{"report_id":"809cb89d-758e-42cf-9ac1-78eebb805d11","version":0,"status":"done","tags":["suspicious"],"date":"2026-07-22T21:53:18Z","url":{"schema":"https","addr":"ccleaner.lol/","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"172.67.162.22","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"ccleaner.lol/","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"title":"Ultra Cleaner - GOOGLE PLAY","dom":{"size":13468,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"61c39f073b008de43229c65beb939d0f","sha1":"6d582bce7d910ce73f6d3458088d3b1993c75d98","sha256":"b15fba17c7b26b0ae5421d00a8f5a51a316c9347453ffd81eb47b4b889c0fe70","sha512":"2697b439db847a0fb33b23c299c4678d957706e43b6211854ff9e1fba04c165e6353003e4e10368fb60e469e4ec674ef8b1644ba469613a2b414a28d84373150","ssdeep":"192:o7qSk//YVVoZnEVfWLwDYnRNmC+w8oKgRjshv/j+ZgErrJhLdj:hrcYN67oKgRghv/j+3r9","tlshash":"f95274a242f70827349ac4913fa7978b3a959083951bd6543bfd87d48fc2d92e913b8c","dom_hash":"domhash11ec99d3bd8499bca9da6c3f7199bd93","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ccleaner.lol/","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"172.67.162.22","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T21:53:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"ccleaner.lol/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"ccleaner.lol","ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-20","domain_rank":0,"first_seen":"2026-07-22T21:53:18.551816Z","last_seen":"2026-07-22T21:53:18.551816Z","alert_count":18,"request_count":8,"received_data":202652,"sent_data":4021,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.telegram.org","ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":206724,"first_seen":"2015-06-25T10:09:00Z","last_seen":"2026-07-21T20:53:14.116342Z","alert_count":0,"request_count":2,"received_data":724,"sent_data":1169,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn-icons-png.flaticon.com","ip":{"addr":"23.36.76.123","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2013-05-10","domain_rank":239972,"first_seen":"2021-09-02T06:55:19Z","last_seen":"2026-07-17T06:29:22.949059Z","alert_count":0,"request_count":1,"received_data":15704,"sent_data":555,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"ccleaner.lol/","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a4796167988d680dac9eff20fd6b5442","sha1":"cc7930cc594df603062d6a6ac941dcac8b0925ba","sha256":"44c95f7d72cf5c53d1f681a3c1d109fd4b186f886bd0950328c9101b1c42c662","sha512":"0f7ab87ce60941c0ae2aa47cd023c0aaa128e57745f1152cba3ce59215e6df8d3050016eb43b71ebe7015ffde28d307f6435302d774fb87650b55ce111b82434","ssdeep":"","tlshash":"c761336912770d790453b4bf7b8b7504263390a33608dd66796dc681bf86a34c2b37db","size":3464,"data":"","first_seen":"2026-07-22T21:53:21.594519Z","last_seen":"2026-07-22T21:54:14.507553Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"ccleaner.lol/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ccleaner.lol/image/5.jpg?v=2","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:51.977Z","timestamp":1784757171977,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 22:52:04 GMT","end":"Sun, 18 Oct 2026 23:48:06 GMT"},"fingerprint":{"sha1":"E2:5A:A2:70:87:23:CE:4D:54:EC:75:44:EE:74:FC:0B:0F:94:D6:41","sha256":"16:D2:62:8D:7B:FF:44:B0:10:57:A9:B6:CF:B0:CB:EC:6C:D8:8E:20:D2:44:C2:A4:A5:7C:6D:06:20:05:38:A1"}}},"request":{"raw":"GET /image/5.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 20 Jul 2026 23:48:31 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb3cf-8658\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aGhiDRgQF87xLsYeQnT1tCNfCrcg%2FtTcGIbmJOyONdnGNpRb7gh0MVwULVkwUYJz8SCYlMTFvcXQq53U3xxFLXKnFQEuNi2X%2BIeKrPoF79wclzZ70bLxuIGFVPoO504%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5acc4d991712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34392,"size_decoded":34788,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 234x756, components 3","md5":"d1c2512d67243b8367e9fa338ac36a74","sha1":"aeb60c827e30192c7f2d63f7c1811ab01b31cf64","sha256":"970ee8cb5131f999966ef678655614f691279c1dd33661fd5a7739d59edc7988","sha512":"11ca90207d036e0991727997656f14937322c841684d65bf75842d2a452d3435ec0fb9bd2fadda235f22fd9fcaf0a181d990a0336afbe561930144aeaf3c6ad6","ssdeep":"768:dTYsI59P7LkQxzOZG07Ybny1/J2SgwGRq:dTYsMjLQPYbnsryq","tlshash":"bef2f1b7e6303b91e91d2ebec5f44382eadbfe26581349d71878943e4f2903477a1845","first_seen":"2026-07-22T21:53:21.552595Z","last_seen":"2026-07-22T21:54:14.493323Z","times_seen":2,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8902150277:AAF5CpDD7PFGufvmaRdzB8L32d7vgCFylrY/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:51.989Z","timestamp":1784757171989,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:09 GMT","end":"Sun, 13 Dec 2026 15:14:09 GMT"},"fingerprint":{"sha1":"EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41","sha256":"64:47:03:9A:C9:ED:B9:03:8C:07:6E:AA:3D:BF:75:4B:4C:C1:4E:C1:A5:8C:83:2D:3E:FD:0C:E7:F7:82:C2:71"}}},"request":{"raw":"OPTIONS /bot8902150277:AAF5CpDD7PFGufvmaRdzB8L32d7vgCFylrY/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://ccleaner.lol/\r\nOrigin: https://ccleaner.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\nserver: nginx/1.30.1\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: content-type\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":334,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T00:24:31.034548Z","times_seen":17464322,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":0,"dns":1,"connect":18,"send":0,"wait":20,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn-icons-png.flaticon.com/512/732/732208.png","fqdn":"cdn-icons-png.flaticon.com","domain":"flaticon.com","tld":"com"},"ip":{"addr":"23.36.76.123","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:51.970Z","timestamp":1784757171970,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.flaticon.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 29 May 2026 07:09:24 GMT","end":"Thu, 27 Aug 2026 07:09:23 GMT"},"fingerprint":{"sha1":"3F:C9:F2:2C:B9:3D:5A:B8:5C:51:20:99:4A:C7:F4:FD:B5:63:CE:B3","sha256":"48:B1:A6:08:9F:69:B3:F5:90:BB:AD:4A:A5:2D:34:F3:29:98:74:97:08:A8:63:F0:CC:8B:1F:82:E6:40:F8:E6"}}},"request":{"raw":"GET /512/732/732208.png HTTP/1.1\r\nHost: cdn-icons-png.flaticon.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-length: 15167\r\netag: \"8412cc2c8fb288c9c3cb9063e2e2aa11\"\r\nlast-modified: Thu, 24 Apr 2025 01:39:04 GMT\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\nalt-svc: h3=\":443\"; ma=93600,h3-29=\":443\"; ma=93600\r\nserver-timing: cdn-cache; desc=HIT, edge; dur=41, ak_p; desc=\"1784757171968_388254846_50203064_4096_1339_0_23_22\";dur=1\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\npragma: public\r\ncache-control: public, max-age=31536000\r\nx-default-rule: YES\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":15167,"size_decoded":15704,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"8412cc2c8fb288c9c3cb9063e2e2aa11","sha1":"83937b799fe0b96626825b2fa42ef19191d4cc92","sha256":"d08838f32bcc7cec0c1961f399b85207d038e5021f374863edad9f1219a76904","sha512":"dcac32f03607bf7c08cbf7a09e547e984a4e193bb5ea5b00a7a724196fa59b5da0cdee90240022dd8119719396ef53010f3108d0a5634e709a85931ba8be1e69","ssdeep":"384:oVwxF2+4dsciLvJxMXNK0pMRQa9hqjynI33Lmj643Wp4FPOA4FLdJhh37oIu:7v2Tds302RrqjyW3LmmpNLdJhh3w","tlshash":"8362c144e8f31f5bd62d38f91e46296409860d6f9387c4db82f8ccf46b8e9d1976a070","first_seen":"2024-05-22T15:18:49Z","last_seen":"2026-07-22T21:54:14.497574Z","times_seen":30,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":44,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8902150277:AAF5CpDD7PFGufvmaRdzB8L32d7vgCFylrY/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:51.986Z","timestamp":1784757171986,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:09 GMT","end":"Sun, 13 Dec 2026 15:14:09 GMT"},"fingerprint":{"sha1":"EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41","sha256":"64:47:03:9A:C9:ED:B9:03:8C:07:6E:AA:3D:BF:75:4B:4C:C1:4E:C1:A5:8C:83:2D:3E:FD:0C:E7:F7:82:C2:71"}}},"request":{"raw":"POST /bot8902150277:AAF5CpDD7PFGufvmaRdzB8L32d7vgCFylrY/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ccleaner.lol/\r\nContent-Type: application/json\r\nContent-Length: 199\r\nOrigin: https://ccleaner.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":199,"data":"{\"chat_id\":\"7755410152\",\"text\":\"🟢 \u003cb\u003eПосетитель:\u003c/b\u003e\\n\\n1) ID: \u003ccode\u003ewzx2455mi\u003c/code\u003e\\n2) Время захода: 22. 7. 2026 21:52:51\\n3) Скачал: нет💩\",\"parse_mode\":\"HTML\"}"}},"response":{"raw":"HTTP/2 400 \r\nserver: nginx/1.30.1\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 56\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":56,"size_decoded":390,"mime_type":"application/json","magic":"JSON text data","md5":"d948d5845276032d39194409db9ad97b","sha1":"475fe4e71224df85d494e34e0cb8ed799afcdb0d","sha256":"a0a1e0f24b392c6da875c10977d169497a47f669b7e671e62330e125a56721fb","sha512":"3e538a78d85dc32eb47db705c97d627ed8851f6dd87904e2e39aa1d5357cdeaea2a7746fc2ccddbde9bcbcab66ddcceff4ab5cf8db169c49e0f81c592104c67f","ssdeep":"","tlshash":"22900244098ed56744da11605935954855b756b8641964404d95611d56421ea58f240a","first_seen":"2023-07-28T20:34:41Z","last_seen":"2026-07-22T21:53:21.55861Z","times_seen":456,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.lol/favicon.ico","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:52.138Z","timestamp":1784757172138,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 22:52:04 GMT","end":"Sun, 18 Oct 2026 23:48:06 GMT"},"fingerprint":{"sha1":"E2:5A:A2:70:87:23:CE:4D:54:EC:75:44:EE:74:FC:0B:0F:94:D6:41","sha256":"16:D2:62:8D:7B:FF:44:B0:10:57:A9:B6:CF:B0:CB:EC:6C:D8:8E:20:D2:44:C2:A4:A5:7C:6D:06:20:05:38:A1"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ccleaner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zZx5WzhrmPmDVZIg5maN%2B4dOWJSUnkyVqAuSExx%2BMvVjdTVOP7mySMwsvDfCK73A0z4suALapCtwHvKosdVJ1sPqR3KJodI6ux8sHHFtsPQcYSHTz5M4UJ0OMaMZ4TM%3D\"}]}\r\npriority: u=6,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a1f5acc5d9a1712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":275,"size_decoded":838,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"70701af31927dc855cad5bcfc3cb25ae","sha1":"ab56847ad9f7698426c058f86c48b23e8736441a","sha256":"3dbff59cc2a495535e07dbb9f4e61f2292db413d6c3586b8da439bb0046e6d5d","sha512":"949cbf67fd11ea7a89c7ac3bf9602e46e28b12067bd42f1a438255b9cee6107e39d744f03790269bedc495f66f27d789ba518121497f284c21bdf7c2fd117ad3","ssdeep":"","tlshash":"87d02bdf904363974811196039c115c2268d12eaa43a81a83dc6d48b529857ecdda99c","first_seen":"2026-07-22T21:53:21.561315Z","last_seen":"2026-07-22T21:53:21.561315Z","times_seen":1,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.lol/","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T21:52:51.270Z","timestamp":1784757171270,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 22:52:04 GMT","end":"Sun, 18 Oct 2026 23:48:06 GMT"},"fingerprint":{"sha1":"E2:5A:A2:70:87:23:CE:4D:54:EC:75:44:EE:74:FC:0B:0F:94:D6:41","sha256":"16:D2:62:8D:7B:FF:44:B0:10:57:A9:B6:CF:B0:CB:EC:6C:D8:8E:20:D2:44:C2:A4:A5:7C:6D:06:20:05:38:A1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ccleaner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:52:51 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncf-cache-status: DYNAMIC\r\npriority: u=0,i\r\nlast-modified: Mon, 20 Jul 2026 23:47:20 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yQdhhnhKg02L0zXZ7vt09QQqD2E7q10StjctmvAJYN3f3psZBV1l05IvmRqQ0zBHpLFZrI57Gf38Ayz0kfDZ0%2F6r%2B2ZxSFdWN8%2FdygbQo5hL8q%2Fs3HyD6b2VnQW8MeA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncontent-encoding: zstd\r\ncf-ray: a1f5acc0f93e712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14051,"size_decoded":4867,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"b72fda7d790371689a0e2e9f42b21d14","sha1":"5f0432929e5df8aab4c6d94f3a6b508a07a84b6d","sha256":"39b5c2ee89740d3d57b572367a8e07a587b6f30bea2c21ec8983b1def66403b4","sha512":"aae0826ed80ad0fe61393a56b256e04c2d75e6bcd8f3914f9a1c79e1bc95cbc230082b3dd10d7ffc70aa49384d17a29ffec1ffb2171554ba077cb02f271ebf81","ssdeep":"192:9A6I6S3F8x8zKlZVVhHkFyc3JmCd38oNyTw1ymkwXjPQRBN:xKJJMoNyTgymkwXWBN","tlshash":"7e526264c1a604272177c9956fa2578afe9181438b0792583ffc53939ff2d25da23ecc","first_seen":"2026-07-22T21:53:21.564222Z","last_seen":"2026-07-22T21:54:14.505541Z","times_seen":2,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":66,"connect":17,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"ccleaner.lol/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"ccleaner.lol/icon/icon.jpg","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:51.972Z","timestamp":1784757171972,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 22:52:04 GMT","end":"Sun, 18 Oct 2026 23:48:06 GMT"},"fingerprint":{"sha1":"E2:5A:A2:70:87:23:CE:4D:54:EC:75:44:EE:74:FC:0B:0F:94:D6:41","sha256":"16:D2:62:8D:7B:FF:44:B0:10:57:A9:B6:CF:B0:CB:EC:6C:D8:8E:20:D2:44:C2:A4:A5:7C:6D:06:20:05:38:A1"}}},"request":{"raw":"GET /icon/icon.jpg HTTP/1.1\r\nHost: ccleaner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 20 Jul 2026 23:48:16 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb3c0-6b5d\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wUly2U23zelar7MK2c9wyMWK22IrgHSilBHNAC56kqJGd%2FUm8gS91QWJma6f6ALeozNCDOjI3No%2B6DPkLtlvzRHs2%2FHicd1pN5SW9KXlsTqjdUF1I7nktlwFulPHAoI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5acc4c98c712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27485,"size_decoded":25760,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3","md5":"23f377595f810fc051de395a73750f5c","sha1":"60b2da88b8666bb5b2219b4f0da9feb1d360764b","sha256":"63771e066d02e86f109e7613dcf669c96123a274bfdc258d8f7754d48bec7788","sha512":"a04244a9744ab7adaac65b0d933bc81bcfd8c3ae9a2ede5fdaa7ce66e4661ee6653410da43eb501a0ec5678d6f7c22212ea4d5a433a847530cb3b978798d2cdf","ssdeep":"768:3J2UjRb24op3eAJvoeYlgTLCWAcrednhzxcNHJ85:3J3A1JAaP/McNHJ85","tlshash":"4ec2cf934a45c96e8c6e02b5fe0319cc7f6b4729cd646bef23337ec962d89a7005990c","first_seen":"2026-07-22T21:53:21.566756Z","last_seen":"2026-07-22T21:54:14.498597Z","times_seen":2,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.lol/image/1.jpg?v=2","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:51.973Z","timestamp":1784757171973,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 22:52:04 GMT","end":"Sun, 18 Oct 2026 23:48:06 GMT"},"fingerprint":{"sha1":"E2:5A:A2:70:87:23:CE:4D:54:EC:75:44:EE:74:FC:0B:0F:94:D6:41","sha256":"16:D2:62:8D:7B:FF:44:B0:10:57:A9:B6:CF:B0:CB:EC:6C:D8:8E:20:D2:44:C2:A4:A5:7C:6D:06:20:05:38:A1"}}},"request":{"raw":"GET /image/1.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 20 Jul 2026 23:48:31 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb3cf-69df\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=64Vp3exe5E1gC%2BH0jd%2BOjfoXy0QcNScsYSgaNj8rPnQ4rUU6mLdvX1be0VowyVdrQvo%2FcxAGMGtyByAoGWWtuejFdfIUZIPH47Z22eAU3YKVbtZIQzeahvoPlE05bng%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5acc4c98d712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27103,"size_decoded":27416,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 235x759, components 3","md5":"7efc1755c747778a1f53de2e61b2ee3a","sha1":"1fa486337f9175a4f71542fb9cec7289aac367b3","sha256":"565ae014fb86548def3c60d754b4d82fd855b6287b0817483424d33a77f16fe8","sha512":"e39c59770eb9041e10692e85ce03fea35d17a3a23a832169e3576f04cd7fdb82f8c8bb4baadcf75189964e89fd2c816c8b7c8e350ad27b04b347f89a5437cf6a","ssdeep":"384:AItyxsMPrwvobbhn58rTbKPRf65kigMFSObhZRzYsh37cCWe03JJDp2Vz:VyhDwgbbh58rkkfgMFxbhREN3vpYz","tlshash":"84c2d1e2f7a3e936e815163202c15914f7e6ba292093f4ff74557f7d933a2e108609d2","first_seen":"2026-07-22T21:53:21.572026Z","last_seen":"2026-07-22T21:54:14.50144Z","times_seen":2,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.lol/image/2.jpg?v=2","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:51.974Z","timestamp":1784757171974,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 22:52:04 GMT","end":"Sun, 18 Oct 2026 23:48:06 GMT"},"fingerprint":{"sha1":"E2:5A:A2:70:87:23:CE:4D:54:EC:75:44:EE:74:FC:0B:0F:94:D6:41","sha256":"16:D2:62:8D:7B:FF:44:B0:10:57:A9:B6:CF:B0:CB:EC:6C:D8:8E:20:D2:44:C2:A4:A5:7C:6D:06:20:05:38:A1"}}},"request":{"raw":"GET /image/2.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 20 Jul 2026 23:48:31 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb3cf-7487\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Oh8EMMBPxmtrKSULXfieNsZCsUJghQnnmZIe9mvV%2B8y2m1J78XTX6t5yXj%2FWeUZqN3Ot6CaD%2FXZe3L%2F4lXj3byN4gDgyDsVqSEhWbcVmaruN8nZxm6hAxhG4p%2B6LQPs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5acc4c98e712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29831,"size_decoded":30162,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 228x755, components 3","md5":"06fca469614846b8e1ba3eb13f4fc8c0","sha1":"91e5b241e3a688d82403bce23bdbca7344267465","sha256":"2b474b6b630ce95057f28a668613130dc2efa54a3382208046dd2b58ece96641","sha512":"ca8e9cb21adb7aefa77d8f931190d68e3cfc78c85c4e0859d9af5df0a8c6a18ca6eb62b902a48a0a37b217740e2c21980c1156bc8f3179bc2846a8c7ec7656de","ssdeep":"384:AIIDfFWumU43QEGiZ8nE9lUCgeRCxz3/pccI1tWZJhbe9EyaPQy73Vt1GkNAwvvH:6OUqQhEUC/6vcmZ7beey/6tIwvvznz","tlshash":"1dd2e0665e1d1e4ff0a1317de0e28824deab7106f21f467f4eb191024758aadaee3141","first_seen":"2026-07-22T21:53:21.578051Z","last_seen":"2026-07-22T21:54:14.490547Z","times_seen":2,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.lol/image/3.jpg?v=2","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:51.975Z","timestamp":1784757171975,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 22:52:04 GMT","end":"Sun, 18 Oct 2026 23:48:06 GMT"},"fingerprint":{"sha1":"E2:5A:A2:70:87:23:CE:4D:54:EC:75:44:EE:74:FC:0B:0F:94:D6:41","sha256":"16:D2:62:8D:7B:FF:44:B0:10:57:A9:B6:CF:B0:CB:EC:6C:D8:8E:20:D2:44:C2:A4:A5:7C:6D:06:20:05:38:A1"}}},"request":{"raw":"GET /image/3.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 20 Jul 2026 23:48:31 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb3cf-85bf\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z0lNywMI7M%2FnnjGjAHpLCEBRhi3qlA85JT2oDZkJeYpvmYyNooKWeYkJLgTURKg9PRK4rcW8JVsZQ4x1vbtGkEuAUlTegM5Yf27tEi4X6U31hrt10iYuhOf1Y3izuDE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5acc4d98f712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34239,"size_decoded":34365,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 235x757, components 3","md5":"f6c044c1ff9e1cc7d91a96ed004c476a","sha1":"d465bde04450f5a6da9e8a1a268c453da317067b","sha256":"0e2f947f47ccab11ea8c39d58aaeb315b078cd668f9670c5d51667761acb0099","sha512":"22622b39eb75211c2d322279f239c2c489d99be91cbda9cf2c72155d387bed3068a3f3faaf9c17015284ee912c1aa83a0a68a9726c7a0cf4147c102b90a4f519","ssdeep":"768:GQA5RBOgjZbZwQdXorgo/NWJsNh9UYRwi38bVgnNxx:uzOgFNN4rgPcjUaMbsNxx","tlshash":"dcf2e13641805b47eda46c3d13cc873fe716b9230dd01b36db4e96769fe720856caa88","first_seen":"2026-07-22T21:53:21.587432Z","last_seen":"2026-07-22T21:54:14.492608Z","times_seen":2,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccleaner.lol/image/4.jpg?v=2","fqdn":"ccleaner.lol","domain":"ccleaner.lol","tld":"lol"},"ip":{"addr":"104.21.34.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccleaner.lol/","date":"2026-07-22T21:52:51.976Z","timestamp":1784757171976,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ccleaner.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 22:52:04 GMT","end":"Sun, 18 Oct 2026 23:48:06 GMT"},"fingerprint":{"sha1":"E2:5A:A2:70:87:23:CE:4D:54:EC:75:44:EE:74:FC:0B:0F:94:D6:41","sha256":"16:D2:62:8D:7B:FF:44:B0:10:57:A9:B6:CF:B0:CB:EC:6C:D8:8E:20:D2:44:C2:A4:A5:7C:6D:06:20:05:38:A1"}}},"request":{"raw":"GET /image/4.jpg?v=2 HTTP/1.1\r\nHost: ccleaner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ccleaner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 21:52:52 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 20 Jul 2026 23:48:31 GMT\r\nvary: accept-encoding\r\npriority: u=4,i\r\netag: W/\"6a5eb3cf-74a8\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=642pQMHt2SiaB83B31wedltAFTfhsAkh7g0g2MSEeLn9q2P7X55%2Bduz%2FGbiI%2BpeQsKfNaoKF5%2FuXufWFEvCN7fje9pX1GpVBw9dc2DlHi%2BPTgxGH3mXSljuQzWo2ukc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f5acc4d990712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29864,"size_decoded":30213,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 237x756, components 3","md5":"e8badb33b64188f1c594949365cec8bd","sha1":"0b4bcfa278bdef563fa30f4c0b8e016a775a3d7d","sha256":"dff9896b15c42344a42e86579f8209011435f50297d1adbe988aaf8ec86d1f92","sha512":"a27323a77d9ab446ef667bea870d072d120040abc22225dee4bd2755b2a82964eb0d63c0fc3172f4eada3bd04131e3e82d6b0aa77ca997d32a35ee25568e1484","ssdeep":"768:/x5LaLajRp9PwutKHPd+pdabT9FZW4RmPW9+eV2epNJYS:5sLajRg1PL9FZ3R9+eVxpNmS","tlshash":"a1d2f101db163602ce1b06b815e82e86f52dfa96b7304331afcb5ad65f4c6c52b5a1fc","first_seen":"2026-07-22T21:53:21.591421Z","last_seen":"2026-07-22T21:54:14.503232Z","times_seen":2,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ccleaner.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}