{"report_id":"8757ee07-27f4-436c-b2a5-fbe159d5284e","version":0,"status":"done","tags":[],"date":"2026-09-11T10:07:52Z","url":{"schema":"http","addr":"stashphantom.cc/","fqdn":"stashphantom.cc","domain":"stashphantom.cc","tld":"cc"},"ip":{"addr":"170.9.233.173","port":0,"asn":31898,"as":"Oracle Corporation","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"stashphantom.cc/","fqdn":"stashphantom.cc","domain":"stashphantom.cc","tld":"cc"},"title":"StashPhantom — Prepaid Cards Filed Like a Timetable","dom":{"size":25027,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2067)","md5":"6eafed8a00bc1133c2d17523e35df838","sha1":"6b7a4bf3fd968d6fa6c2a75923904bad31350619","sha256":"7ad0b257584b4a22c38977b8f28b9a07348680de84ae1402b1a344d5cb617238","sha512":"4b4e64b72bbe09fe0bceb404ff840cd3245f68cd52b81a6c9ea7f948a80409f3a19d9b9f18fa0bf8d03ffff74ad3ac87f24f91a8fd7ed94fc195dc4b6f0b4482","ssdeep":"384:bNT5e29iezDfG01ghRFG4K8RTCwjIn/+6MS:F4FePfG0aBYOTCwU/+2","tlshash":"fcb27333e278243f65234ac1e222733a71e7928fe50b157471bc46aa4fd6d85fc2b45a","dom_hash":"domhash27955d148fec07982dd3d919ff2b05e0","first_seen":"2026-09-11T09:41:48.076735Z","last_seen":"2026-09-11T10:07:56.570514Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"stashphantom.cc/","fqdn":"stashphantom.cc","domain":"stashphantom.cc","tld":"cc"},"ip":{"addr":"170.9.233.173","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-16T10:07:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"stashphantom.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"stashphantom.cc","ip":{"addr":"170.9.233.173","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":5,"request_count":5,"received_data":1834033,"sent_data":2389,"comment":"","tags":null,"fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-06T22:43:29.090385Z","alert_count":0,"request_count":7,"received_data":234607,"sent_data":3997,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-06T22:43:29.329928Z","alert_count":0,"request_count":1,"received_data":10544,"sent_data":575,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"stashphantom.cc/js/main.js","fqdn":"stashphantom.cc","domain":"stashphantom.cc","tld":"cc"},"ip":{"addr":"170.9.233.173","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"857c228074ae8dee2cf74e6a680f3891","sha1":"7941d4dba914ad6790806060640fc89cc2c6242a","sha256":"5d1033e6346d9707aabb39cfca68db04ba247d31db1debf891e802a91664b218","sha512":"9b0e646afa247ac47653592f7507c1daabf9df37f53f7150619688f3727eeda4ec72b9eae125afebce752a774dc353cd6c53e599c5217600b0e0379ba8f578f2","ssdeep":"","tlshash":"b4418656b1ba053a0a738237a3df57fd3631100b6180c90d3e7c85481fc1b6959f2dda","size":2346,"data":"","first_seen":"2026-09-11T09:41:48.080018Z","last_seen":"2026-09-11T10:07:56.57328Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"stashphantom.cc/js/main.js","fqdn":"stashphantom.cc","domain":"stashphantom.cc","tld":"cc"},"ip":{"addr":"170.9.233.173","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.016Z","timestamp":1789121243016,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stashphantom.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 10 Sep 2026 13:59:45 GMT","end":"Wed, 09 Dec 2026 13:59:44 GMT"},"fingerprint":{"sha1":"F6:7E:7D:5B:6D:E1:C6:70:41:9B:E4:E6:45:18:21:79:C5:4C:28:32","sha256":"A9:93:D7:3F:13:AF:03:42:E0:B2:C8:FE:59:F6:87:99:78:00:44:7E:38:30:D3:70:D4:51:EE:E5:63:D3:51:3F"}}},"request":{"raw":"GET /js/main.js HTTP/1.1\r\nHost: stashphantom.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://stashphantom.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript; charset=UTF-8\r\ndate: Fri, 11 Sep 2026 10:07:23 GMT\r\netag: W/\"92a-1a08bdd0950\"\r\nlast-modified: Thu, 10 Sep 2026 15:08:34 GMT\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\ncontent-length: 970\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":2346,"size_decoded":1325,"mime_type":"application/javascript; charset=UTF-8","magic":"Unicode text, UTF-8 text","md5":"857c228074ae8dee2cf74e6a680f3891","sha1":"7941d4dba914ad6790806060640fc89cc2c6242a","sha256":"5d1033e6346d9707aabb39cfca68db04ba247d31db1debf891e802a91664b218","sha512":"9b0e646afa247ac47653592f7507c1daabf9df37f53f7150619688f3727eeda4ec72b9eae125afebce752a774dc353cd6c53e599c5217600b0e0379ba8f578f2","ssdeep":"","tlshash":"b4418656b1ba053a0a738237a3df57fd3631100b6180c90d3e7c85481fc1b6959f2dda","first_seen":"2026-09-11T09:41:48.080018Z","last_seen":"2026-09-11T10:07:56.57328Z","times_seen":2,"resource_available":true,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"stashphantom.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stashphantom.cc/images/logo.png","fqdn":"stashphantom.cc","domain":"stashphantom.cc","tld":"cc"},"ip":{"addr":"170.9.233.173","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.021Z","timestamp":1789121243021,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stashphantom.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 10 Sep 2026 13:59:45 GMT","end":"Wed, 09 Dec 2026 13:59:44 GMT"},"fingerprint":{"sha1":"F6:7E:7D:5B:6D:E1:C6:70:41:9B:E4:E6:45:18:21:79:C5:4C:28:32","sha256":"A9:93:D7:3F:13:AF:03:42:E0:B2:C8:FE:59:F6:87:99:78:00:44:7E:38:30:D3:70:D4:51:EE:E5:63:D3:51:3F"}}},"request":{"raw":"GET /images/logo.png HTTP/1.1\r\nHost: stashphantom.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://stashphantom.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Fri, 11 Sep 2026 10:07:23 GMT\r\netag: W/\"da209-1a08bdd0950\"\r\nlast-modified: Thu, 10 Sep 2026 15:08:34 GMT\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":893449,"size_decoded":881684,"mime_type":"image/png","magic":"PNG image data, 2172 x 724, 8-bit/color RGB, non-interlaced","md5":"29f0b8812a469688466433809abd0fd3","sha1":"4b9e4f48d26326a00fbde37aa5a08ae907707f85","sha256":"2d3478121e38b6bc156bd0a052e472779ebd528f0b540e63fe8797158f65cc20","sha512":"ddc7c6d09455af8f4d204f0603d673d447f9ee242da88673e424c931662e2bca8e89d7ff30de78406743627f368c7af8d6f5004043907f502970e4673730856c","ssdeep":"24576:ngmHyAq2kIF0cUu/6MopQaKYUiPm5BvjRnpXLuWbKNxd:bHyA0M0PuHoq1YUiWjRngWmF","tlshash":"40153327fa71c028e0897d3d239c411a15b53bf90df91091627fa72474a976a9e02eff","first_seen":"2026-09-11T09:41:48.082552Z","last_seen":"2026-09-11T10:07:56.575168Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"stashphantom.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.147Z","timestamp":1789121243147,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://stashphantom.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 34928\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 09 Sep 2026 10:31:58 GMT\r\nexpires: Thu, 09 Sep 2027 10:31:58 GMT\r\ncache-control: public, max-age=31536000\r\nage: 171325\r\nlast-modified: Mon, 08 Sep 2025 17:56:47 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34928,"size_decoded":35741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34928, version 1.0","md5":"cd56e2ec63d7a63df092f824f981253c","sha1":"65449f1605378d8a5661bb33558d6bc69ca77a17","sha256":"8f704806dbedeaaeca334b11ec348bc3ac3a439d6431544b3afb54f534ee4967","sha512":"d40e3b18973049d9b38b5e9c83221163e103c57cc99392d7629a29349bdfa438a2e91977a91d82f1a4bd19710a36370e1810fe98fab33cfd527162e341fb53e2","ssdeep":"768:7JuqbWaxbCU2kKMWdbqzVg9xn0krInmHUZCUIRxfScXQw3gxwHpbz:VuaHbekKMY+VwRrInm0ALD3g4z","tlshash":"70f2f1394a4d0890e24ac6d61d92373c27159e3d2a12251616a4f6afc3c9ecc76e2f7b","first_seen":"2025-05-30T01:40:34.848528Z","last_seen":"2026-09-11T15:23:32.094647Z","times_seen":9865,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":30,"send":0,"wait":22,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.148Z","timestamp":1789121243148,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://stashphantom.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 34928\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 09 Sep 2026 10:31:58 GMT\r\nexpires: Thu, 09 Sep 2027 10:31:58 GMT\r\ncache-control: public, max-age=31536000\r\nage: 171325\r\nlast-modified: Mon, 08 Sep 2025 17:56:47 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34928,"size_decoded":35741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34928, version 1.0","md5":"cd56e2ec63d7a63df092f824f981253c","sha1":"65449f1605378d8a5661bb33558d6bc69ca77a17","sha256":"8f704806dbedeaaeca334b11ec348bc3ac3a439d6431544b3afb54f534ee4967","sha512":"d40e3b18973049d9b38b5e9c83221163e103c57cc99392d7629a29349bdfa438a2e91977a91d82f1a4bd19710a36370e1810fe98fab33cfd527162e341fb53e2","ssdeep":"768:7JuqbWaxbCU2kKMWdbqzVg9xn0krInmHUZCUIRxfScXQw3gxwHpbz:VuaHbekKMY+VwRrInm0ALD3g4z","tlshash":"70f2f1394a4d0890e24ac6d61d92373c27159e3d2a12251616a4f6afc3c9ecc76e2f7b","first_seen":"2025-05-30T01:40:34.848528Z","last_seen":"2026-09-11T15:23:32.094647Z","times_seen":9865,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":30,"dns":0,"connect":0,"send":0,"wait":22,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.186Z","timestamp":1789121243186,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://stashphantom.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 34928\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 09 Sep 2026 10:31:58 GMT\r\nexpires: Thu, 09 Sep 2027 10:31:58 GMT\r\ncache-control: public, max-age=31536000\r\nage: 171325\r\nlast-modified: Mon, 08 Sep 2025 17:56:47 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34928,"size_decoded":35741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34928, version 1.0","md5":"cd56e2ec63d7a63df092f824f981253c","sha1":"65449f1605378d8a5661bb33558d6bc69ca77a17","sha256":"8f704806dbedeaaeca334b11ec348bc3ac3a439d6431544b3afb54f534ee4967","sha512":"d40e3b18973049d9b38b5e9c83221163e103c57cc99392d7629a29349bdfa438a2e91977a91d82f1a4bd19710a36370e1810fe98fab33cfd527162e341fb53e2","ssdeep":"768:7JuqbWaxbCU2kKMWdbqzVg9xn0krInmHUZCUIRxfScXQw3gxwHpbz:VuaHbekKMY+VwRrInm0ALD3g4z","tlshash":"70f2f1394a4d0890e24ac6d61d92373c27159e3d2a12251616a4f6afc3c9ecc76e2f7b","first_seen":"2025-05-30T01:40:34.848528Z","last_seen":"2026-09-11T15:23:32.094647Z","times_seen":9865,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.189Z","timestamp":1789121243189,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://stashphantom.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 34928\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 09 Sep 2026 10:31:58 GMT\r\nexpires: Thu, 09 Sep 2027 10:31:58 GMT\r\ncache-control: public, max-age=31536000\r\nage: 171325\r\nlast-modified: Mon, 08 Sep 2025 17:56:47 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34928,"size_decoded":35741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34928, version 1.0","md5":"cd56e2ec63d7a63df092f824f981253c","sha1":"65449f1605378d8a5661bb33558d6bc69ca77a17","sha256":"8f704806dbedeaaeca334b11ec348bc3ac3a439d6431544b3afb54f534ee4967","sha512":"d40e3b18973049d9b38b5e9c83221163e103c57cc99392d7629a29349bdfa438a2e91977a91d82f1a4bd19710a36370e1810fe98fab33cfd527162e341fb53e2","ssdeep":"768:7JuqbWaxbCU2kKMWdbqzVg9xn0krInmHUZCUIRxfScXQw3gxwHpbz:VuaHbekKMY+VwRrInm0ALD3g4z","tlshash":"70f2f1394a4d0890e24ac6d61d92373c27159e3d2a12251616a4f6afc3c9ecc76e2f7b","first_seen":"2025-05-30T01:40:34.848528Z","last_seen":"2026-09-11T15:23:32.094647Z","times_seen":9865,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.191Z","timestamp":1789121243191,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://stashphantom.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 34928\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 09 Sep 2026 10:31:58 GMT\r\nexpires: Thu, 09 Sep 2027 10:31:58 GMT\r\ncache-control: public, max-age=31536000\r\nage: 171325\r\nlast-modified: Mon, 08 Sep 2025 17:56:47 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34928,"size_decoded":35741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34928, version 1.0","md5":"cd56e2ec63d7a63df092f824f981253c","sha1":"65449f1605378d8a5661bb33558d6bc69ca77a17","sha256":"8f704806dbedeaaeca334b11ec348bc3ac3a439d6431544b3afb54f534ee4967","sha512":"d40e3b18973049d9b38b5e9c83221163e103c57cc99392d7629a29349bdfa438a2e91977a91d82f1a4bd19710a36370e1810fe98fab33cfd527162e341fb53e2","ssdeep":"768:7JuqbWaxbCU2kKMWdbqzVg9xn0krInmHUZCUIRxfScXQw3gxwHpbz:VuaHbekKMY+VwRrInm0ALD3g4z","tlshash":"70f2f1394a4d0890e24ac6d61d92373c27159e3d2a12251616a4f6afc3c9ecc76e2f7b","first_seen":"2025-05-30T01:40:34.848528Z","last_seen":"2026-09-11T15:23:32.094647Z","times_seen":9865,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.194Z","timestamp":1789121243194,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/archivo/v25/k3kPo8UDI-1M0wlSV9XAw6lQkqWY8Q82sLydOxI.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://stashphantom.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 34928\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 09 Sep 2026 10:31:58 GMT\r\nexpires: Thu, 09 Sep 2027 10:31:58 GMT\r\ncache-control: public, max-age=31536000\r\nage: 171325\r\nlast-modified: Mon, 08 Sep 2025 17:56:47 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34928,"size_decoded":35741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34928, version 1.0","md5":"cd56e2ec63d7a63df092f824f981253c","sha1":"65449f1605378d8a5661bb33558d6bc69ca77a17","sha256":"8f704806dbedeaaeca334b11ec348bc3ac3a439d6431544b3afb54f534ee4967","sha512":"d40e3b18973049d9b38b5e9c83221163e103c57cc99392d7629a29349bdfa438a2e91977a91d82f1a4bd19710a36370e1810fe98fab33cfd527162e341fb53e2","ssdeep":"768:7JuqbWaxbCU2kKMWdbqzVg9xn0krInmHUZCUIRxfScXQw3gxwHpbz:VuaHbekKMY+VwRrInm0ALD3g4z","tlshash":"70f2f1394a4d0890e24ac6d61d92373c27159e3d2a12251616a4f6afc3c9ecc76e2f7b","first_seen":"2025-05-30T01:40:34.848528Z","last_seen":"2026-09-11T15:23:32.094647Z","times_seen":9865,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/courierprime/v11/u-4k0q2lgwslOqpF_6gQ8kELY7pMT-Dfqw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.197Z","timestamp":1789121243197,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/courierprime/v11/u-4k0q2lgwslOqpF_6gQ8kELY7pMT-Dfqw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://stashphantom.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 19348\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 05 Sep 2026 03:33:40 GMT\r\nexpires: Sun, 05 Sep 2027 03:33:40 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 10 Sep 2025 16:48:04 GMT\r\ncontent-type: font/woff2\r\nage: 542023\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":19348,"size_decoded":20161,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19348, version 1.0","md5":"3313e74393da3f4d9b0c6667cae65f97","sha1":"ce1bcc36aee6c6a73936796ac0772a830b7085c0","sha256":"5c7ae1cc9aae183453565c836b74a1b988f5f2e52b65098decb909b3930957ec","sha512":"c1a03c9510feacd6a7e3da8c34364a63ae38051d020ff68fb18a89b4552995a6379a8b1272a38f93064c4f282421349d127d6fa552aa21cd64fe88d2f2a911de","ssdeep":"384:wqwyycmU5TRLpFqlrV/NjdDhfWU9SXx/WBUnSz/He525SB6U:wdZILpclPdDOXlWBUSM25CL","tlshash":"2f92e1d2ec7e7d5b258491fba2c72789ac33442732eacf38b5d1790068b674a14b8425","first_seen":"2025-06-09T00:57:14.795547Z","last_seen":"2026-09-11T10:07:56.577667Z","times_seen":553,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stashphantom.cc/images/logo.png","fqdn":"stashphantom.cc","domain":"stashphantom.cc","tld":"cc"},"ip":{"addr":"170.9.233.173","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.368Z","timestamp":1789121243368,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stashphantom.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 10 Sep 2026 13:59:45 GMT","end":"Wed, 09 Dec 2026 13:59:44 GMT"},"fingerprint":{"sha1":"F6:7E:7D:5B:6D:E1:C6:70:41:9B:E4:E6:45:18:21:79:C5:4C:28:32","sha256":"A9:93:D7:3F:13:AF:03:42:E0:B2:C8:FE:59:F6:87:99:78:00:44:7E:38:30:D3:70:D4:51:EE:E5:63:D3:51:3F"}}},"request":{"raw":"GET /images/logo.png HTTP/1.1\r\nHost: stashphantom.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://stashphantom.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Fri, 11 Sep 2026 10:07:23 GMT\r\netag: W/\"da209-1a08bdd0950\"\r\nlast-modified: Thu, 10 Sep 2026 15:08:34 GMT\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":893449,"size_decoded":881664,"mime_type":"image/png","magic":"PNG image data, 2172 x 724, 8-bit/color RGB, non-interlaced","md5":"29f0b8812a469688466433809abd0fd3","sha1":"4b9e4f48d26326a00fbde37aa5a08ae907707f85","sha256":"2d3478121e38b6bc156bd0a052e472779ebd528f0b540e63fe8797158f65cc20","sha512":"ddc7c6d09455af8f4d204f0603d673d447f9ee242da88673e424c931662e2bca8e89d7ff30de78406743627f368c7af8d6f5004043907f502970e4673730856c","ssdeep":"24576:ngmHyAq2kIF0cUu/6MopQaKYUiPm5BvjRnpXLuWbKNxd:bHyA0M0PuHoq1YUiWjRngWmF","tlshash":"40153327fa71c028e0897d3d239c411a15b53bf90df91091627fa72474a976a9e02eff","first_seen":"2026-09-11T09:41:48.082552Z","last_seen":"2026-09-11T10:07:56.575168Z","times_seen":2,"resource_available":false,"data":null}},"time_used":304,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"stashphantom.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stashphantom.cc/","fqdn":"stashphantom.cc","domain":"stashphantom.cc","tld":"cc"},"ip":{"addr":"170.9.233.173","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-11T10:07:22.061Z","timestamp":1789121242061,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stashphantom.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 10 Sep 2026 13:59:45 GMT","end":"Wed, 09 Dec 2026 13:59:44 GMT"},"fingerprint":{"sha1":"F6:7E:7D:5B:6D:E1:C6:70:41:9B:E4:E6:45:18:21:79:C5:4C:28:32","sha256":"A9:93:D7:3F:13:AF:03:42:E0:B2:C8:FE:59:F6:87:99:78:00:44:7E:38:30:D3:70:D4:51:EE:E5:63:D3:51:3F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: stashphantom.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=utf-8\r\ndate: Fri, 11 Sep 2026 10:07:22 GMT\r\netag: W/\"5fbf-GCgraFAx3xIRPgt2d704NBIWt0k\"\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":24511,"size_decoded":6615,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2044)","md5":"b971b19acf761c4d9d161093ecd263c8","sha1":"0b0e68d437890e936045fe7508d35556801d5693","sha256":"9763f88cd3a2aaf6b20b16fc7f3f918015daa1348676b7cb387d94b4021ac07f","sha512":"c94b90eda75dcd2da6c08e35ca1482873991662fa73b721619d0c48a68f14760c7441c953f72bc0f4e36f6b93a2d46e5bd91a693d70cb4c341ebdf5cb89a7218","ssdeep":"384:3GLqtEriXgDEHmpZrRFn4Y+RTdEj0npmZVM6:KCdX6EHmzH/cTdEQoZj","tlshash":"c6b27423e268243e246345e1f231733b61f7928be50b167471fc42aa4fd6d86fc2759a","first_seen":"2026-09-11T09:41:48.084295Z","last_seen":"2026-09-11T10:07:56.57859Z","times_seen":2,"resource_available":false,"data":null}},"time_used":585,"timings":{"blocked":0,"dns":111,"connect":109,"send":0,"wait":110,"receive":0,"ssl":255},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"stashphantom.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Archivo:wght@400;500;600;700;800;900\u0026family=Courier+Prime:wght@400;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.011Z","timestamp":1789121243011,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css2?family=Archivo:wght@400;500;600;700;800;900\u0026family=Courier+Prime:wght@400;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://stashphantom.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 11 Sep 2026 10:07:23 GMT\r\ndate: Fri, 11 Sep 2026 10:07:23 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9860,"size_decoded":1363,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"89cf6d52b247c3fb080929418fe1ae33","sha1":"9144191b367dbe70b2a3f03a2fbe9a74c0c38af7","sha256":"954c7625920d5a47f462db28e5ad712126620222f105c6389a602f3f9921219b","sha512":"73c39c3f870a109bc6cbc7e912cf5f6121cdfe1d75e30bc51c157df47ff6ea7b1aec9873a982d2d7449e3b334b72d50d216eb09a7c69263e161cefc5c1834aeb","ssdeep":"192:cKop1WhHpOWMWp/W79pAWWMppW97pykmhiKmIS:cklyjoh","tlshash":"1212eea6046f9540eb475cd337ee7e36ee4fb1906440c4b96ffd1498acaac22236670d","first_seen":"2026-09-11T09:41:48.085455Z","last_seen":"2026-09-11T10:07:56.580603Z","times_seen":2,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":36,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stashphantom.cc/css/style.css","fqdn":"stashphantom.cc","domain":"stashphantom.cc","tld":"cc"},"ip":{"addr":"170.9.233.173","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://stashphantom.cc/","date":"2026-09-11T10:07:23.014Z","timestamp":1789121243014,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stashphantom.cc","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 10 Sep 2026 13:59:45 GMT","end":"Wed, 09 Dec 2026 13:59:44 GMT"},"fingerprint":{"sha1":"F6:7E:7D:5B:6D:E1:C6:70:41:9B:E4:E6:45:18:21:79:C5:4C:28:32","sha256":"A9:93:D7:3F:13:AF:03:42:E0:B2:C8:FE:59:F6:87:99:78:00:44:7E:38:30:D3:70:D4:51:EE:E5:63:D3:51:3F"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: stashphantom.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://stashphantom.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0\r\ncontent-encoding: gzip\r\ncontent-type: text/css; charset=UTF-8\r\ndate: Fri, 11 Sep 2026 10:07:23 GMT\r\netag: W/\"4928-1a08bdd0950\"\r\nlast-modified: Thu, 10 Sep 2026 15:08:34 GMT\r\nvary: Accept-Encoding\r\nx-powered-by: Express\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":18728,"size_decoded":5400,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (1042)","md5":"708736fa37e4aaa8f6b23a7a4d0885e2","sha1":"b6c4711b584d3a4ef38b81b2bbb1d05c3191549f","sha256":"c414aff74bee8093399dd3339868479303471fef0920c641ddf57d4cf92fe53c","sha512":"d90fde4bfa8cf5990e01443089239da351a130d241852eb1228b81ff24a1835c6be201d25906fb24810d7438983b1619778089f5208192fe9957aeb909620263","ssdeep":"384:c+2erBmO47KPNhb5dt5PAgQRhd+TMIYaKqYaDLsiAqoP0R5SUUwy//RXmLNLJGm/:LWOrVYkPVVGhChiY","tlshash":"eb8275f6a291a138fc2bfc50a78866df7014a413dd6753e9ed829124c8c76fb5b71b08","first_seen":"2026-09-11T09:41:48.078756Z","last_seen":"2026-09-11T10:07:56.582071Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-11","alert":"Sinkholed","trigger":"stashphantom.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}