{"report_id":"87003c99-a196-40d1-aa8d-b65b7a005633","version":0,"status":"done","tags":[],"date":"2026-09-08T06:03:56Z","url":{"schema":"https","addr":"royalsea7.com/","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"royalsea7.com/","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"title":"RoyalSea Casino: Bonus up to €2,500 + 200 Spins","dom":{"size":41238,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (6541)","md5":"6ea3e2a2e3a016f53df803a32e40fd2f","sha1":"ffe4098c86a7269d56a5f3370706a49d01d87b75","sha256":"e493568c7a2b4889f28eae4047c51a4f3134327bfd3364235c044cb7dd2c5565","sha512":"f799804491c0690c7faf9c44ae9ec2b3c553e7211e2f6c3154115a8292836b001cd7ad153f05aab95b05fe7a951251dae8a55684df5ee8e166bed0b24f52fcfe","ssdeep":"768:rPy5X6tQjBlOH7xTfoqoHXroxXhOiRQibdMdA7QDvmGI:jIdsr9oH7WhOiRlHMCGI","tlshash":"8b03f823c1f0227202a3c2c137653fdabf91c017d6651944351f4ade8feada996336ab","dom_hash":"domhash33e209f5b5b20d19de0f888dbe368432","first_seen":"2026-09-08T06:03:14.338431Z","last_seen":"2026-09-08T06:03:57.45694Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"royalsea7.com/","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-13T06:03:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"royalsea7.com","ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-07-25","domain_rank":0,"first_seen":"2026-09-08T06:03:11.837534Z","last_seen":"2026-09-08T06:03:11.837534Z","alert_count":48,"request_count":16,"received_data":725719,"sent_data":8266,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"royalsea7.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-08T23:45:48.124032Z","times_seen":432133,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5125578d2168a363e76b627e53b48ca5","sha1":"828773e6f234d4f1e982fb50446c72f649e9fdb7","sha256":"cdfbf78862bdf9dda08ae338de0f9ab7e555075b9f9c3b8ee9f14d6212a48d9f","sha512":"9fddb3c1f055d0c93202d71d666cba1afaa9eca5ff06bf6190c53abee13a6516a500587d845cc8265933e8869c7e6ed576bec0a4672114ebc99e7ac6a7e431b8","ssdeep":"","tlshash":"e8f09ee6f6d293f823f73721660fdb50753a09d2d48da518d4238c653d7c6185431e36","size":512,"data":"","first_seen":"2026-09-08T06:03:14.367786Z","last_seen":"2026-09-08T06:03:57.489543Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"royalsea7.com/wp-content/themes/singlebrand/style.css?ver=0.1.0","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.146Z","timestamp":1788847407146,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/themes/singlebrand/style.css?ver=0.1.0 HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5U8r6JwLkdefqrTQol3j44JQC7UP4od7%2BJqJa%2B%2FwB8ukdJm6jGg37P%2FmOUdcDlQrHwNHz7tiFlPgQRHVDxYvHFDdL4DhZfAMxClzd8oAXMWzLswPWtGhnWLEqXKqp%2FXZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"7bb65c76092a6591a1465e6a6ed073b7\"\r\ncontent-encoding: br\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\ncf-ray: a37bc006a89656aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1161,"size_decoded":1494,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"a93e445afb25308a406047612c02dd8b","sha1":"14246babb8c4436eb5e2362c01022c0dc645cdc1","sha256":"1922d3597f9f53373f0840a44a27594c3d19ec091b20be5378c6abe9104d7a52","sha512":"319608656f6705a281ef4649d7b98db4c5b1d301e2e50dfc5282630f2cd259182a2d0db8c06f6dcb118ad9ee788063a362bddd477198b7a7a4224be130f7b665","ssdeep":"","tlshash":"e0214413634625446762575c56ee573ce9241300eb4e5afee07b033de3718540165679","first_seen":"2026-09-08T06:03:14.35073Z","last_seen":"2026-09-08T06:03:57.458701Z","times_seen":2,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/1szka9u-src.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.150Z","timestamp":1788847407150,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/1szka9u-src.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FiEs0ekk1Wdr2u0waAOhVazDHc7AsHU%2FyYiiyuCqp7Nl9Wda14AmEe2lhYQ0ldSbwnLsxIRKhxkfSy3ZF3AY63WE47M%2B8D4OUo3DyURQMj%2BzewX2rPxnRijRnm9qc%2B2b\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"a6c79c9861b1acc53b9fa9cdb895de02\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=3,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc006b89956aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 75196\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":75196,"size_decoded":76004,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ffe15feeac5400ce806d348d4f091824","sha1":"9d27add17b8ca528168b24efd32f888f94de00a6","sha256":"080b34426c93068565d3ead4a60f908bf19654c33cf5705f1594bfc20cc894a8","sha512":"ec4b8c01ce3e717cdc9cf08b36f2bf332bd2e76ec6d93056d446a34f8b82ae7a2ba22e784662fd5cfd7e65d712f3ee76a75d9dfe3da356b9bfbb4f31bffd661b","ssdeep":"1536:FD6feBMmgpWMiIMXIaH3hpTIf9MLO4zpWrKH87CLM+f8EmR66x:FxBhggVv0f8ZlzlLps6W","tlshash":"f87302634d4623e70f9f9eee8731e5d9c691f7e48324d10896b40263257eeb1a0c7589","first_seen":"2026-09-08T06:03:14.344758Z","last_seen":"2026-09-08T06:03:57.460052Z","times_seen":2,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/1lfh70l-src.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.163Z","timestamp":1788847407163,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/1lfh70l-src.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GnNGFiZfgZxp4kS%2BukF3K17M0KZmlJmVkkV%2BvJECUc7LjSyAbZf0GbyMagmr7%2FJl92SeJdPOckaoB3QaKIGF59FUVCBeX9hTux3qC3vBbXVsQt15IGXW5kYlzOKSlBpR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"51dfe0177ffd561ae649c2ed437e3e1b\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc006c89e56aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 67168\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67168,"size_decoded":67972,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"76878f71056b05371f6450375e595cab","sha1":"52b0dd5053b907de79a4a722566599ed9760383a","sha256":"15c3058b1f98643b742098dd81bb520d94ad2bd665034d08ea9923444cb9c23a","sha512":"bda1504d5071f34ebc0177306581f79791f922bbdd1936824f96035d6f34e8dc9a9beac458b21db175ca13038ac0cdcd186cb8f3ecd9cdbd492f41bf4eaa9f74","ssdeep":"1536:FnyHuhxIUwgSdfiZPUkefV17ImMqyt4OYd:FnyWJvSdfiMfV17IfWOYd","tlshash":"1b6302863e99bdeb0e864150345eb5cf51d8bd93b8a1bf9813b003eb3f7a265a304456","first_seen":"2026-09-08T06:03:14.347325Z","last_seen":"2026-09-08T06:03:57.460682Z","times_seen":2,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/g5k60n-src.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.315Z","timestamp":1788847407315,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/g5k60n-src.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SrhVN3z%2BSC9pEtul5iKzzQiuwdCIOq7q%2B1T3v2N8nFKV%2FJRkJZPM6Y4g%2FbbUwH0Gocs%2BXV7OVqE1BXtfUCNgG%2FiCBCUGQQtZsbmIG%2Fpout6E4fTVg0v0rdtEKaVMQ6qK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"41a1c1bda909c5cbf2ef8df94296cbd7\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc007b8a456aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 86370\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86370,"size_decoded":87182,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"34f20f7a1e1a63541fbc62dd6daebd63","sha1":"59869727748bc0d26515d22aa8afece258a86e25","sha256":"11c5f593069a4afb1ad2e2a54534dd97705fefa5dfbbdb6db43e4284a61e99f7","sha512":"04e7f3733c266d9e90873f09500dcf83a9dad4f092244177e00c8735f3c8aa626ee9c0ba0c6ef00aa81c5f1177180ee4e729c8e328d8f87bd12076d518a662b9","ssdeep":"1536:766selRsV3/3Wf9/OaNmAVg6OO0T2fbc4zcG9iIdoBrgReN7CBlnVrGQiWKOpAh7:7FsefU/s9/OaNmAVgPT+c44GoCoBJNOm","tlshash":"348302aa3d6fd1ecd05436d361e6a7b23e56de1d244d60cae02680fbe901b2cf469507","first_seen":"2026-09-08T06:03:14.340875Z","last_seen":"2026-09-08T06:03:57.461372Z","times_seen":2,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/o1il2y-src.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.317Z","timestamp":1788847407317,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/o1il2y-src.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6n08vaXSms7adQBvV6lTGNetS2mXHa0Dw%2Bm%2BYwl9CZJSG3SIhQHTGVR1gRYIsu18ehuZNlbPLOICB6VfMYMn4IaaHFg6aBApksEGldpvhIReWj33lTXl6hx%2FvRPKpbNl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"fadd930b8acc45f996a451a82048c5eb\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc007b8a556aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 65280\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65280,"size_decoded":66084,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7f17f4b0e151b000468f04b834d7e3f5","sha1":"6952d6c4b42c96bec8332a03aeaee3fb5d6696cd","sha256":"682ffbe56cb391a1f2778c6ef8b7d73e1edaf17152362622b0d2d866005f3305","sha512":"30c74ce1d3097f989622a255c37f7533db9928aa25c8cf244c3ce368095dec02866e257e523ef4efc44b550b6adef1d90eef10af772a9ea9c2b435c7c432215c","ssdeep":"1536:s848IbNBeDJRT2NQymVDE/npOuVzQLNjmGNiSQIoQkmdulSRiH9Wd2:RWeFp2NQym1cpOaQsG3QI9kdkg","tlshash":"3e5302260c65135d99b00ebf4ef2db16fec6718add6a8c098b1841731c97a05f99ec2b","first_seen":"2026-09-08T06:03:14.365525Z","last_seen":"2026-09-08T06:03:57.461937Z","times_seen":2,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/style-a1450fcb422d.css?ver=a1450fcb422d","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.147Z","timestamp":1788847407147,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/style-a1450fcb422d.css?ver=a1450fcb422d HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Iu6zloNaNINKuvES7etZqP3zZflDgBaXSd3jlKpos648YwV3z%2BVNWescQCNgiWu1ePChsWtCAIDK%2B4l1QXkxoMBPsnA51U4HWCkpQWPdrcUz%2BhRNX09Wfmw1Xfc3JOPU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"f1ee1ffb479edc7b0fff683572981862\"\r\ncontent-encoding: br\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\ncf-ray: a37bc006a89756aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24827,"size_decoded":9288,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (573)","md5":"5520891b6b56a3a96d706decef1361f1","sha1":"ed6cf3fdf56b618a840931df8c9697fe7460a95e","sha256":"85ccad728c296b281fb6c0c2f53d2dc6f80f454fe9f5afb8effc2a023e5badcc","sha512":"788ddf46c18cd7f368a1728e56180b2e10b8d38718e85ff01319a6e58941b85c086efd9e1f5e29eb79e6a2edd8549aefa1fc49bde45c442a5b1b2e25c3a92754","ssdeep":"384:sowmYtojoXnebUX6kPZjY9c69fO3WPv16XIwInTUVrfF8ym5QWW:P9joXrXVjY93PW9r","tlshash":"75b2a5727700733cbc23d5166b8d669d6214f025da6b45e4f84ad3286acf6f20ab1bdc","first_seen":"2026-09-08T06:03:14.360099Z","last_seen":"2026-09-08T06:03:57.466599Z","times_seen":2,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/8fgll6-src.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.164Z","timestamp":1788847407164,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/8fgll6-src.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q0EsO8Idjqvm%2FpVt7%2F8E3sKDtJd9VgAiEJj8Y3TkM3MwzKqf9sgmrdvmNMNnsXgC8yMg5YyISig2njTo97YxZ%2B%2BvMnnVUehhmjIcSGnpyXWragCAi%2BT8hiCxGfc4ua52\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"b08eaa1010bdb2c5d31c95928c9d14b5\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc006c89f56aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 43808\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43808,"size_decoded":44616,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"32699637c4afc5645c1f4df9cd2963c2","sha1":"017064364b9bbebe917b27a286aac747684e7c31","sha256":"a99020572e172cc893b0721b52f17fe7bc8a0444b457cfeca05e10425afe3cfc","sha512":"81bab6384923c822f1f2a0d224de90a2c4f1a982d9a1933225a08b178c975ce8a685b46eb7d7e1d34dc3f5e3d8e93ac0c31205efd2f840b6484ecce4554b2e6f","ssdeep":"768:e5iQocUJUXx7WxajV8aaXxhzzLRLvWzDo9aM5qVo4Ntx8zFXcC:NqUKxypHzN8DnZVoSCzFf","tlshash":"ec13024ef2045271c9d2845f1f5e21bc8f3f1cb183a997c5ca30fb42a915be91536897","first_seen":"2026-09-08T06:03:14.352429Z","last_seen":"2026-09-08T06:03:57.470644Z","times_seen":2,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/oha6mx-src.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.318Z","timestamp":1788847407318,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/oha6mx-src.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3xm2cIKOdoovQqe27EomN1045Vt4R8PW2tTyX72bPC0k6e3Y6KBv9q0CvDVXYitUjz04oc%2FDCaxi7ZOZb%2F4DnkptByyqYVV%2B8M3grnoJ9qujsYkAQ1YvF1BWtevqUaLb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"08da82710df225e40dd45f796b0a5162\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc007b8a656aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 61004\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":61004,"size_decoded":61808,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3b1bdc5236387671be3379cb502e0563","sha1":"9c9d9e843589f703707f6707408335317b3822a1","sha256":"0d939415ba6dcdc4f5e825404352e80bffd5b087e2225063bbe33c5566d23adc","sha512":"216f03a35dcd63e861b71863af69baf558bd91ab66b272898f9fec35d82f3a90ceb4db838a9d6b74cf37efd1609b9f0635ab5cb24fce8375e7bf30c587f6b6d6","ssdeep":"1536:6qzYSv60JAgSaP93Eq4Tc1loTUjVNCvjZ15o1+:tzxv1JAgSaPREqz+CV8vyw","tlshash":"1f53014151e8757b0efb04bf2a91383cb27d696e351b18f8fbeff14326451969a0085e","first_seen":"2026-09-08T06:03:14.354527Z","last_seen":"2026-09-08T06:03:57.476146Z","times_seen":2,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/1g7kqea-32.png","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.408Z","timestamp":1788847407408,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/1g7kqea-32.png HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4yE6eStTk%2B7Y3fzONw26bb2lOb07qQu3pMSxfRqwneiQ0Zv87y%2Fc3%2B0%2BnO%2B3xUC%2BHmDiA9t9ZYpMV2XvmYabrN5tXUtnR%2FLeDzkiI05nnUUW%2FZWZdhQyVSbroWC1B6Yx\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"841facbe23e1abc65940682e82fe16d7\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc00848ac56aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1094\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1094,"size_decoded":1909,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"ab9e03d080eca6625e1d4694ac29c72d","sha1":"6ad96dde4a2b347b74736afdbf40242ede66dea4","sha256":"e366628f8bc7cc6407dbbe3a8157ec324b0ee328182594dee0659bff3ac15832","sha512":"6a17aeae9c4373ba986ecf3be198f3462349615805b501c30a044db6d383fc915463e7f1a4cd3338ce6e04354fe4a71354a67e9671dbc1eef5da8fb9b932fb01","ssdeep":"","tlshash":"aa1182f5d5caee68ba6d093034f3b9b2d8701089413e5294a827c6c2693908f65e49e7","first_seen":"2026-09-08T06:03:14.349117Z","last_seen":"2026-09-08T06:03:57.48143Z","times_seen":2,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-08T06:03:26.784Z","timestamp":1788847406784,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Fcu5o7oikEJYS02MW%2BMbyAmW1N3cOr0FFrhFCWcp5zKGkMlDcsOJKTcSdGT0tQJVWXbwFWe8D%2Bak4cXmKQTo56SKJM%2F4YyfcqZrMPnRz1NiALjeVALjWAwu5DmDICzbR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/html; charset=utf-8\r\ncontent-encoding: br\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nvary: accept-encoding\r\npriority: u=0,i\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ndate: Tue, 08 Sep 2026 06:03:26 GMT\r\ncf-ray: a37bc004988256aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42001,"size_decoded":11725,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (6541)","md5":"1e691e48e07a8b89a2629afa6979d4c9","sha1":"5348534d901664ca5aef7c297ffd15e3afc96d05","sha256":"37c087c2721a7070f924a9f8cd141db27be25efade60034fc8a8e60e3e0875c1","sha512":"5637fb2ae2ac7fee320b8a93f76139588991a0827badb85c233442661bf7d6a6ac753a0444b835a01f25ec17d20e974d8ed63f370340596e9c24545a39aa2adc","ssdeep":"768:twV5X6tQjBlOH7xTfsqoQgwroxXh+QRQibZMrkfnhmmaL:abdsrBoBkWh+QRlbfRaL","tlshash":"9c13f863c1f0227302a3c2c237653bdabbd0d017d6651940351f4ade9feada9963369b","first_seen":"2026-09-08T06:03:57.4838Z","last_seen":"2026-09-08T06:03:57.4838Z","times_seen":1,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":6,"connect":19,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/1w79ypn-src.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.160Z","timestamp":1788847407160,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/1w79ypn-src.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L6BVhIH5bTlymbi5SAaaTgHnUDmJKnxB%2FVlkuicIrernD72xK97obzJ8sdhGaUn1ftUlKhebcLHBs7c2M5DBgRvJYOHs%2F5TDC8F8cfCUqVYIbt3SNWGvlx4VHvpF%2F%2BWX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"658285d14dc53e25bf5c62806e959d1b\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc006c89c56aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 67596\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67596,"size_decoded":68402,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ca673cd8fbb0d5b7c305c04942f21b14","sha1":"e7f35a0d4aa37829f26d32f9dd3e42542d217830","sha256":"786e23bb07bf1272115947449f3cb7c0dc0fdef04c53eedaa570bcc83b90c944","sha512":"b8e24abb68cd60dcbd92717ccb7445626095ecc72e50b71a015bb54b9fb8941ea34834a06e65b14842821be2461027966a152bf66fe2e9983cde4c4a1aed872d","ssdeep":"1536:vFSW186dqxB1lvZJvcumlPm8jnsWF1Z2FIJWYrH2:911yxB1lBFie8jFw0jq","tlshash":"fb63021ba4f00227ed89519e1516bec6eff2f85c7333271585334444d1b9da8abe2c6b","first_seen":"2026-09-08T06:03:14.361677Z","last_seen":"2026-09-08T06:03:57.485315Z","times_seen":2,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/m7x99e-src.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.319Z","timestamp":1788847407319,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/m7x99e-src.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HYyYFz8Zn0PfBgdHEfMA7jgsrioIy9syylWcbvIGngsN9RCKFWZWdqEdElZDqgqTFRwAgpWZOQw3FL4l5gx%2FqoL0lbEyYhFyAjme3jNpGcPas4F3sa%2FnLP79EBmtRAhr\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f89e58a33341a264b7034750e76c8739\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc007c8a756aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 99872\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":99872,"size_decoded":100674,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c17c0120ddda801a5334a1c780c33522","sha1":"0027568c82b687f8d06419b75cc7ee642eac2433","sha256":"bc8c419f2c92e1654103bac2e64422632b10080d10ea17c07fb875d8cefc5295","sha512":"b7cec1e7ff7766d02fcd54d7e8f1b08875f8d043c72147c4f04d7780cd2d34d1f28074dc8e8989e10dca4450974913b32c558bc20abee18bb4825474cd8170db","ssdeep":"3072:GFL5i8hHNybLDzomEg5PD/5ceV1JWegaFqrorP+Qy:G3Zhgh9/5ceV1v1FqrorP+v","tlshash":"18a312964c2d4c2df04576d458e97485cf8263cb7ec2af6e1050468eba503eaefad82c","first_seen":"2026-09-08T06:03:14.356489Z","last_seen":"2026-09-08T06:03:57.486005Z","times_seen":2,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":40,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/1sgv97p-400.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.149Z","timestamp":1788847407149,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/1sgv97p-400.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YKP5Y3QzUup%2BGpv8r9BvfSXUXuuPpcsApseb7Se9pkQo%2ByFLXbbsBED9uxPvow6qn7ZoqmWAo5bPUOhDd4ynOAYOO5%2ByczNXWPrTAXoTzlZZiJHx0kfGW%2FteL7UiBGjn\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"d71417cbfd7d04977c9eee4e8fb71f56\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=3,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc006a89856aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11882\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11882,"size_decoded":12688,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"157d8b1aa0adacdd1f26d65b4ed268e8","sha1":"1305121a9a97ff4423a7b6630b55a85f52b71986","sha256":"f33697293776d117100a386536b37f2c80cfb7b9a27eaa9056f1ff84bbab89ea","sha512":"51863a3b3c76ba933c76e84672f5a5b553553c33e3be26e12a12b6b7f9610507e72bbeb75dc0cf985b9b453f5b007b62ec850cddac413a32540fbdcf3910b6c8","ssdeep":"192:qfT6+y7Ev3jS1+ycJEzaFJsJX5nwWtGS89Na45gM5gEwqaTEsDFTHXvQGa4QpEpU:qfT6572zSIzEaJyyC4Nxg4g3EsFrvQGi","tlshash":"da32c064884b363bc4479e1cc43fb012bb318aa5f1575d7fd1222799dee8b086e3511c","first_seen":"2026-09-08T06:03:14.343046Z","last_seen":"2026-09-08T06:03:57.486946Z","times_seen":2,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.156Z","timestamp":1788847407156,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Thu, 10 Sep 2026 06:03:27 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SJ5Ejzz2INMtvP8FSnixfgZf2BOti6pwQ0JRxvJfKF0%2Fktmf%2FutfsaM3vyzQDOjb1%2FIav9aUBRUc5Hlu1%2B%2ByKA7dnrGcY8VzwesUOeixnFGtWmlV%2B7DDpTb8ztClxFeN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\nserver: cloudflare\r\ncf-ray: a37bc006b89a56aa-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1238,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-08T23:45:48.124032Z","times_seen":432133,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/1263164-src.webp","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.162Z","timestamp":1788847407162,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/1263164-src.webp HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J4LD4%2BsqzsCGqqGRIDxsTqh5Cs%2FjCkHVU%2BfKSxw5xRY9kIAhqaLzvKMPzpPsAS1phjWT2yQrIDYFJ6b4j%2FSbvjLqUyOdQ%2FIX42LSeOqtu36sjqYn83mv%2Fxjp0M24o%2B5h\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"16ccd4ab24aef5ef1f37630feee8ba77\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc006c89d56aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 63392\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":63392,"size_decoded":64204,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9b91586fc7155d328a9577e05ef4aabf","sha1":"ea9e6ffe78d6b144576efdb833c7605ac54b3ab4","sha256":"f83349a817dc548a67b84b58e1b8f2d294d66a873599ed9b2ef47e4484fa038d","sha512":"7df35a7086dee23633d28f3264d039a391786504f11485170b17e00af560fe9e7ce315522562f92271f89e759fd5791606a075ab2ba9b6e42e9f97ac4ea5d046","ssdeep":"1536:6El29exQzD4uqDzhdmQOzh7s5VkMhs1WUnxCGb:4e4rh7sn/s17b","tlshash":"8053028bdd4a8ccbd35c146992b0f14cd8321585ebc61cd4316e2a81be5f6cc7ab07ae","first_seen":"2026-09-08T06:03:14.363569Z","last_seen":"2026-09-08T06:03:57.488674Z","times_seen":2,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"royalsea7.com/wp-content/uploads/1g7kqea-180.png","fqdn":"royalsea7.com","domain":"royalsea7.com","tld":"com"},"ip":{"addr":"104.21.95.13","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://royalsea7.com/","date":"2026-09-08T06:03:27.407Z","timestamp":1788847407407,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"royalsea7.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 24 Jul 2026 05:47:32 GMT","end":"Thu, 22 Oct 2026 06:47:23 GMT"},"fingerprint":{"sha1":"F4:CB:72:8A:BD:D7:7D:15:63:BA:45:47:38:64:A6:E6:5E:A5:11:66","sha256":"68:CB:41:87:30:37:06:3F:83:62:F4:56:B3:EF:2E:30:8A:7A:D0:D5:83:20:0B:F9:EC:E3:03:63:BC:FB:16:1C"}}},"request":{"raw":"GET /wp-content/uploads/1g7kqea-180.png HTTP/1.1\r\nHost: royalsea7.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://royalsea7.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xl9d9eqTp1cgLUP96r%2FYoUMu%2FgmS%2FzMGr0Pvbeolm2jsNpWG5hiCdJge79wwBcqTipQWXbbpH1Q4n7jEC%2Bvlr22QfkWxMncvza%2FSlriAxYe1UNKfshgUwfJeXGAQohAj\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"841facbe23e1abc65940682e82fe16d7\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Tue, 08 Sep 2026 06:03:27 GMT\r\naccept-ranges: bytes\r\ncf-ray: a37bc00848ab56aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1094\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1094,"size_decoded":1903,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"ab9e03d080eca6625e1d4694ac29c72d","sha1":"6ad96dde4a2b347b74736afdbf40242ede66dea4","sha256":"e366628f8bc7cc6407dbbe3a8157ec324b0ee328182594dee0659bff3ac15832","sha512":"6a17aeae9c4373ba986ecf3be198f3462349615805b501c30a044db6d383fc915463e7f1a4cd3338ce6e04354fe4a71354a67e9671dbc1eef5da8fb9b932fb01","ssdeep":"","tlshash":"aa1182f5d5caee68ba6d093034f3b9b2d8701089413e5294a827c6c2693908f65e49e7","first_seen":"2026-09-08T06:03:14.349117Z","last_seen":"2026-09-08T06:03:57.48143Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"royalsea7.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"royalsea7.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}