-PtjkzAztCROxIDQkKjp6oNAiltwi+war-EvQF22U$kQkFAI5PLSXvawQs$E4tWjLXfvUXFvZKHuxcxImJxIjU40ukw0sOuOI2Ai-0NH7L0j6YaFYs40n86wPfLThsvCRjbY4whzMz2OhPffgKyjxOroLqtoeFt8TrrU4EYZ$2J8kJUJuyIZSSqZ9+w+$0WcJviLJoMCaj0dR8flA-JorHZKnopy4fN+lOF+kwvK7oryRjydedL+8YUC6CjStzJkbQgT6O4fru1deFqJQjuE6ShF8+6ayPTuiux$7k7jyWkFtQVkfw4Ewydr5WkFOo3yTu$tfeOvS0rtfRQ8pQK+glyCQOK2xjpUjTrrzFVzT-giuNiqiLlL6DVortQHxruk6o4J18wr4z40Vw1ou$TyQlwY6w-k7OevgLCE4w4w6U9viC6dgz0sFkWImwHoE0sOKF4qKCawyOuOrcgTUouyx-h0rkbZ400sJtWr+d8t1UwU48S-yCnXiY9lCFiL7P6EMu$rpvQo4dSEiYFW6NytXXIcyo2AL$68z$ucsz9E4-iYzcDZg8w$gI00pwaJ62Y-PW6jDd6ukQVt5+nHjyCkwYlUmS0dNXLZt8IAErqpeqkWOF4jCWgZ9LW0rLPO2IfzU2$PlOEumR2Wo$rTQL6EJ2YycHrP3Z8AFPUHfPTPdzM8zSMZaC4W6z6wyQoOwUmSuRGIWcrjLHXlrL1F8uoXiJ6tWqhF2QAtjDiDZdGAQcCWjRGXIu4U0tatA$GRlKl0aHYE9IbLSoHA+0HXKEHc+dqNXw$E8LcOuCPUN-awXqFO48NcAHRYDqyU0Xsep0safefoFJlkXWVJfa9YE$i+4Y8+OAfdIDtj+oy-WE90AWkJsljX1UEY9iFeLqpLwD1uw$vqpqqpoojruYiEVw7phZOf4tlJEp5fAZLRiYqIoSAKK8bv$qLolPp-tEvj5rge3SrS4H8FrrCk3KfXTd1LzHLOiAfd2$eWsPrqey4+eqCzT-+z9+S-Lk82pW7voQnClJxqwame+f7kFpDk6PYOmfVvt2cf1A70Nz7yhJ7$fFQYavWYkFjfFar+M0ri8C8+faxIrrlEJE2oNHQdeF7aXlPL2Fz-oExE4-aCwwWSzZ-wyK1Hmou-LLCEZFY-9TUJQsiwZi+vqlnPvwUutkXPRs2i-fJv6iRdWEJNTq0KoDlq6YQqUKYtWu9Hz8yoQsAU4r3lYw1$oWYj1FUs3ArlAslQOHYAf0EpL$GRQQmlGfJljT9lsLUkrSJcpjtKR+$HJTUiPy1fVIvyf8H8IJ9lyjwy1K7AGADArrvjLpm+KJ8Y+XufLu7JYeQCTZul7q9SAJu-QwOCaXjQkLA8$NElIH7j1RZ8dj6dmWYr+D72Q272xyYtD8mKR8ijlv$27XbfPXUlRXxaz$vIiF6ULJMQqRgcDcpuuZoovU3lZXuoYIfIR0kvPFwE8tqc$p9Stvh0EdiuwLLELr5TQraqPe5NXjeCc8XLIHput-OSs$eJQLQ$aaANdr4qLAfK0efdeK9jsQs8it4SHTKQ2ALSNuLpRCXKpw6sya4dasbLcpyIeKXFoCIeiT9NyP90M+7FQTQrzKGzcoNNda-FdXueoDscJCTfUsYRiw3vfEvO2c-EZiXAGowWtqJ$YeNR$jJA2zMYuJhZ8YuCRS9fTRatdkxIiKytuIpzpfK-VozlbPYXAkDrvdFuyPbeUUnrnugDrArKryjDi22Fpw5E8YlsUAFdMKUR8NnRhZVjRI6-QAnXHKrlZRgS1FrkXAPF2vlcR0ECTPpdoPPA2p6JpAd+LEM-5ADein3Yu-kNackOrpw2iv7q7IurC2fF6YJ+p2c06+LzJUhOtwSHcPAAMsMZ9coX$rbcwp8qozwbvyikwN1pTFqRiY+$g8Tkg0vwocJy+dGAC0rirXtr9r9q6tEovrpvp$dqWz+tw-xb-JRvGIrrIXr+eFOz5ewur85U9KfisvoEUz228hKIjwk$a2MJwmxLCUVy6FNeUkfEsCPOxpNVStrtgZRl6HxOtUmA6e9kmSj1dXvIivQdCT$N2XJldp$iVlLQp$QY8+8-EoeHVQ2Nw1j0iXTSyH5WhOmvcoComzmJzXHS+C3H+fCrtwyv+K+K8QTFOW+RcKfDzccNTLL58-8+FTOHVZJw4Yr$aRQOI-P$GSTjKEirDwLLxHtNdrvrNejd6oNDCTwbzTQ+3dv80omcQAVrpOMHc88S3+8cNUptHDiaikiD6qzdWdwr--M-7XJy78xg2XnlCHe0023j67efxt5dGR4igLlD7Y4k8RV$6WMTUJhZalZihAIZZFvY1oLU85g-LNEiYZVrfNJdWGwGSMwESnL9qcdAwukSNY7$eR96SW-NPLPYsS7Hc0MeMX$woxyF9$odaR+z2k65TC8+jGijKRkkOTXNXpaeTHg5pcsFgVapXzi9RD7N0Kkqkj9x0owdpF1Y8wyCX8pea8tOVldeO9-lZ8FHp$5fJHXo9wyfOPLvLowwLhYRarJj0FHDAGCZVE1WXOjDONV$CFilytSw6w4Nw9Aq3kXXvKOACTUQAhAt7XRQ7TMI2NAlCawgpAVNXeclAwa8TwOc3KcW9iL4mK20fb3X+JHXI+-vfCHI2cElhRdDHG4$pFSAbenKJQtu$LhpO0DrwwN6N2bRjI$IwwU2vdeCuDijMJ7AvorLmz$F1L4rv03sig3-Sq1aZJ6wRcKDrr81zx626fkTINpDI4vIA64+NsmeHVSP9LU27YrL+DmZxt-S2VoQxcUMeDlZ8YSGW7WgbyW1ljEfg01v2c-QNyLLN-5Ipf4VoPCpi10MOd94FzVp26PL-Ds6pXpwqlRXuW-Aw-2H$ZF-6C2CwJ7EfAydMRVa7Rij6QHMwIu+-J7solOPS0lpu5SbGNHiwT7AlCHPzMqbEfmWNrpQo8irw8MYLt854RI8X$XD6lZfg8wgfPFgkEGR2lHEZQ9qYz3UQMsXpJN94EYH4RH3c3ZmKwTSA0Lm6NbsRcxhA19NzNufufQ68VLQies9NgeCkeXa-adzfvEJV$213HlzR2id6wtFwYKc97UkIznQd2Q2caD8TyFpEQr7L9yAn2QgAUNL13IIiFOpD-0ih0Y1n6sg6YsRdKdQu7KlaxZDuccegFPaLJLJHJzxLnIs2RwEKQe9YlYqk0LM6dg9bPc728$-fsV2rnaICH6kUKCRblgoYaFvE$G$7lEM675CmPmdQxWc6+CEUy6vFwEaw6EScQmp8+4GRt+J7uPLX4UH0+TTuQip6VaHRNUk44YExxeOwkbFc9z1QHQYc5lDrKREOPnM1CSWZIA3NRgm8KSLcbd5AW2X8cAKCS7zxsigdcuzIgoU373mML$gem$bD6jKZZXx6tiJplwwEDr-erFq-np0Ccy7U-Dlwy8H7onisaN1KCmwpNPMd8c$7KrzUVz08cr-EvCO3+s0Puu1guPkx0XSF5kf3lHjuj73TDogDNQwyJme-kuTwwOAVP-JlYuExtwLYY7YKi34HmFG5ZFM7sTRwvFMfZ0fb7iuxlmZ1+wMw7Jj8V6t0bYN6E1CmXcM4o0OclHNmN0WngpQmDF8TErQTr9GUG0OUx29LQ9nt-9K980zZN+mTsiXuT9N$HM5MbRgjrdD9wOG7ghF7G9faSqPNhs1hYuOxct62JnAWlLTQEeet1yzVN$Nz$3K-Gr0YmAJegfhw-ANwATTUC-S7sieuNUUCm6-zoARaVezK76NZUqJqEfNsWew35otW+8uK$47GiofF3karjHoZ4+imzWy8tEVDox5C29Ee9PrHF3zEDNcWpyQYQn76w+jY1DZ2+prNZDwfk$Ee-it4vdEA234aOfgM3Iq1uGUhjtqfk0+Qj8IeADN+uz8VJEqx4GUb0fsIon6M8cWDNkd+CR9Pm2Pckjqfkn+l84je3N42AJQYvsajv9DH8dkj3gr-qULEOFUIAkaaEsXijesFjdEIj1gGmkiNtkQ$2jaU2QIg-WUwNo9TsX4AmUSks-4U$0h4Yuy9oUrPaIuzWS28IsrY384ZQWrwc+$ajDs8Z4KjpkUuiaGi8Zix2wi-JXZi3riJfLt+eCGrYrPmIiW8ArIUoLr8i0YlroALOU5azAEcc8Aaocd1jnZjws8XW-+iNrpNHj6+t62EobJzZX4ciuA+jjd+IZWmY8N5kM7+ZIZnnANJrIu4Vr-gw4Ui+yACOGZIZo+p6LW38OvrajzCAykX$A-Rr2Z34PguSq-VE+fZOiFFkUug2GZdwpJU8cIAE+9as6DoyNE6tPZKspZX42oUwUZ7Q7riRI+ukJscZsr1WGL+eErE9ws+3sZwHUA1mcWnUnOJtqgLoqQg8dmZqZApyoEW-4dp8kiuRvcQuoUoxaXw1nudzG23aGHI-eg2YUE+5snUJMN8irsJWYri8WYHqyYkG+9dQAxglQHf+X$m4I9MWT2ogqXrMx9NU8gp-1oksodzLZ4iVwdVsYorcqdta7Lrw7WW+PZ$2$tYekEovawmixYUHJr--vEua7ckjaVkVuGeWZXiI9Ie9Esjo6ca4P4r29E+grwNk8o4Hr-dizdnWe8M9qJjcksdi3$8dFEPm0iFr5gJjHNUVZQkVrvwxZLjLzq+2$r937Q$kYztrNJrS3CLi0KztCbhsfAnx$nUqrxrTd8aw4q4A8p4sjW7jCUr8X9u3$zx+ZCi18AQqvnxjo0NNf3Oo15jFi4cH2UNAryX-yd19w8W42IdMwX1sH1NVW-HuCkjWlavXILf3rRkvoZ4w4cOy0qR2UWJ4JZtFy1jukc3o6sNPNLCjluiWaZmVNEvW2VYqizw1ibDE7kjNY+6LPXUA$wU8jfjb8Ad2g+nMG+hdjECjS2PJAcjcwZ4gStdZLER$i$KZ6WcsKn3fjRo+3xgDrcpkG+TafOXSTNOgW$rhjb48Wpjk4+9syoAcrCpIyE1rYnj96gHs2utjgIieXwhWN4wdZ64f$+86Ls1qFspErscEqj+IYxsUQWsDoHTtaLAoQQX5qxbtNMZR+naiZ2r3$2ofgZTRUfFaxWYCQbd9+MjtI0jihv0HFZ75gWrbrfJfmoZL$EShHwkK8rlgKj7jAOXzrRH3R0jDLczpnw7ofWcoLrYj3jC624OajzE9EH4SJY3XrjoW1UKijjrQqWdwyWeNjJxp85Alju9eHJUim1wrfdAiy4zHxnTON1gpq-w-IjmE-UtW5SU$J6JbwDsYgIULWE9UaJCmSxGOeipaX9YFSvrI4afsMX3DcFsiuFP6UUr+IIopPDOTt1ye2r1WXcYW-1E8Cz9Z4NAvfAL-daNDliY1A-FFW7YAj+gR87u8IjeosjaaUwL0rzy5jPIpmlxW4tyLErU8aa-zegruE0rr1J8ZhiQudk4jS4aayN9ew5q1aL5nUd96gvI4nklswiJF$n$qW1bhjKwm86OlDt44odji4wTfAqsfdnExqXxnUN4r6dDwSesiCSpwsCkM$RwolNzNI+3Q4ZuerNLLLFkEwCSEWlQD+8xjLjPsUS8crQ$xL4-QjH3AkAct6+xs-aZjo8M9t9kJk+srWR864YA3y+AjvWD4NFLrJcCbiYjrNsOWEUvkJ4vwy4H-892ZunVDmQfc-z5Z8F2VN0kL2IzRufWAsqesAwg2wuHNxjvwsQAcYe29onakeo9HNrFjc+z3peoxZ4YY3t80VHwVjq4TlrfW93w7qW$4LG9LbagmoeAXqpPW+zfaMZNSggrrCXaf$keJQ$WYkyNdW3DWXXlqXkEjrng2jlf4EFpyco5Fke-NWuYH-vJyVbmMyLqHM-oZMYq7KXXqqbtvzEsPqKFT0XDARCfaQfFSvbwbwZs0e0eDSdi+SsqxcglQttamiN2o7Zg+j0fS4wby2gIsuspJugtKq3$urn7G60nwbq1FpVd0ZAycHkq1OYal9WeAm+ltQ++VwWTQa8qGAtzqVK78WuU+vuN+hV9812YqSjO1xkoh7HKsHkpEjp5V8Yb7IGHkt8WwTlLTQri2kUDQIsMgmrGACWOQrCxn7vQ2yqRQDQrrF7+QOgUp9hJLjq8QZLqNfY2oL-Vuo63mI$gm4JamNcmIitSrqg2gSGwWqs04fg+NYUODS6oeGQNpwJuYxrb$ChzpJbEY65fDZH$Jv2qgwewWqnu8pjAjSgLQwHaNbLNWoe3YcCu9ahEUTHozNZofqaFkbdk8LYO8JH+$+adNuCY3WpGHkteZksdjgrxZcxvfda4MYtoGqRi06H2NUYpoWENj8kCZuTNMS6siCazisu-UgcsGe72IAZ-AJVwfql92YzId0Wyo0sS9kgHoV1ZyWY0ybydkZVXNnrV0yAvNTZVzjYmA$-wiUpyu7gcgAmrtw$RpF42-oMhvN8uFL32JDSodCfCjX04d7uztFX$jfA8ufr-ysFIMufo6Vfr-OYFTe+G2ty4LOg3eaffnpVun7XgGmqL0wuZwTJYI8v-R-g+2spwbQLqHpjqIP8OxPrF7NOzs$pg47iwhjUAOfoLjPj7diwk60jTPy4YHTYHFQ2VgqVujNiu2HktGHkAKYjAEflt44HCaKFTjh3XA$cVWuaWK0Azq-Jegu-YFTroUQ4rEpWWH3wWjJcRtETlun7i62-tkgfoWe18dfFJiyA+dE3f7RuGcpZE9ZS-KZ1r7uCMQcZY-hWWS77A5uUoKjmwe4gTeMY0pnwSqVQSUlu0GYfiqwAwDhWoY2kL-CZ1QUHXdiJTvjte3Ob8LNUOT+ZkYwI0XXXPPH2N7FTOJNHXvK4YL0FmmA1D$y0NnFCaejM9Exr43hEg3jI3ko2vHrJ-AXUXoHI-uJQXjw1PfWJ8IYDJQeseROVmXrEPHD3OjKfPqIzON+KuaW26o0NOFdCx-f17XOikkE8sqjr1+OdqlbtvHeV+TmSmTib+dV1vIWT6LPIpq$C1vI1RO0iyptVpeOm7sXP0XLfTH$v+LUnMPjQvCHEswJZOP0AS0CTdg31U69zjmPCJNP8aYgFciHfE$MV+TEXKTTfvK3IE51vjqYExfyACggYmXoGNMUTALvp1P64qjy9yHtg7jV6Q5cGKlCD-V1UrCGNWisYlgPcLIWPIj8ppeOiYAr0+$jfkAiRMggn3TIjv6HuvAYzia9Hnf4AuO6yo9i1wXfdQYvw7ar3TIi8kWSyf1YrhPRa0QRjRnY7xbyA4P4MpEHY-S3Ta4fXbS-1glrvSWL-DAj-ZYv29aaa0U9xrr1iW2alafypguOT9z7aSsOn3gL0yROVaD80k2uO5YQHsPSNOh-IXSsXng$TNO$JJVf1DoQIfuOoxFuCSb2mVIUvKHAXjJz2K+iU8i9QXjJfrJVIUviM0XiJA2bypU0Lr4R+TIIQ-anZ7Y-dK12Ig-DQFoM8XIJYO6FimvgAFRrW-O5yRRqOA+ukykI7-YqvDAYRINmgdXNOFu1L4$yKIoeD0Kf9YOVJx+wv$TKqT9-WA+HxeSnJ8djX$Jsg4vcFvmpQs1JJHveH9Ob2+RZP1InvA4YnmyRINVHO7DJfNv2sM3cOoiE3jzkpd1Pq9C60HE2s6ugSpzsWsEOL+PwdPCqYGvnrpjMsXaZwDPiNiWjEWoWT4AFl2O6OMdyfw4yr0fk0Z6s+GTb$AlttHrHijEvraUNFF6YHaym59d-izfsMidN1MWybc+K7AMd0mbi$usIw$+qjeQiWIjjjkF6D-jqFr4+nC9iMjSWDNwoF5WriMw-bU9jI+K+4EYwnoux28oAWEW79sWRRYSr79nE0wrNSIvz8jjUf4-ftjU3r4wvWTq54YqayssSkrPAuouLEp24WRWAi3IqTwfiRZJDyNdp$WUisvjLj40WjsiGjR4jjIzJ9Obqj$aYOWz+LsLjQw1004HjUE$gbzWo0hkNR0y9zbkDJj8iL-83+rb54a0WjyVrbkDfrrtRL2dMrbTNLjA92Wry9HbZDMnE2Eik39rWLjGxkt$C0Y9IwaWmQHNtd0WsEndD10568i+bZZwU4ncJWua-AjhRtj0z-XWzj9jjsXAQLQqT9jvyjiudSqMONsDnqWHjUg-MOCW+n$WrNrWwEk8jjOmjwUpjQqrmJ9rysQ8U9UoQKV06dUwUIguGq6dc8U4f8LLsMf8W8aI7JaYHtOEuYd9wWa9QqTVYS$TaOxrNDPld0S+1j5NcGVVKrsjwzZoDMjACerkEmAnMTALQrsDAmj2j$iE4khX+fk9lZ6D2j-fYCPxowsZD2j+jEjUisVZwjHso9y$L4VTiRwHqCjLrz79dIV3YwQrUritwUoIENir9+SUnoXjzj3s3jgjULCSsZ6Y8RW7nFuWL2SjY8LNHO8mWwVHsrNjjLIvb9rwUXbSpZRizWSDFajCA$FE1QnuDTqKktPk316s6DfjH4uIk4+xsRWNNljU4JW+Yx-irLAisxJqjjsls49jj"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\npriority: u=3,i=?0\r\ncf-ray: 9aa85151dbbd568e-OSL\r\ncf-chl-out-s: 4ctESQjekmI/HBE1SgyhYA==$e7hM7nbwbSYMIkbmdMyyPA==\r\nset-cookie: cf_clearance=haAhkaMrz0nr32bLzxKeoq2t2z4K1F8h54219eo_pos-1765155540-1.2.1.1-Icz68rGiHSElRlmWYjV_HbM28GDITe.VuQbhUgkbZ6.7AR7PuzTcYUPfP_qNfaJtaZuq5F3P03k5o9sC48vtk3UYRNNQNj5w6JZR1s8EcW9KpTOOwQnKNHhSLyiNMlQj7smnFRTNt2RbYoA0BWjS_W8MuMeij1hbVxp56dJ74vRmCHpGruZTr6IeBF_._RGOFprTKXbS94JOglyxGPT0k_6y3gbjLSzO6ygy9pOZvSo; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=mewcdn.online; Expires=Tue, 08 Dec 2026 00:59:00 GMT\r\ncontent-length: 0\r\nserver: cloudflare\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=agOuPMet6L0CLopFm7jaUi6503LeAYg%2B346yw0qBk5vV%2Bo2jC7%2Bllh6mAakgVbXt4lnC9%2FXm%2FgbkGLplendT3aYrHmuz%2B20jFX1kzSb4tb16Vt%2BSsgtIR1NmLztGtsoh1aZzqlk%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=889\u0026min_rtt=398\u0026rtt_var=399\u0026sent=273\u0026recv=79\u0026lost=0\u0026retrans=0\u0026sent_bytes=274607\u0026recv_bytes=22312\u0026delivery_rate=14597652\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=27703\u0026ss_exit_bw=14597474\u0026ss_exit_reason=2\u0026cwnd=31013\u0026unsent_bytes=0\u0026cid=ab77c206a9cb10a7\u0026ts=1608\u0026inflight_dur=83\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/apple-touch-icon-xlarge.png","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:01.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /apple-touch-icon-xlarge.png HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0; pp_show_on_4e5e04716f26fd21bf611637f4fb8a46=1; cf_clearance=haAhkaMrz0nr32bLzxKeoq2t2z4K1F8h54219eo_pos-1765155540-1.2.1.1-Icz68rGiHSElRlmWYjV_HbM28GDITe.VuQbhUgkbZ6.7AR7PuzTcYUPfP_qNfaJtaZuq5F3P03k5o9sC48vtk3UYRNNQNj5w6JZR1s8EcW9KpTOOwQnKNHhSLyiNMlQj7smnFRTNt2RbYoA0BWjS_W8MuMeij1hbVxp56dJ74vRmCHpGruZTr6IeBF_._RGOFprTKXbS94JOglyxGPT0k_6y3gbjLSzO6ygy9pOZvSo\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 Forbidden\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:01 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=6,i=?0\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: referer, accept-encoding\r\ncontent-encoding: br\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=22wCF7f4Gs2rhpvxQWFqUaAKKZAeXU%2FbxjTbuaZEK2lPsUQ2InW54GMauTMnjPbNlVeJgawDxwuLLHc9W%2FLfjIuJvAYLDIc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-ray: 9aa851537bc6568e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"6db22053bf9ac0255bd0f7ff56690ded","sha1":"9cc2bd47005e1fd1908c4e2038e5ea210fd03590","sha256":"dc68b4a4812d44cd603b4837e68f7992cbecbddf364d5a371b6282728ad34a18","sha512":"361360cf4e54e8b3889690ab015783dae6c4b9ad2978af00ed17b69fc0a64a7b2ef79a3a32e2cd8420e63ea090bab274dacdac763e5603d820a508924745983c","ssdeep":"","tlshash":"db60000300000003000c003c00300c00000c003300033c3f3c0003fc30f03c0cc0030c","first_seen":"2023-05-10T07:37:32Z","last_seen":"2026-07-06T10:27:02.880877Z","times_seen":40,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pahe.win/static/frontend/css/style-dark.min.css","fqdn":"pahe.win","domain":"pahe.win","tld":"win"},"ip":{"addr":"172.67.202.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pahe.mewcdn.online/UBFaK","date":"2025-12-08T00:58:59.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pahe.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 14:44:12 GMT","end":"Fri, 13 Feb 2026 15:42:35 GMT"},"fingerprint":{"sha1":"4D:3C:88:D7:06:31:6E:88:FD:C2:E4:7A:80:69:63:03:E1:FA:98:04","sha256":"CA:2E:69:7C:C7:BB:C2:CD:2E:5B:FC:50:07:41:B6:FB:F2:B2:53:FC:32:C6:6F:37:56:C9:E1:88:40:4C:AF:F3"}}},"request":{"raw":"GET /static/frontend/css/style-dark.min.css HTTP/1.1\r\nHost: pahe.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pahe.mewcdn.online/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Dec 2025 00:58:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\nserver: cloudflare\r\nlast-modified: Wed, 02 Aug 2023 20:57:48 GMT\r\nvary: Accept-Encoding\r\nexpires: Wed, 13 May 2026 20:05:05 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 6471085\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7HdI%2Blf0V93oSgPfSLyZm1fmgKiaTM2yl9fRYi5S%2FP%2BGDW3DKanbAKCKc%2FIkNeatJpUbv1CaG%2Bfnqq5i4vs2TInW3D6rEA%3D%3D\"}]}\r\ncf-ray: 9aa851497d1256c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":474008,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"beceece79fd5d9ac302f603247ea764d","sha1":"b3c1a21a0f532b3336442e7eab9f68017e777441","sha256":"6f30da4acb00a8757e47e31a5338799b0157b19328458d62b2def70f0efa6696","sha512":"f4fbc0ee0bb422fbdc8061ddf79b1cb0a6a150d90c75eb6f8fcb38e9b9baa75b10fac4abbe8995404027e298a523dbfbc0f8dbd9b83aef04002379f479cdefa7","ssdeep":"6144:VPXLk3SYihENM6HN26wwAZ9bTTuU4eoEOuUI:Rp","tlshash":"a7a49796f590301de0a7c25e94d0bbbd5e2f4241eb161baff53737a84b4a2ca1523e4c","first_seen":"2025-04-15T17:58:08.435735Z","last_seen":"2026-04-29T20:31:54.272523Z","times_seen":11,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":71,"dns":28,"connect":3,"send":0,"wait":8,"receive":0,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"pahe.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/css/bulma.min.css","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.228Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /app/css/bulma.min.css HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\nlast-modified: Sun, 08 Aug 2021 13:11:30 GMT\r\nexpires: Thu, 19 Nov 2026 17:54:23 GMT\r\ncache-control: max-age=31536000\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 770867\r\ncf-cache-status: HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OkHvTQ022HOHDbyx9zeFmb6TPpK3V4qb2Txt9vU%2BsBMpXlcTsAYiV0xew8an2rMgRcsq3roTddwLsHf213jpQzqsZEnLIDM%3D\"}]}\r\ncf-ray: 9aa8514e6b65568e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":206620,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"04ba689c01d96e600ef0cc16bb0bb72a","sha1":"06411de8efc0aa3ca9629073023011b2f9fcde22","sha256":"503b5b507aa95557d799d25c41553f6df0c4afdc6575fdc36ddd12843d147ff6","sha512":"220983930cecf7ab784ab0a15b6f4da3735704806ff1b696e3dd33939697be1083f2fb99337c944a46f24c1717a2193249e732cc8ad4c2217fa95d1cb8f70bdd","ssdeep":"768:YZYapYLD0HK3m4QMAJNdz6CPry05DEJa09DKMzsRLcB73yMBgDFlWxGDA3UMQS+T:oX3e5hFC","tlshash":"0b149992ee503c4f7513882e54d0f7a4272e59c4da1627b7b537b2e0864a78f2937f0a","first_seen":"2023-04-07T23:27:35Z","last_seen":"2026-09-27T12:25:13.223109Z","times_seen":332,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/css/downstream.css","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /app/css/downstream.css HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\nlast-modified: Mon, 15 Jan 2024 04:11:25 GMT\r\nexpires: Wed, 14 Oct 2026 06:47:28 GMT\r\ncache-control: max-age=31536000\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 1654921\r\ncf-cache-status: HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ll%2BncAfJDep6ifODFAxaJ5YVd39shTTJAmj3HDULUoASj48F5KG0L0ikCJ4S7zoUCwVuDw8APu2qKWgNBYjLASpx%2B1uEcSM%3D\"}]}\r\ncf-ray: 9aa8514e6b67568e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65081,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"assembler source, ASCII text","md5":"f15d295d44873f1e0f4a13162edf80c3","sha1":"b1966da8a69c16945c519b3ad966c71110501a72","sha256":"d8b1ac24b4d8864cdce304ad294f71d1e3cca8f4147420b8c37e89e31eee5619","sha512":"0a63df4044bad9945c3d7ccf03915c886da9b4e16d5f548305483ffe2f0204f99df0f66d9302883379de2aa6b3050f963a563b1fcb05b1e9365bfcd9e9079b90","ssdeep":"768:GEslswu0BNTSR08WOq6RK9/d3OHJyTY5HtuGjaRDSFY8gy2FcI:GEsfugSR08RRI/d38yk5HtuGORkYll","tlshash":"ed5348fc91fe29920359e0d56343e320fb3db3a8dd4a4d55d2a2bd8da6c06589183bcd","first_seen":"2025-01-20T03:46:45.422246Z","last_seen":"2026-07-10T12:00:56.27617Z","times_seen":28,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plausible.io/js/script.js","fqdn":"plausible.io","domain":"plausible.io","tld":"io"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.287Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"plausible.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 20:09:47 GMT","end":"Sat, 14 Feb 2026 20:09:46 GMT"},"fingerprint":{"sha1":"A3:B1:40:5E:58:17:30:60:8D:55:64:BA:D5:D8:AE:AC:A3:5E:68:91","sha256":"98:6D:01:16:D6:F1:8A:5C:8E:6A:D9:2A:B5:83:83:1B:60:B0:A2:BA:EB:FA:48:00:99:6A:B9:D1:0C:4B:7E:10"}}},"request":{"raw":"GET /js/script.js HTTP/1.1\r\nHost: plausible.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: application/javascript\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 682664\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, must-revalidate, max-age=86400\r\ncontent-encoding: br\r\nvia: 1.1 Caddy\r\napplication: 127.0.0.1\r\ncross-origin-resource-policy: cross-origin\r\npermissions-policy: interest-cohort=()\r\nx-content-type-options: nosniff\r\ncdn-proxyver: 1.41\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 12/07/2025 11:29:54\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 53d5917150e105d9e00c43e1f61eb1ce\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":3005,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3005), with no line terminators","md5":"25b5b48c4c1efed79da2c557576bff85","sha1":"f441809be456048d32225ae0d47efaf1006efbe5","sha256":"a34d5ce3e989b828c42fe4994c8c1e21693c311db3b076fcbf5202cdc505e5ac","sha512":"7e68bb787c024fb14042a4ab95b7ad5d81750b357404865fab281d16e925a0f5e5149fc46f32549f73d57fd17052ff10ce323b28eefe34cf231f29457b00aac2","ssdeep":"","tlshash":"80512db96a02757909b9d167b62fb3163a3366263116b401542cd9c13e28eefc323ecd","first_seen":"2025-10-28T15:34:03.371103Z","last_seen":"2026-09-28T11:40:27.034777Z","times_seen":6716,"resource_available":true,"data":null}},"time_used":90,"timings":{"blocked":43,"dns":32,"connect":2,"send":0,"wait":2,"receive":0,"ssl":8},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"4e/5e/04/4e5e04716f26fd21bf611637f4fb8a46.json","fqdn":"4e","domain":"4e","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.391Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /5e/04/4e5e04716f26fd21bf611637f4fb8a46.json HTTP/1.1\r\nHost: 4e\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://kwik.mewcdn.online\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plausible.io/api/event","fqdn":"plausible.io","domain":"plausible.io","tld":"io"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.507Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"plausible.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 20:09:47 GMT","end":"Sat, 14 Feb 2026 20:09:46 GMT"},"fingerprint":{"sha1":"A3:B1:40:5E:58:17:30:60:8D:55:64:BA:D5:D8:AE:AC:A3:5E:68:91","sha256":"98:6D:01:16:D6:F1:8A:5C:8E:6A:D9:2A:B5:83:83:1B:60:B0:A2:BA:EB:FA:48:00:99:6A:B9:D1:0C:4B:7E:10"}}},"request":{"raw":"POST /api/event HTTP/1.1\r\nHost: plausible.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain\r\nContent-Length: 137\r\nOrigin: https://kwik.mewcdn.online\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":137,"data":"{\"n\":\"pageview\",\"v\":33,\"u\":\"https://kwik.mewcdn.online/f/7HUhhvFhV7eN\",\"d\":\"kwik.bunniescdn.buzz\",\"r\":\"https://pahe.mewcdn.online/UBFaK\"}"}},"response":{"raw":"HTTP/2 202 Accepted\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 2\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 682664\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\ncache-control: must-revalidate, max-age=0, private\r\nvia: 1.1 Caddy\r\napplication: 127.0.0.1\r\npermissions-policy: interest-cohort=()\r\nx-plausible-dropped: 1\r\nx-request-id: GH8XnKb3M-0C21sdw4CJ\r\ncdn-proxyver: 1.41\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 202\r\ncdn-cachedat: 12/08/2025 00:59:00\r\ncdn-edgestorageid: 830\r\ncdn-requestid: f29a05268cb20aa00529eceb48e6465e\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-09-28T14:46:00.830499Z","times_seen":484813,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":8,"dns":1,"connect":1,"send":0,"wait":39,"receive":0,"ssl":4},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/cdn-cgi/challenge-platform/h/g/scripts/jsd/5eaf848a0845/main.js?","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/5eaf848a0845/main.js? HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0; pp_show_on_4e5e04716f26fd21bf611637f4fb8a46=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=XvP2uhcXNoLSf3blhjycjaoeghi8WzaYE4IlZQ4iJPjhan%2Fj9vkQ00Sj8jY%2F7R7W9YsvlPBQlD0qg1weMF5ggUyItVO5XqlDb7EccOfYCrk7iL2oi9AXmQ7pke66xFwGSZqGkhg%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\ncf-ray: 9aa85150bbaf568e-OSL\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=946\u0026min_rtt=398\u0026rtt_var=537\u0026sent=258\u0026recv=67\u0026lost=0\u0026retrans=0\u0026sent_bytes=268621\u0026recv_bytes=8900\u0026delivery_rate=14597652\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=27703\u0026ss_exit_bw=14597474\u0026ss_exit_reason=2\u0026cwnd=31013\u0026unsent_bytes=0\u0026cid=ab77c206a9cb10a7\u0026ts=1424\u0026inflight_dur=64\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10342,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (10342), with no line terminators","md5":"7a2c40942d6760132aeb848d3d14bb8b","sha1":"0daf8cf003b74a203d82f1f56982ba5f5550965d","sha256":"70003b4b1c293751ef0c4416395f8cfcfb1224e20d6868cf47d927360f6486c0","sha512":"c8e474cc636ef0bd7ed178a2eaf9754f20825d7c78d5873b19ed5473fe52afd2a6457d9196fedfffb12a3d482f9634c0b8068871f9e0fb03c53ad14835f5995d","ssdeep":"192:/AZ0e/4MS2FuzBhKEIqhh9dMRrhBpea/NCXXZggb:/4t/4kuzBhbLhLMPNqX2W","tlshash":"1322f8ce7d08301c6277306210bbf9f76029de896288dec596b2bc67aa35f781515f84","first_seen":"2025-12-08T00:59:29.50233Z","last_seen":"2025-12-08T01:17:03.321451Z","times_seen":3,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pahe.win/static/bundle.pack.js","fqdn":"pahe.win","domain":"pahe.win","tld":"win"},"ip":{"addr":"172.67.202.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pahe.mewcdn.online/UBFaK","date":"2025-12-08T00:58:59.367Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pahe.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 14:44:12 GMT","end":"Fri, 13 Feb 2026 15:42:35 GMT"},"fingerprint":{"sha1":"4D:3C:88:D7:06:31:6E:88:FD:C2:E4:7A:80:69:63:03:E1:FA:98:04","sha256":"CA:2E:69:7C:C7:BB:C2:CD:2E:5B:FC:50:07:41:B6:FB:F2:B2:53:FC:32:C6:6F:37:56:C9:E1:88:40:4C:AF:F3"}}},"request":{"raw":"GET /static/bundle.pack.js HTTP/1.1\r\nHost: pahe.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pahe.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"pahe.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"protrafficinspector.com/stats","fqdn":"protrafficinspector.com","domain":"protrafficinspector.com","tld":"com"},"ip":{"addr":"18.198.241.35","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"traffinspector.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 19 Nov 2025 00:00:00 GMT","end":"Fri, 18 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"11:9F:BE:35:27:7B:7B:85:C9:B3:FF:0E:CA:F6:0D:13:B0:A9:A0:BB","sha256":"81:A4:38:32:0D:BC:66:C8:7B:6D:08:BC:93:91:76:73:A2:BD:D0:53:3C:BF:2F:FD:B8:87:00:C6:EC:3B:6C:77"}}},"request":{"raw":"GET /stats HTTP/1.1\r\nHost: protrafficinspector.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://kwik.mewcdn.online\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 40\r\nserver: fasthttp\r\naccess-control-allow-origin: https://kwik.mewcdn.online\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\nset-cookie: uid_id2=c7dec667-1270-4f45-851f-b28d0fd44c7c:3:1; expires=Thu, 06 Dec 2035 00:59:00 GMT; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"0395a9137713b87dab7df1ed2cc1e5f6","sha1":"1a634981da28a140a785e70c64758a04d9c45a6d","sha256":"2184f129f5babf2a5c48cf91a57d40288ab46f550232dfe702bd59c9dfb99660","sha512":"6c7c2581e8cd865ea379fecfe7172243cc55576ffe451d5c669dbe90b5619784a51e2d44a33cc026b162171fc586196fd805379d866e5b2075ec604de0eb573e","ssdeep":"","tlshash":"0690045117074357450cc4311c053311c150d03c45f1103701f1f3330514c0d40d4315","first_seen":"2025-12-08T00:59:29.503765Z","last_seen":"2025-12-08T00:59:29.503765Z","times_seen":1,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":68,"dns":1,"connect":21,"send":0,"wait":21,"receive":0,"ssl":50},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flushpersist.com/pxf.gif?uuid=c7dec667-1270-4f45-851f-b28d0fd44c7c\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=4e5e04716f26fd21bf611637f4fb8a46\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=0","fqdn":"flushpersist.com","domain":"flushpersist.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:01.132Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"flushpersist.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 29 Oct 2025 22:02:45 GMT","end":"Tue, 27 Jan 2026 22:02:44 GMT"},"fingerprint":{"sha1":"F7:0F:08:42:86:24:7C:1B:49:6E:E0:01:4D:B6:85:C3:51:09:E9:4B","sha256":"57:4B:E8:D9:F8:CD:FB:C3:56:16:42:88:21:1B:6A:B3:83:F2:4E:B5:2C:AC:2C:6B:0E:46:6B:15:51:D1:3D:17"}}},"request":{"raw":"GET /pxf.gif?uuid=c7dec667-1270-4f45-851f-b28d0fd44c7c\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=4e5e04716f26fd21bf611637f4fb8a46\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=0 HTTP/1.1\r\nHost: flushpersist.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Mon, 08 Dec 2025 00:59:01 GMT\r\nContent-Type: image/gif\r\nContent-Length: 1\r\nConnection: keep-alive\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\nx-envoy-upstream-service-time: 1\r\nHost: flushpersist.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: ccfb8ba12df130b6ec4ca2129b9550cf\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":708,"timings":{"blocked":306,"dns":28,"connect":91,"send":0,"wait":94,"receive":0,"ssl":186},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"capaciousdrewreligion.com/advertisers.js","fqdn":"capaciousdrewreligion.com","domain":"capaciousdrewreligion.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"capaciousdrewreligion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Oct 2025 20:56:38 GMT","end":"Wed, 28 Jan 2026 20:56:37 GMT"},"fingerprint":{"sha1":"EB:17:57:F5:81:91:8C:ED:D5:07:18:77:76:BC:15:EB:E3:09:DE:A8","sha256":"CD:52:14:EF:16:E7:22:82:5F:7B:37:EF:C6:F7:C0:D3:88:13:69:A4:AD:0F:FE:9E:5F:6B:27:7B:24:50:DE:51"}}},"request":{"raw":"GET /advertisers.js HTTP/1.1\r\nHost: capaciousdrewreligion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Mon, 08 Dec 2025 00:59:00 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 0\r\nConnection: keep-alive\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: b61c2e1032c90da6c667fed7348d4d67\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":273,"timings":{"blocked":126,"dns":54,"connect":34,"send":0,"wait":18,"receive":1,"ssl":37},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"capaciousdrewreligion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"voraciousinfosag.com/pixel/pure","fqdn":"voraciousinfosag.com","domain":"voraciousinfosag.com","tld":"com"},"ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"voraciousinfosag.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Oct 2025 06:59:02 GMT","end":"Thu, 15 Jan 2026 06:59:01 GMT"},"fingerprint":{"sha1":"29:72:F7:97:EA:BA:F8:5E:0E:BD:FF:EC:7F:DC:F4:94:2D:BB:5A:7F","sha256":"EB:75:3C:6E:74:AA:2D:47:8E:9F:57:B4:3A:F8:16:AD:BA:8B:AA:3D:D7:DC:6A:FC:9E:54:14:36:86:5F:DB:17"}}},"request":{"raw":"OPTIONS /pixel/pure HTTP/1.1\r\nHost: voraciousinfosag.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://kwik.mewcdn.online/\r\nOrigin: https://kwik.mewcdn.online\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx/1.21.6\r\nDate: Mon, 08 Dec 2025 00:59:01 GMT\r\nConnection: keep-alive\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Max-Age: 1728000\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":742,"timings":{"blocked":324,"dns":48,"connect":91,"send":0,"wait":91,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"voraciousinfosag.com/pixel/pure","fqdn":"voraciousinfosag.com","domain":"voraciousinfosag.com","tld":"com"},"ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:01.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"voraciousinfosag.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Oct 2025 06:59:02 GMT","end":"Thu, 15 Jan 2026 06:59:01 GMT"},"fingerprint":{"sha1":"29:72:F7:97:EA:BA:F8:5E:0E:BD:FF:EC:7F:DC:F4:94:2D:BB:5A:7F","sha256":"EB:75:3C:6E:74:AA:2D:47:8E:9F:57:B4:3A:F8:16:AD:BA:8B:AA:3D:D7:DC:6A:FC:9E:54:14:36:86:5F:DB:17"}}},"request":{"raw":"POST /pixel/pure HTTP/1.1\r\nHost: voraciousinfosag.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 73\r\nOrigin: https://kwik.mewcdn.online\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":73,"data":"{\"bv\":\"25.6.4847\",\"error\":\"UUID request timed out or failed\",\"tmpl\":\"70\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Mon, 08 Dec 2025 00:59:01 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nHost: voraciousinfosag.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":520,"timings":{"blocked":-1,"dns":54,"connect":93,"send":0,"wait":95,"receive":0,"ssl":188},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"voraciousinfosag.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pahe.mewcdn.online/UBFaK","fqdn":"pahe.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-08T00:58:59.006Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /UBFaK HTTP/1.1\r\nHost: pahe.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Dec 2025 00:58:59 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nvary: Accept-Encoding, Accept-Encoding\r\nset-cookie: PHPSESSID=dd4cf6022b082e3eb4d99b5ace27aa16; path=/\nSERVERID=janna; path=/; HttpOnly; Secure\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache\r\npragma: no-cache\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Bt4I88glncQ6i6R1u%2FFPcRRH7sHyemCNz7y8nuCv%2BTfa74ZlSsh9uHYbGD6vqDyuGCPLoIXDVmbgyO4RmLN854mtEMHIu01q\"}]}\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\ncf-ray: 9aa85146ec5256b1-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":16325,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (1952), with CRLF, LF line terminators","md5":"8fe1fec55b1822dc71ee59f08924c15c","sha1":"de29d2869bab64e59f8484079a74e57ee2d46cf3","sha256":"cac9f237fa302787b7f61e32186d731338382fe3a302327372b2fa496d0a9069","sha512":"8fe1267f848f66ec19998a05cf5fa82f51734443fb9df7e74c2dfa677176b3e84d56c3ea702e1b53d535336931bed7a5bf4c099dd67dfd61aff0531a96c79952","ssdeep":"192:eaMF0TcrQ/tKq9XqB8L60HCKmKiGLwiIjtpENB8vU+jMOnx/k:HMWg2Kq9Xq6vtm933ggzjMOnx/k","tlshash":"5172527268e0642602e3c0c42971bb4dfde19107d61a9646b1fe1bdf1ff3e828c97969","first_seen":"2025-12-08T00:59:29.504768Z","last_seen":"2025-12-08T00:59:29.504768Z","times_seen":1,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":24,"dns":1,"connect":2,"send":0,"wait":129,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pahe.win/static/frontend/libs/cookieconsent/cookieconsent.css","fqdn":"pahe.win","domain":"pahe.win","tld":"win"},"ip":{"addr":"172.67.202.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pahe.mewcdn.online/UBFaK","date":"2025-12-08T00:58:59.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pahe.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 14:44:12 GMT","end":"Fri, 13 Feb 2026 15:42:35 GMT"},"fingerprint":{"sha1":"4D:3C:88:D7:06:31:6E:88:FD:C2:E4:7A:80:69:63:03:E1:FA:98:04","sha256":"CA:2E:69:7C:C7:BB:C2:CD:2E:5B:FC:50:07:41:B6:FB:F2:B2:53:FC:32:C6:6F:37:56:C9:E1:88:40:4C:AF:F3"}}},"request":{"raw":"GET /static/frontend/libs/cookieconsent/cookieconsent.css HTTP/1.1\r\nHost: pahe.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pahe.mewcdn.online/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Dec 2025 00:58:59 GMT\r\ncontent-type: text/css; charset=utf-8\r\nserver: cloudflare\r\nlast-modified: Mon, 12 Dec 2022 22:10:38 GMT\r\nvary: Accept-Encoding\r\nexpires: Mon, 12 Oct 2026 03:06:54 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 4581285\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pygZY%2F%2Bn3LJCPP7dAYudPNgyBia%2Bcd1JBOh5HWT8PzdLKTNXONBJrZ59aePnLCZmNScPF4kZ86ZWiwpJI1hunLBxl8P%2Bdg%3D%3D\"}]}\r\ncf-ray: 9aa851497d1356c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18803,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1000), with no line terminators","md5":"02e84edb7bf23f54e06e116c6a028cd6","sha1":"60c5ca781d7507f90a14b9af630d028e4b62cf39","sha256":"c1724048077b5cd57fafc0190170fe5d9f3410a910167cb94eab3bdde856d819","sha512":"594d8789c2d7911b1275653683fef5939ba90a762485c988b1acd33e8bdcfefb57b248b0abfa1bbf8729d7145a626128343376909b1a246d3c4fd715b36a3797","ssdeep":"","tlshash":"b311e1bdf128c1e804feb42652ac275376ecb41ecfd84c86e3e492c173cb24406b946a","first_seen":"2025-12-08T00:59:29.505742Z","last_seen":"2025-12-08T00:59:29.505742Z","times_seen":1,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"pahe.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pahe.win/static/server.min.js","fqdn":"pahe.win","domain":"pahe.win","tld":"win"},"ip":{"addr":"172.67.202.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pahe.mewcdn.online/UBFaK","date":"2025-12-08T00:58:59.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pahe.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 14:44:12 GMT","end":"Fri, 13 Feb 2026 15:42:35 GMT"},"fingerprint":{"sha1":"4D:3C:88:D7:06:31:6E:88:FD:C2:E4:7A:80:69:63:03:E1:FA:98:04","sha256":"CA:2E:69:7C:C7:BB:C2:CD:2E:5B:FC:50:07:41:B6:FB:F2:B2:53:FC:32:C6:6F:37:56:C9:E1:88:40:4C:AF:F3"}}},"request":{"raw":"GET /static/server.min.js HTTP/1.1\r\nHost: pahe.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pahe.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Dec 2025 00:58:59 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Tue, 12 Sep 2023 15:23:54 GMT\r\nvary: Accept-Encoding\r\nexpires: Sat, 24 Oct 2026 22:56:00 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 3306040\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=upJRFyQtAszWWHlexw4ZVxFluqUhNaP1Y8583NpY9Kay5S2pXzdQmj1G%2BuX4quTLNkpmh%2BJBAl80DIhJ1EMqoc9WPA4X5Q%3D%3D\"}]}\r\ncf-ray: 9aa851497d0c56c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6624,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (6624), with no line terminators","md5":"c50c6644a1224a8e37de5332c627e01e","sha1":"9d394377c2e2552574cccc8c64cdf1c349879f98","sha256":"0963849b9fc2cbc55745df1a15d55f06cd46c2fec034129aee8bd588cd09fd47","sha512":"8c34dc73603106df63d189721ceb48061119a2948c022949f93d2a4570b2bf0fa68e305bb95621bacff978c9bbc80e0f6b1e8f88192d960f2a2c87d86e226ae7","ssdeep":"96:dOPy3PVXbc+GPyMwVJvccc0RCYwq8IjPj6jljCVwVJ0G2wVJsHJI2oqA:dOq3PVoJKMcvczjYgorWNkc0bc8JI2g","tlshash":"d4d1861db090c6de127734bb606b6a17f0b22c29da466000d25a18ba5fedec4643bf1e","first_seen":"2023-09-29T22:21:09Z","last_seen":"2026-09-09T21:51:09.281231Z","times_seen":172,"resource_available":true,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":22,"connect":3,"send":0,"wait":15,"receive":0,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"pahe.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/fonts/fa-solid-900.woff","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.410Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /app/fonts/fa-solid-900.woff HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://kwik.mewcdn.online/app/css/downstream.css\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: font/woff\r\ncontent-length: 80484\r\npriority: u=4,i=?0\r\nlast-modified: Thu, 06 May 2021 07:01:15 GMT\r\nexpires: Thu, 19 Nov 2026 17:17:48 GMT\r\ncache-control: max-age=31536000\r\naccept-ranges: bytes\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 1031702\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ho8HBdEqV8FwDG0Otc7LK%2FlS68e2naEeQeHA2Ue60%2F0C%2FoO9NsbDDLwbNHRk3Pr8P1j5euOAaLn%2BuOmlwbGgL%2FkNOWCd48w%3D\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-ray: 9aa8514f9b78568e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80484,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 80484, version 1.0","md5":"2d0415fa29ea596b7a02c78eddeede20","sha1":"80d33a73cbb60e206ef6f5c898988641576c7dda","sha256":"48745629a252fb4e8d2750527c0d49341c2c17d5fe5bc6a37ec82b062ae84c9c","sha512":"da41eeacf2ba370f044f14f61b6b2df9dfb7cc5b4b8518a5fa822909958213c64852fdbf1093fbc8947066a8bbee97639a0ad257cf65eae2b839141837ec42b4","ssdeep":"1536:OowQDx3FIFA2uOjEAmY7oRFjji8iSVl4qeosQ/qeLr0mLv9:OowAx3WFA2uOjLncZiLSVx7/qELv9","tlshash":"4a731285933a5bb2b73a4ebf464f707976be76d9104d428cf501fa28e4b4731c0e88a1","first_seen":"2023-05-01T23:23:01Z","last_seen":"2026-09-17T18:56:44.028411Z","times_seen":87,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/cdn-cgi/rum?","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"POST /cdn-cgi/rum? HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\ncontent-type: application/json\r\nContent-Length: 1072\r\nOrigin: https://kwik.mewcdn.online\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0; pp_show_on_4e5e04716f26fd21bf611637f4fb8a46=1; cf_clearance=haAhkaMrz0nr32bLzxKeoq2t2z4K1F8h54219eo_pos-1765155540-1.2.1.1-Icz68rGiHSElRlmWYjV_HbM28GDITe.VuQbhUgkbZ6.7AR7PuzTcYUPfP_qNfaJtaZuq5F3P03k5o9sC48vtk3UYRNNQNj5w6JZR1s8EcW9KpTOOwQnKNHhSLyiNMlQj7smnFRTNt2RbYoA0BWjS_W8MuMeij1hbVxp56dJ74vRmCHpGruZTr6IeBF_._RGOFprTKXbS94JOglyxGPT0k_6y3gbjLSzO6ygy9pOZvSo\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1072,"data":"{\"memory\":{},\"resources\":[],\"referrer\":\"https://pahe.mewcdn.online/UBFaK\",\"eventType\":1,\"firstPaint\":0,\"firstContentfulPaint\":539,\"startTime\":1765155539964,\"versions\":{\"fl\":\"2024.11.0\",\"js\":\"2024.6.1\",\"timings\":2},\"pageloadId\":\"4eadab34-b50d-4355-abb3-5e2acd7adb5f\",\"location\":\"https://kwik.mewcdn.online/f/7HUhhvFhV7eN\",\"nt\":\"navigate\",\"timingsV2\":{\"unloadEventStart\":0,\"unloadEventEnd\":0,\"domInteractive\":519,\"domContentLoadedEventStart\":593,\"domContentLoadedEventEnd\":598,\"domComplete\":835,\"loadEventStart\":835,\"loadEventEnd\":836,\"type\":\"navigate\",\"redirectCount\":0,\"initiatorType\":\"navigation\",\"nextHopProtocol\":\"h3\",\"workerStart\":0,\"redirectStart\":0,\"redirectEnd\":0,\"fetchStart\":0,\"domainLookupStart\":0,\"domainLookupEnd\":0,\"connectStart\":0,\"connectEnd\":0,\"secureConnectionStart\":0,\"requestStart\":34,\"responseStart\":225,\"responseEnd\":225,\"transferSize\":44910,\"encodedBodySize\":43496,\"decodedBodySize\":150061,\"name\":\"https://kwik.mewcdn.online/f/7HUhhvFhV7eN\",\"entryType\":\"navigation\",\"startTime\":0,\"duration\":836},\"siteToken\":\"55da1edd4fd242db9002a0d888a93773\",\"st\":2}"}},"response":{"raw":"HTTP/3 404 Not Found\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SvITd3kyepmtLCipVzQdKW6kJ9Ee5iBO4VI3Cy5PwElbtc%2BSsMpDhv5MDz6rJfKnvYNbm3OxP1TrALXw%2FOTtNMt0Z37A3pPwA%2FoGhgD9s0Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: 9aa851522bbf568e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":151,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"45efc4779b2e6b43ed200755328af518","sha1":"badb6097a3c8fad00517f38352ba72b9f7b6637b","sha256":"d66dd0f2f24c4343661a5396e1ba76782fe651f7d422209eded956ebf90900fc","sha512":"862ceb668672d90ed3da9419ca69bf0214b5c34dec2353fea792a75fb1c0c2e5fd54e6e56cf1e9d4d60c4eaa7d98411f5cb5e128be2661d9bbd084d0dbd085e0","ssdeep":"","tlshash":"a1c02b3d35637e0c8563303522c3b190d0c6833774ba00220500c00330cb2e9cac33d7","first_seen":"2023-09-18T10:37:28Z","last_seen":"2026-09-27T19:19:29.834828Z","times_seen":19564,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/css/plyr.min.css","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.230Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /app/css/plyr.min.css HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\nlast-modified: Sun, 17 Oct 2021 07:43:37 GMT\r\nexpires: Thu, 19 Nov 2026 18:49:47 GMT\r\ncache-control: max-age=31536000\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 770867\r\ncf-cache-status: HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FnneKPkXYDxbEpkzgOQKzz1ik9wiad2Kp%2FcjWoL55WosNkZdBa4TOEftgiJpuPjvSFtcL9QGaX03vWWd5GWxHLyApzQqGNM%3D\"}]}\r\ncf-ray: 9aa8514e6b66568e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34673,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (34671), with no line terminators","md5":"0fab1b2866f80525d4f0439e6ee922ba","sha1":"ebcdbff7a3df48105e5c4a6a9342fc3340239f41","sha256":"92f682f3bcbbd42d72e38cd9974522f9e2c1d0f371062cc5c8dd4c2fbb6ceff1","sha512":"1666ef325c75d0faad966a328290b07dccdf8af4e096e3bb8e75094a35f20d972d6d1f29e2f986695b5fb4404d74c5a5139d201c61eb5b29d452baca896756c6","ssdeep":"384:fjvC0N8LOiy8U4eg9qgjg4g4gS0+ocaLU2xA/rjybIphWpbIn4pdpjxb3:fO0N8LOi+4r0+QjbIphWpbIn4pdP","tlshash":"fef243a079686238b837d55d37b0c5ce237cd102fd965ab9f194b7608eceab346b3601","first_seen":"2023-05-01T23:23:01Z","last_seen":"2026-09-08T19:59:27.037922Z","times_seen":77,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"recordedthereby.com/sfp.js","fqdn":"recordedthereby.com","domain":"recordedthereby.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.547Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"recordedthereby.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 01 Nov 2025 21:52:16 GMT","end":"Fri, 30 Jan 2026 21:52:15 GMT"},"fingerprint":{"sha1":"28:00:54:93:14:36:88:7E:A5:2B:E0:C9:FA:D5:79:F3:BD:1E:EE:C2","sha256":"B0:4F:43:83:79:3A:6D:87:46:75:6E:1F:97:87:CA:CD:68:65:04:31:42:55:45:13:AE:56:BD:AC:22:F0:AF:A7"}}},"request":{"raw":"GET /sfp.js HTTP/1.1\r\nHost: recordedthereby.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Mon, 08 Dec 2025 00:59:00 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 32181\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nP3P: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\nAccess-Control-Allow-Origin: *\r\nVary: Accept-Encoding\r\nHost: recordedthereby.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: b496b16279ae714c2e7f9923471ec919\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85379,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators","md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-09-03T10:37:11.15018Z","times_seen":27836,"resource_available":true,"data":null}},"time_used":245,"timings":{"blocked":101,"dns":41,"connect":17,"send":0,"wait":26,"receive":19,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"recordedthereby.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"recordedthereby.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"recordedthereby.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"recordedthereby.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"professionaltrafficmonitor.com/stats","fqdn":"professionaltrafficmonitor.com","domain":"professionaltrafficmonitor.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.547Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /stats HTTP/1.1\r\nHost: professionaltrafficmonitor.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://kwik.mewcdn.online\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kwik.mewcdn.online/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":152,"dns":0,"connect":22,"send":0,"wait":0,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/favicon.ico","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:01.033Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0; pp_show_on_4e5e04716f26fd21bf611637f4fb8a46=1; cf_clearance=haAhkaMrz0nr32bLzxKeoq2t2z4K1F8h54219eo_pos-1765155540-1.2.1.1-Icz68rGiHSElRlmWYjV_HbM28GDITe.VuQbhUgkbZ6.7AR7PuzTcYUPfP_qNfaJtaZuq5F3P03k5o9sC48vtk3UYRNNQNj5w6JZR1s8EcW9KpTOOwQnKNHhSLyiNMlQj7smnFRTNt2RbYoA0BWjS_W8MuMeij1hbVxp56dJ74vRmCHpGruZTr6IeBF_._RGOFprTKXbS94JOglyxGPT0k_6y3gbjLSzO6ygy9pOZvSo\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 Forbidden\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:01 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=6,i=?0\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: referer, accept-encoding\r\ncontent-encoding: br\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dyh3%2B2ZrF0YLz6B4XJyDmoo25EXgV2VBrrprWF%2FFKEbPJZF5c26dR%2FOUG07%2B5J%2FutCWiMech7YheK5Lp80B3wm1CwuBg%2FXE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-ray: 9aa851537bc7568e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"6db22053bf9ac0255bd0f7ff56690ded","sha1":"9cc2bd47005e1fd1908c4e2038e5ea210fd03590","sha256":"dc68b4a4812d44cd603b4837e68f7992cbecbddf364d5a371b6282728ad34a18","sha512":"361360cf4e54e8b3889690ab015783dae6c4b9ad2978af00ed17b69fc0a64a7b2ef79a3a32e2cd8420e63ea090bab274dacdac763e5603d820a508924745983c","ssdeep":"","tlshash":"db60000300000003000c003c00300c00000c003300033c3f3c0003fc30f03c0cc0030c","first_seen":"2023-05-10T07:37:32Z","last_seen":"2026-07-06T10:27:02.880877Z","times_seen":40,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pahe.win/static/frontend/js/app.min.js","fqdn":"pahe.win","domain":"pahe.win","tld":"win"},"ip":{"addr":"172.67.202.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pahe.mewcdn.online/UBFaK","date":"2025-12-08T00:58:59.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pahe.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 14:44:12 GMT","end":"Fri, 13 Feb 2026 15:42:35 GMT"},"fingerprint":{"sha1":"4D:3C:88:D7:06:31:6E:88:FD:C2:E4:7A:80:69:63:03:E1:FA:98:04","sha256":"CA:2E:69:7C:C7:BB:C2:CD:2E:5B:FC:50:07:41:B6:FB:F2:B2:53:FC:32:C6:6F:37:56:C9:E1:88:40:4C:AF:F3"}}},"request":{"raw":"GET /static/frontend/js/app.min.js HTTP/1.1\r\nHost: pahe.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pahe.mewcdn.online/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 08 Dec 2025 00:58:59 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Tue, 22 Aug 2023 12:20:04 GMT\r\nvary: Accept-Encoding\r\nexpires: Wed, 22 Apr 2026 23:29:31 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 8706249\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3et0x66x9QjiZhO%2FOzUjfaE%2BRnIUn3Rgu3ZSJq2UgF09b4%2Fa%2BFUth2568M09Aaw8mr%2BFEHTZhtldplP8wzK3w6%2FPlQR%2BnA%3D%3D\"}]}\r\ncf-ray: 9aa851497d1156c1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5886,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5886), with no line terminators","md5":"82374b423499415c2c3173513ec1615c","sha1":"3b219efdc592a49a680e2c71cb22989c686b5417","sha256":"12116847297eb16ae5aa1d26b27a0b4704afcc352272ab89cd6d28a27b2604be","sha512":"48112faa6213433eb691513296bd7cd2bd85db22f0bc8547651ae3aebcf003c0817218f5e86cd90affedcbc74d765e25621c372b304914322f509a2ebf3b7ab7","ssdeep":"96:AMEaQNRdcaNOyculEVlUKpIlIRIBAIBRIqCyAIc7K0M0MlpwRyf2p:bEaQNToyXEDSVLf2","tlshash":"55c18408b15cb5a722fb7136881fba0950727984c656e049a560e1f42facec62973f3f","first_seen":"2023-09-11T11:11:16Z","last_seen":"2026-09-09T21:51:09.287699Z","times_seen":82,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":24,"connect":3,"send":0,"wait":7,"receive":0,"ssl":43},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-08","alert":"Sinkholed","trigger":"pahe.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/js/downstream.js","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /app/js/downstream.js HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\nlast-modified: Thu, 14 Apr 2022 05:59:28 GMT\r\nexpires: Tue, 10 Nov 2026 15:01:50 GMT\r\ncache-control: max-age=31536000\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 1669602\r\ncf-cache-status: HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pN7BPnHDmM%2FQhegStCL28iNcY277EGz3BZSs%2BB2IShF8QwPsPidac9rsx4E%2BRdiM%2BjBpXLrs%2F3lU0bSATD95GMVh48%2Bz\"}]}\r\ncf-ray: 9aa8514e6b6a568e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5990,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"1bafb19b63f8d4df9df4b37ee98181ce","sha1":"c65d58b17925b5b1f709a7996129f33eb206479f","sha256":"a748fa0745603a994e1d242efe1f91e0e3955919f788558b6c3ebc7d18d3a9bd","sha512":"413614fcdd2832e22d01877fa8b14070ff9dca8863939dffc4153d8ca757628f6be94e5aa7f3489e56b2322d1c4a8e032653a11f016d1c8961574380b36c5289","ssdeep":"96:uXnomNNgRKriZMfj4pWy4lbY6INg/FHhSg1MxUAHA/iU4mf47MUZmI6kvekC6QeP:uXom0UjOyU1g9BSg1MxUAHA/isA7MRI1","tlshash":"e2c1981c79f91870013f317a1a6f694e3a7ed047018ace41b8fd96d40fa055856b79fe","first_seen":"2025-01-20T03:46:45.42764Z","last_seen":"2026-07-10T12:00:56.276861Z","times_seen":31,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.575Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0; pp_show_on_4e5e04716f26fd21bf611637f4fb8a46=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\npriority: u=3,i=?0\r\ncf-ray: 9aa851509bad568e-OSL\r\nlocation: /cdn-cgi/challenge-platform/h/g/scripts/jsd/5eaf848a0845/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\ncontent-length: 0\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=sTxBTBtOj8Q3wYqVMxAgew206BvGYO4RtLWzCNJKlwNGH0L0Zs2N00mVvY79IVuYLm6mkh6lyD%2BtpwwTZfAmsxYJs6D0kKiyf99xAKCUW71GP0FOLFJd2lWTxxUCzyUrkJm5Jv0%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=946\u0026min_rtt=398\u0026rtt_var=537\u0026sent=256\u0026recv=66\u0026lost=0\u0026retrans=0\u0026sent_bytes=267825\u0026recv_bytes=8300\u0026delivery_rate=14597652\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=27703\u0026ss_exit_bw=14597474\u0026ss_exit_reason=2\u0026cwnd=31013\u0026unsent_bytes=0\u0026cid=ab77c206a9cb10a7\u0026ts=1407\u0026inflight_dur=64\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10342,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-28T14:46:47.346954Z","times_seen":18708784,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/f/7HUhhvFhV7eN","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-08T00:58:59.986Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /f/7HUhhvFhV7eN HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://pahe.mewcdn.online/UBFaK\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=1,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\ncache-control: no-cache\r\nset-cookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; expires=Mon, 08 Dec 2025 02:59:00 GMT; Max-Age=7200; path=/; httponly\nsrv=s0; path=/; HttpOnly; Secure\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver-timing: cfCacheStatus;desc=\"BYPASS\", cfEdge;dur=23,cfOrigin;dur=31, cfExtPri\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rchBtRahly0j1vEb3Hk9vyYosFlzOdI7R8rmqqt1uXb8LLEUjvkkU5uXB0Oe2dpG15rodhNymJpnmWjxMRebSisfv1Eecv4%3D\"}]}\r\ncf-ray: 9aa8514cfb60568e-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":150061,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (63576)","md5":"e17217a6fcdd463d104bb0f81f97dced","sha1":"17f37f0c4964e0b5c835d7cf3aaf8567a2b941fc","sha256":"0cd8183edc3b6eb0dfed3959e6add86752d6e1d82f72732a3b379bcfca3eb60c","sha512":"08633329d3d03601fc44c4bb09e78d6db0e14198665f73af07945eeb3bb9497363d0eb4b16eeb8bff8b968c9e49e6ecf7649d7b795f48330e3939045139f60ca","ssdeep":"1536:Dd/Xkv7A/8z4hER2jaLS/QEWUh/lJBMCtVCyxGu74cZvXicv1fbCJouw0JckG0ZZ:qOERY/CyrvXicv1fbGhopUWk","tlshash":"02e3c7487fe1b02cc36a61bb232f560ad0576e42918cd948f1aff4e02f5664af63b754","first_seen":"2025-12-08T00:59:29.516775Z","last_seen":"2025-12-08T00:59:29.516775Z","times_seen":1,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":13,"dns":0,"connect":0,"send":0,"wait":191,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kwik.mewcdn.online/app/js/vendor/jquery.min.js","fqdn":"kwik.mewcdn.online","domain":"mewcdn.online","tld":"online"},"ip":{"addr":"172.67.147.101","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kwik.mewcdn.online/f/7HUhhvFhV7eN","date":"2025-12-08T00:59:00.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mewcdn.online","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 02 Dec 2025 22:53:53 GMT","end":"Mon, 02 Mar 2026 23:52:39 GMT"},"fingerprint":{"sha1":"3A:2C:88:7A:F2:C9:2B:81:18:5D:B9:AB:36:15:55:3C:EA:C7:6F:4B","sha256":"FA:C8:64:2E:18:61:0D:41:F7:F3:04:7A:6A:63:95:AA:61:00:F7:C7:0A:4D:39:1D:A0:12:91:27:5C:3F:A3:97"}}},"request":{"raw":"GET /app/js/vendor/jquery.min.js HTTP/1.1\r\nHost: kwik.mewcdn.online\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://kwik.mewcdn.online/f/7HUhhvFhV7eN\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: kwik_session=eyJpdiI6Ink0SW5RZ29pdzdVNk1vMzVPZkR1VGc9PSIsInZhbHVlIjoiZEhwL1ZpQW1UMzM4amVjM2tIbnA5UnBqL2NrV2dXY0plUGg5T0luUmJNWlA3RmpuTkgyRTl3UVRvcjhpMTBxOEI4dXJkZDRaNiszR0g4ZGo4OEtuR3BXMUs2Z0FMNGhzWTV2blpPYVNjU25vUjRSc1A4eWpjU2dpY042WlU1ODEiLCJtYWMiOiI2NjI2NWY4MWI1MjY1ZGU1MDFlMmIwNTQwZThjNTdhOTlkZTJhMjU4NWE5MTczNzhmNWY4YjRhZTdjOGU0MTNlIiwidGFnIjoiIn0%3D; srv=s0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Mon, 08 Dec 2025 00:59:00 GMT\r\ncontent-type: application/javascript\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding, Accept-Encoding\r\nlast-modified: Sun, 08 Aug 2021 13:12:26 GMT\r\nexpires: Sat, 28 Nov 2026 05:27:42 GMT\r\ncache-control: max-age=31536000\r\nreferrer-policy: no-referrer-when-downgrade\r\nstrict-transport-security: max-age=63072000;includeSubDomains;preload\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 770867\r\ncf-cache-status: HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9XHf8y9nVz%2F6SPBXXQonQP%2FM%2FgPB44mK11ZUO%2BAHyuzkV4FeClxuVdXa1aekvzTyAs2RvbJI7z85ecy5juVXlt7%2FLlnj9g0%3D\"}]}\r\ncf-ray: 9aa8514e6b68568e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89501,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-09-28T14:50:20.619545Z","times_seen":506433,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}