{"report_id":"889c3012-d88c-4e9a-a96a-d6a77bc92631","version":0,"status":"done","tags":[],"date":"2026-09-15T18:41:32Z","url":{"schema":"http","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"172.67.134.91","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"title":"Fotografo Matrimonio Roma - Raw Tales Photography","dom":{"size":178545,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (36887)","md5":"fdd5a3ee2f259bf0af4d7af1d428d370","sha1":"276216de3d97e7264dc109e16dc8feb0bd5566e3","sha256":"d89cfa6f5a38b2e4f65ea58ab5ecd41cb497c0a00044bc234beeb975a3751227","sha512":"7c2f60322bfdb49db878d782c89b5cb7dc25306a89dd84ea25147b0b4b6107ab1e6009843ae25d8162deb6a4d1b991e1af49df1f2dd451afd75480d19407e44b","ssdeep":"3072:ZT+uOi5Bbot+aVCHVOzXVo4iVOIfox10+b990nAo83kF19TC7hUCP:ZquOi55a+aVCHVOzXVo4iVOIfox10+b7","tlshash":"3a04d813fb6130a600ab17856d3a72bce41be045d7024ef4f2d9c3a937c9b963969787","dom_hash":"domhash62e6c8ff264322e85cfa17bf3a316308","first_seen":"2026-09-15T18:41:43.895006Z","last_seen":"2026-09-15T18:41:43.895006Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"172.67.134.91","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-20T18:41:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"rawtales.live","ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-15T18:41:36.504045Z","last_seen":"2026-09-15T18:41:36.504045Z","alert_count":140,"request_count":28,"received_data":2990180,"sent_data":15768,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"iubenda","description":"iubenda is a compliance software used by businesses for their websites and apps.","website":"https://www.iubenda.com","common_platform_enumeration":"","icon":"iubenda.svg","categories":["Cookie compliance"]},{"name":"WordPress Super Cache","description":"WordPress Super Cache is a static caching plugin for WordPress.","website":"https://z9.io/wp-super-cache/","common_platform_enumeration":"","icon":"wp_super_cache.png","categories":["Caching","WordPress plugins"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"Yoast SEO:20.11","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP:8.1.34","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WordPress:6.2.11","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]}]},{"fqdn":"cs.iubenda.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2010-07-06","domain_rank":150451,"first_seen":"2023-06-30T23:23:16Z","last_seen":"2026-09-15T16:54:17.227064Z","alert_count":0,"request_count":1,"received_data":2201,"sent_data":479,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.google.no","ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2001-02-26","domain_rank":92680,"first_seen":"2012-06-26T23:22:08Z","last_seen":"2026-09-14T00:01:55.00998Z","alert_count":0,"request_count":1,"received_data":578,"sent_data":828,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn.iubenda.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2010-07-06","domain_rank":98443,"first_seen":"2012-10-02T03:43:09Z","last_seen":"2026-09-10T19:10:55.304187Z","alert_count":0,"request_count":6,"received_data":486229,"sent_data":2882,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-09-13T22:44:45.310895Z","alert_count":0,"request_count":2,"received_data":909465,"sent_data":954,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"idb.iubenda.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2010-07-06","domain_rank":154008,"first_seen":"2024-06-21T08:17:34Z","last_seen":"2026-09-10T17:04:43.510478Z","alert_count":0,"request_count":1,"received_data":795,"sent_data":515,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-13T22:43:30.72904Z","alert_count":0,"request_count":1,"received_data":9826,"sent_data":556,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"50f82c5218714d8c16915e7769a27ac8","sha1":"5f2eaabf3c579d58428252a8d85ec1f42b5c2bec","sha256":"b3766c7a0709b271e36e55e7fd213f7a990a626d00eb1356482128cec3a5c1a8","sha512":"8bd84bff6d0d22d3abfd7ae6ac3bf4c51ae03d58f545c06ee2dec8ebb8f69efee1fbb88eb2398c01c85aae250df3a62bed56342f8f98e6e7bd2384167ccd441c","ssdeep":"","tlshash":"e2b09b3b490f045621705189c31c355c45c1575a11a6e151b52d930a5fc812667e55ed","size":125,"data":"","first_seen":"2026-09-15T18:28:22.724111Z","last_seen":"2026-09-15T18:41:43.968587Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2a06162d8bfbebadcd34b697ef8341be","sha1":"3ce478f08e3e8ca243a90f0c5548fc9c9e1e0ebd","sha256":"1e0751a98b44f8aab1ca5a0d8665218a58bc89bcee8dc6d9fe8765aaa82edfe3","sha512":"a9340a78cce5ca04568f3ecd3745fe6917ca2fb387cc29e6347645592fa00d97441c20ef66fd279af28d3987167663fec83eadf529c728428eb5c3426c1cdb4b","ssdeep":"","tlshash":"cc41ce9cf19268fc807b0adab32f775831265a0825820581dbe9a5217d75c43f917fed","size":1976,"data":"","first_seen":"2023-03-08T19:55:14Z","last_seen":"2026-09-15T18:41:43.969986Z","times_seen":63,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"03019a2a3a3633927de5d9ece4a23125","sha1":"027f5257450a01db99b3445b5011380593b1c89f","sha256":"17ae50cb97f08b95d61518500b8854b9e26ef0a7fcd7a8618bb58db9a0cae0c8","sha512":"a3d7f42b4f2cf0ffa9ca829257b08091ea5332430fc02d3d749b2bb255e54f81f72a77b0aeadc8d7b86e74be5ea40443801e5d2bcd64c2aec1a7ed08c6013c84","ssdeep":"","tlshash":"f141416a276d1c6d32bb20e3af5f5f4b5e2600131180e439c9fa76951872c91c2f9c84","size":2150,"data":"","first_seen":"2026-09-15T18:28:22.727226Z","last_seen":"2026-09-15T18:41:43.970932Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"719901458cb6074ac40443862f42cb52","sha1":"a105eaee450ff333a9e8c3cd42e80d7b1893ba7f","sha256":"1252b957246708d60b4ee2da2c325b19643572878e76c950841252496b05a99a","sha512":"973b09350e85650b2cf5ef852031769d8fe6a299c0bc726bbcdd3acf1073b4fb7d63baaf20c5e67897ad511d14e3e5b9f88b898842c257ccdd61801ace95467d","ssdeep":"","tlshash":"c9e0e56064109cbcd843b64c226a2f425c2a722286d53d1caa0e16dd20dd01ada02347","size":430,"data":"","first_seen":"2026-09-15T18:28:22.728503Z","last_seen":"2026-09-15T18:41:43.972272Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ffbd31dd763870dabd715aae4bf68e04","sha1":"fc4d51410d30a11f2db867707f1567b85c0084b8","sha256":"3c908b0b3a125f09e5d3e76e96dda3c517cbdc084e80081d5671bea969d2cdc4","sha512":"a9ab076fd77154cfd5e4273f430f6693115144eb4cce4b14108067eca40368c8efbb878dc6399957a16caca5d1951851651b1227d434f36aaf9e7559f4be9f6e","ssdeep":"","tlshash":"a5c04c88271a5c7156af27440b6ba505b0597214ace22c310d156249a621c9b5755c64","size":151,"data":"","first_seen":"2026-09-15T18:28:22.730076Z","last_seen":"2026-09-15T18:41:43.973569Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"81ac66e0592af6edf81973faa94cb2b4","sha1":"cdb4e3c54f70b51e126ec78f5dc301b73ff542b1","sha256":"0e905523d74d60d0cb5676942686e701f31cb1e1ee3c8d0ae2aa740feb04d08f","sha512":"b12773525b014c67827abd33db0531412ad6ec16bb947b9e5917c2241350363498ec2a98326e33aa7e7f351e4da1c1cb5a716b30c0b657758dd453592a8799b4","ssdeep":"","tlshash":"85c02b8c320a0c7185fb2700cb7ffa04f4013204a8d06d320c0d23044e10e13d748840","size":151,"data":"","first_seen":"2026-09-15T18:28:22.731772Z","last_seen":"2026-09-15T18:41:43.974803Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a9c0a66f84ed68f4bd6c9f6db4363ab5","sha1":"4d870286ed82f26346232ef9edff3d3ae526cdc2","sha256":"9c16bfd92386dc983a0abb9c2e64a9bd71e1f3d325950a77c78dd98b764c57f0","sha512":"ac075f064fc69748a92263c632ce65d2f98c0ebf98f7e186ab801c8ed7a9195b597bed4eac22b9e60eb4a95cfcd3e998117304ee7f0af76f230a678459770bfe","ssdeep":"","tlshash":"27f0dcac2c42a09633fe2534c227aaaa2b63070074c2d4688642c4152ca89820c42dce","size":460,"data":"","first_seen":"2026-09-15T18:28:22.734305Z","last_seen":"2026-09-15T18:41:43.976146Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c224d46d5ca04a6c15f94b26f0d449ff","sha1":"e1f57fde78eab1137d09be2357b0f0736de3fedf","sha256":"43bf6f2a888fab875a76d3f024fe54666c15fe62b246b07082e1da645aa0292c","sha512":"b8a2ae9f5392c36099d07d128fbd2a611b62f3a7e0f6c41e3db018a3a1981c1a163fecec1666b7be461bd8b616cce8e6d2ce7cc355083530594bb1e41e6aceaa","ssdeep":"","tlshash":"67e068193e058438818ae0f41aeb990a26210087568044c3881fc88ddde8ffec809ec8","size":370,"data":"","first_seen":"2023-03-07T12:01:54Z","last_seen":"2026-09-15T18:41:43.97739Z","times_seen":4196,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f80ab1b6b101ade956675f92e9e2c535","sha1":"e34e50c8452ecfd3ceda8cac5c535765a9cd4467","sha256":"be8976a510b0972b2e0896f491ae58feadb3f8629b40ce30285fad6e00e13447","sha512":"82acccfa50afecc6dee9257874e67aaed8f5d2407487bcab00fd5d5b4b95206db3cdbc703ae9f7dba8e534710dffc4cc143b3ff68980dfe4ef4be6c3ea6244bb","ssdeep":"","tlshash":"ddb0120a55432e9731a018f12f6c76b347d313a47c304401278e8243de52003ec49691","size":94,"data":"","first_seen":"2026-09-15T18:28:22.736874Z","last_seen":"2026-09-15T18:41:43.978203Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2bf0d981ee4a2081d4bb756c638783b1","sha1":"d43025f102884569a1be4d5e37ecf70c510a3561","sha256":"d67d26117e80c8f2ad40df3967adce5d8bf4afe8f3bf55fe996433264f61dd15","sha512":"4396b28a724b608f03321dc60136f3cc71df3cf589e30c707d4310b9d7af3fa45430c04bcce3b6ff3374b2ace7b9f0b3ae06c5fd626f75dc43dacd15903993a0","ssdeep":"","tlshash":"2ff0720551e48c398bbf2099ad3b0a0aad6c409a71481633f3bef35a52aa81a40e75a0","size":639,"data":"","first_seen":"2025-11-14T15:40:23.998676Z","last_seen":"2026-09-15T18:41:43.979305Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google-analytics.com/analytics.js","fqdn":"www.google-analytics.com","domain":"google-analytics.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"d39a8679ed70005ee063ea62886141a2","sha1":"52b556cb7bdbe59b9b1ab9415ff905b561b8399e","sha256":"b33ed8fd08f8cf0138f219167d4bb5817f1b09c1d9ac7431e833899ecfff40f1","sha512":"c65e2fe579412ea8ef38d29185f47dec1f4fb871ec28767c104821f1c3368793c4ff577ed58971d27a9bbac97fee734093766954f7e9d2fc0ff1cb687a0ab977","ssdeep":"96:A1VdZYqhPnjpsx4/eTe8qSMbqaQd6VL2Jyt9LdJoyayCVPVD5wdBf2PfCHiUr3:AXdZYqNjpm4yPqSMbqaQGL2QfdDayCZa","tlshash":"3ca1ca9929fb50210233b1bd1bafa918b63895236208dd61bd8c9264af94437d7f1bc9","size":4693,"data":"","first_seen":"2026-05-25T14:46:35.360433Z","last_seen":"2026-09-15T20:57:24.865312Z","times_seen":98427,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/iubenda.js","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"7678fe1eaf2d9b376db19bbbd904ca49","sha1":"f17c03a27d7ce16066402e7c893382c7c6ab5139","sha256":"f76f1415dfe4d455984dc8b3387ce03ae18faedd883f5f237eb194198a79cd7f","sha512":"eaa689ebb3316ce698bea60be069e48820bebb325f5d0ec880f8a4a36b3e50916627d6085fa8e5f6c5bff197228702dd21f4e2804c1289712034f34fcab63a2b","ssdeep":"384:rrqtkkSIWzFWsh2rQffWiIya39ieJjZ3SyUYYha+s3UjXpUUKwYWRSwpEF:yG8WzFRh2rQfR3GzfUYYha+s3+XuZwXI","tlshash":"96621aac7a81316a478323d87cff584cf0724468ae09c890d055d6b57ab8fe4906ffa9","size":14920,"data":"","first_seen":"2026-03-16T15:42:48.548438Z","last_seen":"2026-09-15T18:56:04.691837Z","times_seen":23758,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/cs/iubenda_cs.js","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"1fa4066f04722e1ad6a53a6fc0bcf7ed","sha1":"924b3e1c4bc262f85d67822c15405298b963e826","sha256":"1c2e191b75d9cc9b1cfb3aba4a64dfbdb9c42629feb5a2742e06cc1b7e19c1dd","sha512":"6de42ae7038e46cd9338f5b87cd67386927b6a9504ffb4268bdecb60430d4fb5e0c6414b01c18cf2038d640174674a9b699ff1e0cba889b17383747b4a2b75dc","ssdeep":"96:zy6mxfVuqDp5pL0r2vDWI3IhWFWCIq/Y9HWLde:zyrxflXpL0r2vDWRAIq/Y92Lde","tlshash":"c281ea08aed1d43616883ab014fb5d88bd634c6e766c585cf3ce1dd86cc8a8d6d27895","size":4101,"data":"","first_seen":"2026-09-15T12:56:19.27858Z","last_seen":"2026-09-15T18:41:43.915913Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/plugins/wp-performance-score-booster//assets/js/page-preloader.js","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8cc2683737633b8ec0a7b6f8d3dac68","sha1":"928b3fc955ce4166c9bf424bf0a38930b2f8557b","sha256":"8b3644ac5b264c8d3d09222feeea6aa208432f4e46900037dd60bc9834b3c250","sha512":"99f91f1637350e153a35d33de3cf4224b5deb40af63a7b07045c73b87caed9c1f852dcc2907c8e5eefeebe3b7634f50f091b89281099ec99765bb306c689297d","ssdeep":"","tlshash":"235150e9b21221b601f657f621ffa380b635214530039021587e9cd85e3ffea2253e6f","size":3051,"data":"","first_seen":"2023-03-30T00:01:52Z","last_seen":"2026-09-15T18:41:43.945122Z","times_seen":4303,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eventHandler","is_inline":false,"md5":"7688ca9eb3ca1c878821b1e3fe2c23d7","sha1":"2c41fd7e9f8312d6fed18b21e1a0589413e35553","sha256":"793bae9539499e6e02187febbd2e20fd17dd40260033f5175dbfc2f294440d9a","sha512":"2c8eb7f338f85c2fb760cf69c062669cf5b75609e12799b55dfa6994bc9be6fb16695c8d6ad5fb53ca45ea30285b37ef17beadf62bb41480a61dc0fe5339032a","ssdeep":"","tlshash":"9480002888308020000bc30c0203c8c202320c0f02cc2202ac02800802e03200802c23","size":27,"data":"","first_seen":"2023-04-10T15:53:31Z","last_seen":"2026-09-15T20:42:04.777043Z","times_seen":99505,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-includes/js/jquery/jquery.min.js","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0e850a69bc7fd0acc2e92ce6eee87959","sha1":"8be6d9e7f7a61ccf0b8eac8a8144d770b608a19c","sha256":"afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a","sha512":"0f8a4fb2ea15a93290778a55c701208c9245193d8c910f47f26bb245b0a3f6d6d91427a1857f98c3632bc3feec5c0b83517b46c1fa1817bc3bb33b5ccb9a11e3","ssdeep":"1536:IjjxXUHunxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBqUsuy8WnKdXwhLQv1:IeeIygP3fulzhsz8jlvaDioQ47GKK","tlshash":"9f93f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","size":89815,"data":"","first_seen":"2023-03-29T22:52:25Z","last_seen":"2026-09-15T18:41:43.900777Z","times_seen":32060,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=UA-155033732-1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2466819d2ae6c82390d66ce509637df7","sha1":"e3c83354ca318b1fe61cd4996135e380ad405bd1","sha256":"e286bc19f76b6aac4292e087068a0d5b1a85a39118cd7572fba59701351c8fdf","sha512":"c0603e9e4cb9dab97a4a9e061200e8d1738c25c1177c5efe543d9b45934425ab9ef203353ddab7ba7a4a1d54ae1f41b75a51bfff71c4cb4b5eb93923e7de60c0","ssdeep":"6144:ehn1KcIpPImOh9mHFLgycRtbJEqq3RtWWfA7y23fHdr:eGH+5WYxP5","tlshash":"838408ccb7d6742283a3b574503f018bb27a69a2b84cc898f286ddd42e3465a5177f7c","size":382593,"data":"","first_seen":"2026-09-15T18:41:43.939247Z","last_seen":"2026-09-15T18:41:43.939247Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/cookie_solution/iubenda_cs/1.106.0/core-it.js","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"f0dfd29812d630908c222357c2dc9f30","sha1":"ee6a34d60afa86b157471d3a731e05e68ae6d771","sha256":"7f917ad65e7224b9b787bab6cbd1ec5461ce98124234a3013ff70dbcdef0358f","sha512":"39a29f5bd105a1ebf91e0f1e295789b15db6716060e395af60922a054fd2383348a73282243e012a94b0f0783ca6fe18a70468f3b6207411ee1e0482d213ae2c","ssdeep":"6144:vd6kuOyznbBFYGvHZcETxm5F8lkUK6s18viyT7qVAKQu84g+aifbKXvkR9CxIyFA:vQjr41UeCxIyF/I","tlshash":"c394f845b381713406d3a168083b131ea13b75549686c5bcf436ead42f98fceb1abf7a","size":448174,"data":"","first_seen":"2026-09-15T16:54:23.946776Z","last_seen":"2026-09-15T18:41:43.945909Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/cache/autoptimize/js/autoptimize_d4a39ac9d33f52bad142f831c70beccf.js","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"155ff0c42091342c82891f8a3c5cd175","sha1":"46688df412314bf56e765f595d337486391b94c4","sha256":"57d209eb94f73d1c8441ad59ba7f41f0f4076fa6dd5261f87b2f12bd64510053","sha512":"284d46a8bf2f850acdd225e1eb1e5f0fa828bc129a11495d191c56331237b2cbc9a2c667fccfb365d88fd46d193ec3f691af4ceaef72e1c1a44e9d19d0c01dab","ssdeep":"6144:r9P4sZCwe4YxoD9fGevmRzMSZfupgbJUlNyYMZlvIqxGcTJ7PBTkW7kjVxaVwqyj:hPdwxM9Cffly","tlshash":"83b4094db240352142ff62b5102f420eb2336569b506c498b179c9fa6dbce8962f7fbd","size":536243,"data":"","first_seen":"2026-09-15T18:41:43.95341Z","last_seen":"2026-09-15T18:41:43.95341Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-L4DC0WJ05F","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"544bcf832f785fa50f0cb46ce45b03b7","sha1":"90e58755e38c730433e5ca268a3dc79301964655","sha256":"009a3004f819ff7e699f0db4d2e7cdf92532bf3e0767c4f24af2256d345e832c","sha512":"9e4aa38b5dfd7901ae9621bb80aa61bb9291a800bd5fc5ca966d4741f2ee762887281d7d594e6f0abe045bd78cf2995a44700b50ec88dbcbfbad3dfcc3f8e850","ssdeep":"6144:UwXn1KcIGUPWmJhgYcYnsLg2cRtbJEqq3RtwfzA1y2EIwtgT84ifr:n88seoJfUHEIw","tlshash":"86b408ce73c674229396f174903f018ba97b28a2b45cc89af289dce42d3465a5177f7c","size":525664,"data":"","first_seen":"2026-09-15T18:28:22.720497Z","last_seen":"2026-09-15T18:41:43.950061Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cs.iubenda.com/cookie-solution/confs/js/22163588.js","fqdn":"cs.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c601d5496da4ecaae42f2483ea94d9f","sha1":"c858ec3258c41a0f945da582bafab58d9bcab23e","sha256":"8656fd268f81abc44c384a09c0d0f11e6caafef5077192847c690cf3ef19c9c6","sha512":"eda0f47dda2842b40e690d4c9e9001035c065230e8f450c805536bf62508d9ff66f9e019d28c953e1be4c46ce17278e4f4f7fe19d9b9ec93c39b9ee79ddca614","ssdeep":"","tlshash":"d3d095904d4114fc5c4c54359a8044dd6510402bc1471a6851657b3811ce50c36ffec7","size":272,"data":"","first_seen":"2026-09-15T18:41:43.906292Z","last_seen":"2026-09-15T18:41:43.906292Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/iubenda_i_badge.js","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"35bac0339ff36e2548ae16f02d69eded","sha1":"0589a3e91447748d8a3c1be88009234b7b832f58","sha256":"3446c86025da5c5f6caa6aea240950e84c886a92987e2b2835b69780d02bca87","sha512":"dc54624cac90d51554afeacaf4c92c2e0b746f4ca4871ab6a5655071068c9e69062913f08e38fe861ec4676a473d1fbc23f8316b2b8548ae4badc41d4980ffef","ssdeep":"192:bGvzVw/qfgVUkZAQxxrrXYGsV4XGpgmFxcmqZHH/Sph42:bGvzVzoAQxx3XFsV42pgmFx2HHqbH","tlshash":"8d32b7a9b751623450ae97dd682b0f0cf362606e5901422cb93cdcf9657ce46317bb7c","size":11691,"data":"","first_seen":"2026-03-16T15:42:48.524047Z","last_seen":"2026-09-15T18:56:04.705159Z","times_seen":23351,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"JQMIGRATE: Migrate is installed, version 3.4.0","filename":"https://rawtales.live/wp-content/cache/autoptimize/js/autoptimize_d4a39ac9d33f52bad142f831c70beccf.js","line_number":2,"column_number":970},{"level":"warn","text":"Google Analytics and Tag Manager is being shimmed by Firefox. See https://bugzilla.mozilla.org/show_bug.cgi?id=1713687 for details.","filename":"sandbox eval code","line_number":1,"column_number":9}]},"http":[{"url":{"schema":"https","addr":"rawtales.live/wp-includes/js/jquery/jquery.min.js","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.231Z","timestamp":1789497659231,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-encoding: zstd\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\ncache-control: public, max-age=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BSaN4YTwPuUzp2fcLHj0YD5dqgxGgaIvHb2rqqG8dRF2wcKGSDsojdW0vHA1z6X4%2FSymBMQCvdZH9RW1vKfpzGm5bSvsHGglyvta%2Bu8KIRRipTROtHDeJjrCjOo%2B5hsj\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c3524926ee1a-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89815,"size_decoded":33567,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"0e850a69bc7fd0acc2e92ce6eee87959","sha1":"8be6d9e7f7a61ccf0b8eac8a8144d770b608a19c","sha256":"afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a","sha512":"0f8a4fb2ea15a93290778a55c701208c9245193d8c910f47f26bb245b0a3f6d6d91427a1857f98c3632bc3feec5c0b83517b46c1fa1817bc3bb33b5ccb9a11e3","ssdeep":"1536:IjjxXUHunxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBqUsuy8WnKdXwhLQv1:IeeIygP3fulzhsz8jlvaDioQ47GKK","tlshash":"9f93f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-29T22:52:25Z","last_seen":"2026-09-15T18:41:43.900777Z","times_seen":32060,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/flex/fonts/Libertinus-Sans-Regular.woff","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.392Z","timestamp":1789497659392,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/flex/fonts/Libertinus-Sans-Regular.woff HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3b9c353396eee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 793\r\ncache-control: max-age=10368000\r\netag: \"5fe9d513-36880\"\r\nexpires: Wed, 13 Jan 2027 18:27:45 GMT\r\nlast-modified: Mon, 28 Dec 2020 12:52:35 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jmk18LJwdPnOdnOSaCjW%2BO9Al%2FTD6Rof5SQQ9AH6zV5rWExYISO%2BzDNfkTKrdX7Tf6zy6%2FT37bnnovEGTLnUFNwH12vM%2Fyuw8dk2PHq3vEmz5H4mOAVNO7meZJrYWLs%2F\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 223360\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":223360,"size_decoded":224130,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 223360, version 6.7","md5":"b0081cee809e763a7e4189dec9a9e8a9","sha1":"94c8b2ecdcbcbc71d3e935ab61d5894eebba1e87","sha256":"860eac8066034b9cb90828ea0b59ec0fe3b2adfa6c9d2ee3f6cd535b0ba996ee","sha512":"536c47432e7533790b10d867725eb50f4331dfa3bcf5f3582bb35dce3388152f15cde576cfb6666b8becc640710166e22bc3866fb64a474bb5daf836559f5175","ssdeep":"6144:LGAFo7Qr9Ar9yr/c+XU8I5rPSVKY9o9WrAbrH87NlsPAis:L8Qr9Ar9uU+zM8AiAPH83Gs","tlshash":"7f2412ec9ad2563ec0c18af857015dcec5ebe4289a37aac11536b2fd992ff701503e18","first_seen":"2025-10-31T20:57:40.002909Z","last_seen":"2026-09-15T18:41:43.902765Z","times_seen":4,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cs.iubenda.com/cookie-solution/confs/js/22163588.js","fqdn":"cs.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.560Z","timestamp":1789497659560,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.iubenda.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 04 Mar 2026 00:00:00 GMT","end":"Sun, 31 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"48:E7:8A:F5:24:9E:68:9C:AF:66:4E:E2:EE:C3:90:B8:84:A1:8D:4C","sha256":"43:20:4D:9B:97:2D:E4:EF:E6:8F:71:78:B9:81:E9:96:BD:9B:75:C3:A5:EC:88:84:00:DD:76:5A:3C:DC:A3:3C"}}},"request":{"raw":"GET /cookie-solution/confs/js/22163588.js HTTP/1.1\r\nHost: cs.iubenda.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 1019485\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=3600, public\r\ncontent-encoding: zstd\r\netag: W/\"8656fd268f81abc44c384a09c0d0f11e\"\r\nexpires: Fri, 11 Sep 2026 23:06:13 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 0\r\nx-content-type-options: nosniff\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-security-policy: default-src 'self' https:; connect-src 'self' https: *.iubenda.com s.swiftypecdn.com *.appcues.com *.appcues.net wss://*.appcues.com wss://*.appcues.net global.frcapi.com eu.frcapi.com properties: data: *.cardinaltrusted.com; base-uri 'self'; font-src 'self' https: fonts.gstatic.com data:; frame-src 'self' https: *.appcues.com; img-src 'self' https: *.iubenda.com cc.swiftype.com *.appcues.com *.appcues.net res.cloudinary.com cdn.jsdelivr.net heapanalytics.com blob: data:; object-src 'none'; script-src 'self' https: http: 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'report-sample' 'nonce-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'; style-src 'self' https: 'unsafe-inline' *.iubenda.com fast.wistia.net s.swiftypecdn.com *.appcues.com *.appcues.net fonts.googleapis.com fonts.google.com; media-src 'self' https: blob: data:; report-uri /csp_reports\r\nx-request-id: 3b04e2dc193686fa6a288ca21a1b0f53\r\nx-runtime: 0.180956\r\nserved-by: L2-CS\r\nl2-cache-fetch-status: HIT\r\nl2-cache-store-status: BYPASS\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/15/2026 18:27:39\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 6cd33e711a04220acd430da3c8bd78ce\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":272,"size_decoded":2146,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"2c601d5496da4ecaae42f2483ea94d9f","sha1":"c858ec3258c41a0f945da582bafab58d9bcab23e","sha256":"8656fd268f81abc44c384a09c0d0f11e6caafef5077192847c690cf3ef19c9c6","sha512":"eda0f47dda2842b40e690d4c9e9001035c065230e8f450c805536bf62508d9ff66f9e019d28c953e1be4c46ce17278e4f4f7fe19d9b9ec93c39b9ee79ddca614","ssdeep":"","tlshash":"d3d095904d4114fc5c4c54359a8044dd6510402bc1471a6851657b3811ce50c36ffec7","first_seen":"2026-09-15T18:41:43.906292Z","last_seen":"2026-09-15T18:41:43.906292Z","times_seen":1,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":17,"connect":1,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.no/ads/ga-audiences?v=1\u0026t=sr\u0026slf_rd=1\u0026_r=4\u0026tid=G-L4DC0WJ05F\u0026cid=887502287.1789497660\u0026gtm=45je69b1v9105547530za200zd9105547530xf1\u0026rcb=7\u0026aip=1\u0026dma=1\u0026dma_cps=a\u0026gcd=13l3lPl2l1l1\u0026npa=1\u0026frm=0\u0026tag_exp=115616985~115938466~115938469~118897920~118897930~120213116~120385423~120469145~120469153~120912439\u0026z=2089789602","fqdn":"www.google.no","domain":"google.no","tld":"no"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.686Z","timestamp":1789497659686,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.no","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:40:49 GMT","end":"Mon, 02 Nov 2026 08:40:48 GMT"},"fingerprint":{"sha1":"AC:46:A3:8B:39:87:22:F5:32:ED:16:91:E0:7E:28:F9:39:7F:D5:13","sha256":"A4:B2:FB:D3:1E:80:B3:DC:DB:0F:63:1F:D1:60:FE:3F:E6:F8:61:9E:91:4E:FF:2E:A6:1E:2D:71:C9:D0:1F:75"}}},"request":{"raw":"GET /ads/ga-audiences?v=1\u0026t=sr\u0026slf_rd=1\u0026_r=4\u0026tid=G-L4DC0WJ05F\u0026cid=887502287.1789497660\u0026gtm=45je69b1v9105547530za200zd9105547530xf1\u0026rcb=7\u0026aip=1\u0026dma=1\u0026dma_cps=a\u0026gcd=13l3lPl2l1l1\u0026npa=1\u0026frm=0\u0026tag_exp=115616985~115938466~115938469~118897920~118897930~120213116~120385423~120469145~120469153~120912439\u0026z=2089789602 HTTP/1.1\r\nHost: www.google.no\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\np3p: policyref=\"https://www.googleadservices.com/pagead/p3p.xml\", CP=\"NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC\"\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\ncontent-type: image/gif\r\nx-content-type-options: nosniff\r\nserver: cafe\r\ncontent-length: 42\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":42,"size_decoded":578,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-09-15T20:51:36.856184Z","times_seen":1066502,"resource_available":true,"data":null}},"time_used":84,"timings":{"blocked":0,"dns":2,"connect":16,"send":0,"wait":36,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2019/09/wedding-Glamour-867x1300.jpeg","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.757Z","timestamp":1789497659757,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2019/09/wedding-Glamour-867x1300.jpeg HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nCookie: _ga_L4DC0WJ05F=GS2.1.s1789497659$o1$g0$t1789497659$j60$l0$h0; _ga=GA1.1.887502287.1789497660\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mQmiXAmogKWbNCcLCEMZpjxYaD0VcYELb3IS55cB9coLkgyGlavG%2FNAAiBbJkIAb1HHrz9rQuJCi9E60%2FOJFaf%2Bm3qnH5WEbleolRe5MpGJC8KZbAtWmuxW6%2FddG5G5O\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/jpeg\r\npriority: u=5,i\r\ncf-ray: a3b9c3558a10ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 783\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\netag: W/\"67c5e40c-10840\"\r\nexpires: Wed, 13 Jan 2027 18:27:56 GMT\r\nlast-modified: Mon, 03 Mar 2025 17:17:00 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":67648,"size_decoded":65886,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 867x1300, components 3","md5":"92dcef1378325a791c775d1fb40df9f0","sha1":"3caad98b4b32396ba64827a022f3c8109d28cfbf","sha256":"c5c220d286474d2447a9a0c6d9aa256dfe7166fbdb60456679391936fb1b375f","sha512":"23b8069fafa46bebb1522964d3b3ac9eb9ddb31fedf86e61ed3a5ead0657730d47c69c431f10635d74169a8c63af59a96ea443a739075b45d85ea05951efadb0","ssdeep":"1536:KHTCVRyyMjdRGC7hYwYuPDobzPqjpQfpQv1jmq:KHTKRyyM/BVZXPD2y9Qfp6mq","tlshash":"5d6302d5ae2861f68540bda2cad7650f5a234a10b8ebf78bfc9c7c0387180ec5c59393","first_seen":"2026-09-15T18:41:43.909759Z","last_seen":"2026-09-15T18:41:43.909759Z","times_seen":1,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2023/10/couple-photoshoot-in-Rome-32.jpg","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.765Z","timestamp":1789497659765,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2023/10/couple-photoshoot-in-Rome-32.jpg HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nCookie: _ga_L4DC0WJ05F=GS2.1.s1789497659$o1$g0$t1789497659$j60$l0$h0; _ga=GA1.1.887502287.1789497660\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iYf%2FwImvkUQUgbgP%2FwmsWBarx%2B%2FpNnEHbl2a5r6a2nVI8u%2BCeEhbO9srlwzBcSHz%2BMxggW4m1KMy7wTkV2Q18wmiQ6C2jLjPTHilLNljgE8CYqXGtrtQIW3h5bqqLObw\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/jpeg\r\npriority: u=5,i\r\ncf-ray: a3b9c3559a17ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 776\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\netag: W/\"652ff941-11c16\"\r\nexpires: Wed, 13 Jan 2027 18:28:03 GMT\r\nlast-modified: Wed, 18 Oct 2023 15:26:57 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":72726,"size_decoded":70768,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 683x1024, components 3","md5":"9255a8467243a9177c11d50ff03353fd","sha1":"ee96e0331c440d66ba2daf1f22ea42f388a904ed","sha256":"a03f3c45f1ddeee842b5b355f8c53a5b0fc195d3a0110112befcc53546eb5be9","sha512":"6ee4c7f8081c3d43c78c5fbab6d412fb7e57ee52653a22bb7e48c70e7c93618b18e8c091b8aa51a6b1a3ee080104b397313223eb4cd19a91f52646bdef44ca78","ssdeep":"1536:GH/gmHBadrGau9uTgfRRhTqjBHhal76P5ryStigZOW5O/i:SgEB3sgDhTeBj5eSt3yi","tlshash":"32631214714373b09f250ff1e85eb62a4958bed4889261b8bd1ecb239722f81a14f65f","first_seen":"2026-09-15T18:41:43.912018Z","last_seen":"2026-09-15T18:41:43.912018Z","times_seen":1,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/iubenda.js","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.823Z","timestamp":1789497659823,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.iubenda.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 04 Mar 2026 00:00:00 GMT","end":"Sun, 31 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"48:E7:8A:F5:24:9E:68:9C:AF:66:4E:E2:EE:C3:90:B8:84:A1:8D:4C","sha256":"43:20:4D:9B:97:2D:E4:EF:E6:8F:71:78:B9:81:E9:96:BD:9B:75:C3:A5:EC:88:84:00:DD:76:5A:3C:DC:A3:3C"}}},"request":{"raw":"GET /iubenda.js HTTP/1.1\r\nHost: cdn.iubenda.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: application/javascript\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 954456\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=3600, public, must-revalidate, proxy-revalidate\r\ncontent-encoding: zstd\r\netag: \"6aa91f6d-3a48\"\r\nexpires: Tue, 15 Sep 2026 12:58:16 GMT\r\nlast-modified: Tue, 15 Sep 2026 10:35:25 GMT\r\np3p: CP=\"DSP NOI COR\", policyref=\"http://www.iubenda.com/w3c/p3p.xml\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/15/2026 11:58:16\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 9e447b20c604abd97c92747b8fa94efb\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":14920,"size_decoded":7476,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (14919)","md5":"7678fe1eaf2d9b376db19bbbd904ca49","sha1":"f17c03a27d7ce16066402e7c893382c7c6ab5139","sha256":"f76f1415dfe4d455984dc8b3387ce03ae18faedd883f5f237eb194198a79cd7f","sha512":"eaa689ebb3316ce698bea60be069e48820bebb325f5d0ec880f8a4a36b3e50916627d6085fa8e5f6c5bff197228702dd21f4e2804c1289712034f34fcab63a2b","ssdeep":"384:rrqtkkSIWzFWsh2rQffWiIya39ieJjZ3SyUYYha+s3UjXpUUKwYWRSwpEF:yG8WzFRh2rQfR3GzfUYYha+s3+XuZwXI","tlshash":"96621aac7a81316a478323d87cff584cf0724468ae09c890d055d6b57ab8fe4906ffa9","first_seen":"2026-03-16T15:42:48.548438Z","last_seen":"2026-09-15T18:56:04.691837Z","times_seen":23758,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/cache/autoptimize/css/autoptimize_a7252c3866c6ac59cec64f6ecfcc8451.css","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.041Z","timestamp":1789497659041,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/cache/autoptimize/css/autoptimize_a7252c3866c6ac59cec64f6ecfcc8451.css HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Tgc2yJlfA%2FdLlx9BkWZ25dlpv2%2F28RV2KTurznmO0odaIDuDytL%2BRR4QR6dNg72Zp%2BhBdewlD6yY%2BMNoSETf8Etodxs%2Bg9QHotQwJFrNuk89x7iIDMJ%2FWRJEdu8ldCZy\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c35108d5ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 800\r\ncache-control: public, max-age=30672000, immutable\r\ncontent-encoding: br\r\netag: W/\"6aa98da3-1d98\"\r\nexpires: Sun, 05 Sep 2027 18:27:37 GMT\r\nlast-modified: Tue, 15 Sep 2026 18:25:39 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7576,"size_decoded":1946,"mime_type":"text/css","magic":"ASCII text, with very long lines (848)","md5":"e49904d89b6213646c221de4660fe0fe","sha1":"01008df548e5fa1570f46793faa8ee324dfd9d8e","sha256":"34c526f05be909de84402d6e5ffe9ba10e57ea4f400ec95f75cfe2b59bf15630","sha512":"38baa6f068ea4050b3ce11e2433ac6e0b79cf91d7c8b5963cbde50ecab4116c21e5e408eb1b147bff53fd84d3e14788d54aefa13b7577441cedc36284759f4c0","ssdeep":"48:rjCyXveTbI6Cbv6dMcPMLEMBFfPt8qcr4C35y0sK7tQiISyMupgG3PL+Ck+3PAkW:rjdkEHRcEHBFtmF50AjYL0gpg3/T","tlshash":"73f19e8ca215a16f560f102446af8518250a3d0a8b7df7f5f8bfd82ac6cf7d068d3ad5","first_seen":"2026-09-15T18:28:22.717409Z","last_seen":"2026-09-15T18:41:43.914649Z","times_seen":2,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/cs/iubenda_cs.js","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.233Z","timestamp":1789497659233,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.iubenda.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 04 Mar 2026 00:00:00 GMT","end":"Sun, 31 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"48:E7:8A:F5:24:9E:68:9C:AF:66:4E:E2:EE:C3:90:B8:84:A1:8D:4C","sha256":"43:20:4D:9B:97:2D:E4:EF:E6:8F:71:78:B9:81:E9:96:BD:9B:75:C3:A5:EC:88:84:00:DD:76:5A:3C:DC:A3:3C"}}},"request":{"raw":"GET /cs/iubenda_cs.js HTTP/1.1\r\nHost: cdn.iubenda.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: application/javascript\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 954456\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=3600, public, must-revalidate, proxy-revalidate\r\ncontent-encoding: zstd\r\netag: \"6aa91f6c-1005\"\r\nexpires: Tue, 15 Sep 2026 12:57:30 GMT\r\nlast-modified: Tue, 15 Sep 2026 10:35:24 GMT\r\np3p: CP=\"DSP NOI COR\", policyref=\"http://www.iubenda.com/w3c/p3p.xml\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/15/2026 11:57:30\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 5a56c62f4b8be1495459d00736b4be90\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4101,"size_decoded":2766,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4100)","md5":"1fa4066f04722e1ad6a53a6fc0bcf7ed","sha1":"924b3e1c4bc262f85d67822c15405298b963e826","sha256":"1c2e191b75d9cc9b1cfb3aba4a64dfbdb9c42629feb5a2742e06cc1b7e19c1dd","sha512":"6de42ae7038e46cd9338f5b87cd67386927b6a9504ffb4268bdecb60430d4fb5e0c6414b01c18cf2038d640174674a9b699ff1e0cba889b17383747b4a2b75dc","ssdeep":"96:zy6mxfVuqDp5pL0r2vDWI3IhWFWCIq/Y9HWLde:zyrxflXpL0r2vDWRAIq/Y92Lde","tlshash":"c281ea08aed1d43616883ab014fb5d88bd634c6e766c585cf3ce1dd86cc8a8d6d27895","first_seen":"2026-09-15T12:56:19.27858Z","last_seen":"2026-09-15T18:41:43.915913Z","times_seen":4,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":49,"connect":19,"send":0,"wait":3,"receive":-1,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/themes/lyra/theme-files/public/fonts/default/Stylekit-1/Steelfish-Bold.woff","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.238Z","timestamp":1789497659238,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/themes/lyra/theme-files/public/fonts/default/Stylekit-1/Steelfish-Bold.woff HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rawtales.live/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c3524929ee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 790\r\ncache-control: max-age=10368000\r\netag: \"6a469fb2-f47c\"\r\nexpires: Wed, 13 Jan 2027 18:27:48 GMT\r\nlast-modified: Thu, 02 Jul 2026 17:28:18 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GAN6VoKjBxRhmL3CDw21ppm189B%2Flm2e8UiTs%2FEUrwGuqsoDuwRAWk00P2BsMGAAjPNRmc2pBLTVsum9yyNMUScwAkUx9HQBPmLIOXEaIBzRkxyE1XvgZuUNOtEnsEvG\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 62588\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":62588,"size_decoded":63348,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 62588, version 6.0","md5":"8a7643fa221d945ff8758df425c3d155","sha1":"983fda585d7f83f53380f2ee94452845ba813194","sha256":"d86be0f9689e3a1e8b1c59278dd545e754895865deb5f790352e3325aec5e592","sha512":"73b9af3a03d29943475b39e5d370d0ab4570f984a38b00145f6a0124a4921a3c5558f75f59db0ccb1be0c6773807100f823481bd8667519d1e9723061af0621b","ssdeep":"1536:K6UWFAUEq1AqC8Vv10CvFeHJx1sKqV+kFYYamhMHQxf5/aC83:Y4/zC8V90Cv+7SVHV5hMHQxf5/dI","tlshash":"7f53f1d5c1a428dfd59f96f3c9a34f26c112c2371c6881e2199be3c25fba76381ac2d1","first_seen":"2026-05-31T05:21:10.5374Z","last_seen":"2026-09-15T18:41:43.916751Z","times_seen":2,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/themes/lyra/theme-files/public/fonts/default/Stylekit-1/LibertinusSans-Regular.woff","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.240Z","timestamp":1789497659240,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/themes/lyra/theme-files/public/fonts/default/Stylekit-1/LibertinusSans-Regular.woff HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rawtales.live/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c352492aee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 800\r\ncache-control: max-age=10368000\r\netag: \"6a469fb2-36880\"\r\nexpires: Wed, 13 Jan 2027 18:27:38 GMT\r\nlast-modified: Thu, 02 Jul 2026 17:28:18 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CPkUCeeFsDB9SphOoUwqei07hwwImVIyRuiUjblAnSxVCbJOaxyORwd3pLw0x9Bmbezk9MXRBbnOGVvuQ%2F46xZie1SsdpdPA1HaYfg0CrixPcIDkO5PkewpLQdV2u455\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 223360\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":223360,"size_decoded":224120,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 223360, version 6.7","md5":"b0081cee809e763a7e4189dec9a9e8a9","sha1":"94c8b2ecdcbcbc71d3e935ab61d5894eebba1e87","sha256":"860eac8066034b9cb90828ea0b59ec0fe3b2adfa6c9d2ee3f6cd535b0ba996ee","sha512":"536c47432e7533790b10d867725eb50f4331dfa3bcf5f3582bb35dce3388152f15cde576cfb6666b8becc640710166e22bc3866fb64a474bb5daf836559f5175","ssdeep":"6144:LGAFo7Qr9Ar9yr/c+XU8I5rPSVKY9o9WrAbrH87NlsPAis:L8Qr9Ar9uU+zM8AiAPH83Gs","tlshash":"7f2412ec9ad2563ec0c18af857015dcec5ebe4289a37aac11536b2fd992ff701503e18","first_seen":"2025-10-31T20:57:40.002909Z","last_seen":"2026-09-15T18:41:43.902765Z","times_seen":4,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/flex/fonts/Roboto-Light.woff","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.393Z","timestamp":1789497659393,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/flex/fonts/Roboto-Light.woff HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3b9c353496fee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 799\r\ncache-control: max-age=10368000\r\netag: \"5fe9d513-16bc0\"\r\nexpires: Wed, 13 Jan 2027 18:27:39 GMT\r\nlast-modified: Mon, 28 Dec 2020 12:52:35 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BEVQ9mYkTsFZTJBsPqLuHBHy4Xw3VKXXSTXQWWtchgt23Y4D4RFq8awS8LF7I63Q%2BhG4m2g6xWKrj8xYD%2BL7f5nW664srEz8dPCUNjnaikBMAegatRZfo6rEBYnli3Yx\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 93120\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":93120,"size_decoded":93881,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 93120, version 0.0","md5":"10ad0f861c0c5807734017c341940649","sha1":"42eb5fdef68306d937a8fba20dd8da1b0de2bafa","sha256":"499d49392c413d3f5adffa7481a1e4572858ee6369c03ed603b6abdd174b1ce4","sha512":"6ea4eee3f50caab6df1a044c7ffae182bd3ed53863e6d653373c49447e683c0ac9d0e2dbc3a48d4747ca09213c1d608b6796bf406447071609901bc6aa156fe6","ssdeep":"1536:g0EU7Dbj73S8ms+pbzpePP0DUzhmSmL84oo6smemE+rMI/m+x5n58Dj+ARY3niXF:g0h7DbX3ezlzpePhdmSmL83FycrM8v52","tlshash":"1a93123fb3e5b82c4b058777ba0543d061ae94e5e09c58ed06fb88d5dac2637d147a84","first_seen":"2023-04-06T20:46:16Z","last_seen":"2026-09-15T18:41:43.918494Z","times_seen":261,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2024/04/styling-shooting-villa-aurelia-21.jpeg","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.759Z","timestamp":1789497659759,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2024/04/styling-shooting-villa-aurelia-21.jpeg HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nCookie: _ga_L4DC0WJ05F=GS2.1.s1789497659$o1$g0$t1789497659$j60$l0$h0; _ga=GA1.1.887502287.1789497660\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HVNbJkFR020D7N%2FTAwKGLvfy4cnKAL8Myfrp%2BdG%2B6E1iBKuTuMqjIGdS%2B5TJbxQJ57rWUJ5FNmT2SKzprC%2BnWtjHyNNvAcIY3EUrE%2FjJJ%2BjLHSlKoCJ4xzbQZ8F3jz1y\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/jpeg\r\npriority: u=5,i\r\ncf-ray: a3b9c3558a11ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 781\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\netag: W/\"66311c77-c96e\"\r\nexpires: Wed, 13 Jan 2027 18:27:58 GMT\r\nlast-modified: Tue, 30 Apr 2024 16:29:43 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":51566,"size_decoded":49171,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 1024x683, components 3","md5":"d1db1398718348f315a70eb882964c10","sha1":"1446b144efc6b19b36256420b5ea0df8a2ebfdfc","sha256":"94b2413f954efe0ec979674fcee54cdd9b87642f06e91f233f1a28e6544479f0","sha512":"7dc3d32df476e8b8f38af30dd44b0978a857739d60fdebdd0b041c3245ceab8606a465e697cb039a9101d7c1748a4c06426263f1758cfa051090245656a9cd42","ssdeep":"768:shuemu4edhKtb58uSocOiUx113moq/dTl3st5FJhnVrT6sd6bOHj89:shuemuRgBSNCvWoq1OrFFIKDw","tlshash":"3a33f1666d709406c392125864dc2bdbf190e6f86f52c83e3edda2ea6381f77bd09460","first_seen":"2026-09-15T18:41:43.920702Z","last_seen":"2026-09-15T18:41:43.920702Z","times_seen":1,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2022/12/elopement-in-rome-36.jpg","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.760Z","timestamp":1789497659760,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2022/12/elopement-in-rome-36.jpg HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nCookie: _ga_L4DC0WJ05F=GS2.1.s1789497659$o1$g0$t1789497659$j60$l0$h0; _ga=GA1.1.887502287.1789497660\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PWYCiE0jm%2BMaPLai6R0DFL58zFWuvnkoyNALJCnbtWRKlrqmpuncx1z6LIPnUGQJykknY8VanzzlAwrbKudomUUYj7wwAs7VaTfY5oZzPNKGa%2F3IWvnqwDZIOLtifyUh\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/jpeg\r\npriority: u=5,i\r\ncf-ray: a3b9c3558a12ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 782\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\netag: W/\"63a6dcee-113a9\"\r\nexpires: Wed, 13 Jan 2027 18:27:56 GMT\r\nlast-modified: Sat, 24 Dec 2022 11:05:18 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":70569,"size_decoded":70292,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 683x1024, components 3","md5":"5db2092df1aaaa760da8a24d7583f654","sha1":"ce9154d6b86055757e5db0844bb6f01031c92505","sha256":"7b3f016ddead6253045e1a4b979cc86843e8757960b6125738d994f405169331","sha512":"380a4ee8d18e9ab67d6078e3a9741e6ef284b32dd33d325f3522fc9830b0fabf17356baa5e0f2756949509f26958f63860ea5be3c194554ae35fa6934d7730bd","ssdeep":"1536:OHlAD0KWysphBZ6OFG4ldbfjs4ssuJK82KskA9fDMlnkxfzf0X:CCDBWZ8tn4ssuJUPF9LMln2zfo","tlshash":"3663f19760bafe0fecb62733e0125639a125ba68b6864837c0772191dd9f3d18d9cb11","first_seen":"2026-09-15T18:41:43.922964Z","last_seen":"2026-09-15T18:41:43.922964Z","times_seen":1,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2022/11/Matrimonio-Donna-Camilla-Savelli_-57.jpg","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.761Z","timestamp":1789497659761,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2022/11/Matrimonio-Donna-Camilla-Savelli_-57.jpg HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nCookie: _ga_L4DC0WJ05F=GS2.1.s1789497659$o1$g0$t1789497659$j60$l0$h0; _ga=GA1.1.887502287.1789497660\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ExZOXIQua3snV50JlmTSgdCp5FOOt5RZk9BlnNVT0kNoMk1NUCiNlf9WZ7Bs%2F%2B06TcLOJNgxcUt4RTPs1CpmkvwQBhe49L3On6eU1mWbJjM9A3dOyITd2L1tWup1tH%2Fb\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/jpeg\r\npriority: u=5,i\r\ncf-ray: a3b9c3558a13ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 781\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\netag: W/\"636f8cf9-1a687\"\r\nexpires: Wed, 13 Jan 2027 18:27:57 GMT\r\nlast-modified: Sat, 12 Nov 2022 12:09:29 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":108167,"size_decoded":108489,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 683x1024, components 3","md5":"8284791b8342ad806a276a810c70eed6","sha1":"63f7d629adbfda7f8f05b20320432d02c881dae0","sha256":"2e05a71ddb7a00b3c524c528ef37abb6573f96473256604fcfb44e8592436858","sha512":"421ca185b40d10ffc4f8af75346543bc5d73ab8042bfa70c4358942688064cc14ac0c11f9e3f999ffaffc132f0738cbc1ffb95cc408c5d1c342c0d18b28e75b5","ssdeep":"3072:4Ilf+7ItUYdPzR7xNkcyhUETiqefDamh5QMlTQ:JCWxnNLlETq+mhBlTQ","tlshash":"61b3122beb13f923d6a88f3210acf6f45432350d7a5683ef0f553e66366508d940975e","first_seen":"2026-09-15T18:41:43.925577Z","last_seen":"2026-09-15T18:41:43.925577Z","times_seen":1,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2021/08/Fotografo-Matrimonio-Villa-di-Fiorano-18.jpg","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.766Z","timestamp":1789497659766,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2021/08/Fotografo-Matrimonio-Villa-di-Fiorano-18.jpg HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nCookie: _ga_L4DC0WJ05F=GS2.1.s1789497659$o1$g0$t1789497659$j60$l0$h0; _ga=GA1.1.887502287.1789497660\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V47Ku%2FICfC98HMbJ6uju4B9gG2CtFdEYrRbUQSwMfyDXmYCZ3v3zwYNnNitrImicOsAM194IHHX94Oae3As1PFWGfYtDCC4FlfsDWdkZT6ExsuHAXp72Dp6prbnctZOC\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/jpeg\r\npriority: u=5,i\r\ncf-ray: a3b9c3559a18ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 781\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\netag: W/\"612e4a3d-103a1\"\r\nexpires: Wed, 13 Jan 2027 18:27:57 GMT\r\nlast-modified: Tue, 31 Aug 2021 15:26:53 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":66465,"size_decoded":66668,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1024x683, components 3","md5":"a2d99e2f0221d068e518d56dbe529980","sha1":"9c4e07ccfac47d146dca03e35cbc3745814196a4","sha256":"cd99a4c7461881cfba63dabd3174a3da49fb8ca018ad40b9099b637091ad1807","sha512":"2ed040f2947882bd609a2814a4aab0279305e94abd824f5df6ac72cf513bb2e401b3779208f361997c8cb095ede90eebd316adf26b805a078d08e9f8f1c2f56e","ssdeep":"1536:K7hEGE9EcRCdwLLFKfgKqtdrVhSGYj9rbq7L+:KqGPCCmHFKCtt7HmRt","tlshash":"10530296d7bba850fe85e1f246ec1e28599ecf39bbc1c84074333164854d4426bc5a7f","first_seen":"2026-09-15T18:41:43.928127Z","last_seen":"2026-09-15T18:41:43.928127Z","times_seen":1,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/iubenda_i_badge.css","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.918Z","timestamp":1789497659918,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.iubenda.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 04 Mar 2026 00:00:00 GMT","end":"Sun, 31 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"48:E7:8A:F5:24:9E:68:9C:AF:66:4E:E2:EE:C3:90:B8:84:A1:8D:4C","sha256":"43:20:4D:9B:97:2D:E4:EF:E6:8F:71:78:B9:81:E9:96:BD:9B:75:C3:A5:EC:88:84:00:DD:76:5A:3C:DC:A3:3C"}}},"request":{"raw":"GET /iubenda_i_badge.css HTTP/1.1\r\nHost: cdn.iubenda.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: text/css\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 954456\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=3600, public, must-revalidate, proxy-revalidate\r\ncontent-encoding: zstd\r\netag: \"6aa91f6d-73d\"\r\nexpires: Tue, 15 Sep 2026 13:04:12 GMT\r\nlast-modified: Tue, 15 Sep 2026 10:35:25 GMT\r\np3p: CP=\"DSP NOI COR\", policyref=\"http://www.iubenda.com/w3c/p3p.xml\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/15/2026 12:04:12\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 00e07d630bcb2030ccec888bbd7c394a\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1853,"size_decoded":1464,"mime_type":"text/css","magic":"ASCII text, with very long lines (1852)","md5":"48cfb4202078443b0b9cb34010a6dce1","sha1":"f7de749f48f7e56fb3b6651aa2e9aa8ff7b5e1d0","sha256":"b47704effd782b40055c0b5972c78c1dc9af29dd1440617ae628031d0dfb6757","sha512":"2396f03c41e1afa8023981d338976859a1449519235345c99727431d32a6db47cf5776c6cbc2cc9a029433077814e4c47b578ba7a59e999e9cc2402ab978a9e2","ssdeep":"","tlshash":"4b310f308f01129eb823e7199620b8da62b3d891d5425a7d7676f7b4ef830f78192b12","first_seen":"2025-08-08T19:50:57.11951Z","last_seen":"2026-09-15T18:56:04.712666Z","times_seen":21763,"resource_available":false,"data":null}},"time_used":3,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/icon_green_mini.png","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.931Z","timestamp":1789497659931,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.iubenda.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 04 Mar 2026 00:00:00 GMT","end":"Sun, 31 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"48:E7:8A:F5:24:9E:68:9C:AF:66:4E:E2:EE:C3:90:B8:84:A1:8D:4C","sha256":"43:20:4D:9B:97:2D:E4:EF:E6:8F:71:78:B9:81:E9:96:BD:9B:75:C3:A5:EC:88:84:00:DD:76:5A:3C:DC:A3:3C"}}},"request":{"raw":"GET /icon_green_mini.png HTTP/1.1\r\nHost: cdn.iubenda.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cdn.iubenda.com/iubenda_i_badge.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 595\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 954456\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-origin: *\r\ncache-control: max-age=3600, public, must-revalidate, proxy-revalidate\r\netag: \"6aa91f6d-253\"\r\nexpires: Tue, 15 Sep 2026 13:04:12 GMT\r\nlast-modified: Tue, 15 Sep 2026 10:35:25 GMT\r\np3p: CP=\"DSP NOI COR\", policyref=\"http://www.iubenda.com/w3c/p3p.xml\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/15/2026 12:04:12\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 3ad7875d024be5cdd73a5c56582991ff\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":595,"size_decoded":1395,"mime_type":"image/png","magic":"PNG image data, 13 x 28, 8-bit/color RGBA, non-interlaced","md5":"2b18261d5edd28ec21c74b4761ce8a4b","sha1":"d1d719b76c45a198dd240c38d9c33efff6017e4b","sha256":"304edb939beda5e2f3fddab0c71a859ddde3ef12ca89b14530b5025bdcc7c024","sha512":"460b500558d5d305efb54ac71fe6e278e3fbea5c8783784cf394eac5a16a7560c4f23daef212862467f3d56cb758fbe876def4a9d00fdf5943a233242e64d8b5","ssdeep":"","tlshash":"fcf047e914025865e5c12a5d439c681059a737bb6330622c6dcdf01775d9e7a2140356","first_seen":"2023-05-12T17:54:21Z","last_seen":"2026-09-15T18:41:43.932332Z","times_seen":408,"resource_available":false,"data":null}},"time_used":4,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-includes/css/dashicons.min.css","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.042Z","timestamp":1789497659042,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-includes/css/dashicons.min.css HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9YSHyV2zW4x3YM1Hi%2BVqHUf6jZi6D3MpmbYZ282KsVIt%2F7FDloTAP0Vp9byD%2FsnbX64WLTjClh2oQ71GGc5JNJ97Jbz8h9ersi0fewAACjA0Np8aCL9Zxvv21B9QWcKd\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c35118d6ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 801\r\ncache-control: public, max-age=31536000\r\ncontent-encoding: br\r\netag: W/\"6077ce38-e688\"\r\nexpires: Wed, 15 Sep 2027 18:27:37 GMT\r\nlast-modified: Thu, 15 Apr 2021 05:25:12 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":59016,"size_decoded":35880,"mime_type":"text/css","magic":"ASCII text, with very long lines (58981)","md5":"d68d6bf519169d86e155bad0bed833f8","sha1":"27ba9c67d0e775fc4e6dd62011daf4c3902698fc","sha256":"c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e","sha512":"fd0956d1a7165e61348fda53d859493a094d5a669aa0ba648be3381b02ed170efd776704af6965f1e31143f510172ee941d4f2fc32c4751d9b8763b66301486d","ssdeep":"768:oey/Z24B3P3aXOhUzSv16CAyLquqSfurIdUMbs73KO08QSJ2BQH02CRqxMWs5rJq:ox/ZvB/qPWMiquqioMUXQSJYIMW+rJq","tlshash":"9c43c2b1a74a40d677b0c843af65b26a5582bd7df8409cdef40b821c1af3635069dfb8","first_seen":"2023-04-05T05:16:42Z","last_seen":"2026-09-15T20:45:21.900218Z","times_seen":135397,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/themes/lyra/theme-files/public/fonts/default/Stylekit-1/Poppins-Medium.woff","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.242Z","timestamp":1789497659242,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/themes/lyra/theme-files/public/fonts/default/Stylekit-1/Poppins-Medium.woff HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rawtales.live/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c352592fee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 799\r\ncache-control: max-age=10368000\r\netag: \"6a469fb2-10b04\"\r\nexpires: Wed, 13 Jan 2027 18:27:38 GMT\r\nlast-modified: Thu, 02 Jul 2026 17:28:18 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CRJ7OMMr2F7ZLUyyyL%2BlBnvGV4O3XvHN3AWC9cZaSWGUza7YX69j2UPXNsB%2FUg4LS8BfQxl07UXe1lUKXwx4oAexB%2F764d1zuMyFIynhgfnGF44JK%2F4HDLXM8fokLud1\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 68356\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68356,"size_decoded":69121,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 68356, version 0.0","md5":"896fb06c7b3bead35bb2fbe6be7d8b54","sha1":"5fd34acb5d590d495415c8045f49533d4cfb6798","sha256":"6dfdf411a70ae4d26942efdf1034e66976435758d29f2a7d556d77e08b9e2412","sha512":"a6367dfb471742fdf96a60d4454d7078005d6820841474b365bfdef8f55c48ba546126581eefd5a405f6b99384e5dca8cf2b2a344e98710028b4732f5b84dea7","ssdeep":"1536:RzxyCka0UoOqKixt5EQkxykWrZYOv+rCa2+J:hxua0eRixrJHFfYCF+J","tlshash":"d4631222c0ef459afb442fb9e47e0da64a819fd787dd39b90f1cb432d449168e309359","first_seen":"2023-04-19T13:33:03Z","last_seen":"2026-09-15T18:41:43.936406Z","times_seen":442,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=UA-155033732-1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.243Z","timestamp":1789497659243,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:37:41 GMT","end":"Mon, 02 Nov 2026 08:37:40 GMT"},"fingerprint":{"sha1":"DC:E6:38:9B:82:DB:20:21:19:E7:95:FC:30:E0:F0:F4:BC:CA:9A:1C","sha256":"2C:0E:42:66:EE:BA:84:59:3C:53:EB:87:C0:84:DD:32:F4:42:73:26:47:8C:4E:56:F9:5B:47:6C:AF:BA:C2:F9"}}},"request":{"raw":"GET /gtag/js?id=UA-155033732-1 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\nexpires: Tue, 15 Sep 2026 18:40:59 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 134854\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":382593,"size_decoded":135458,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (4998)","md5":"2466819d2ae6c82390d66ce509637df7","sha1":"e3c83354ca318b1fe61cd4996135e380ad405bd1","sha256":"e286bc19f76b6aac4292e087068a0d5b1a85a39118cd7572fba59701351c8fdf","sha512":"c0603e9e4cb9dab97a4a9e061200e8d1738c25c1177c5efe543d9b45934425ab9ef203353ddab7ba7a4a1d54ae1f41b75a51bfff71c4cb4b5eb93923e7de60c0","ssdeep":"6144:ehn1KcIpPImOh9mHFLgycRtbJEqq3RtWWfA7y23fHdr:eGH+5WYxP5","tlshash":"838408ccb7d6742283a3b574503f018bb27a69a2b84cc898f286ddd42e3465a5177f7c","first_seen":"2026-09-15T18:41:43.939247Z","last_seen":"2026-09-15T18:41:43.939247Z","times_seen":1,"resource_available":true,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":41,"receive":49,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/flex/fonts/Poppins-Medium.woff","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.390Z","timestamp":1789497659390,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/flex/fonts/Poppins-Medium.woff HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3b9c353396dee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 796\r\ncache-control: max-age=10368000\r\netag: \"5fe9d513-10b04\"\r\nexpires: Wed, 13 Jan 2027 18:27:41 GMT\r\nlast-modified: Mon, 28 Dec 2020 12:52:35 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PoaycpRr9Rfz0ATJP0S2wVByMyZWakfkBNH9LyZxZMs5KpQLSlneNQNvTng5kK7tCQ92mNzqKYH9GH9SHpSi9B6pDBFjduLa0YGsT2zD2ztlbKJrXGfwKg8ha%2FXXsLYf\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 68356\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":68356,"size_decoded":69115,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 68356, version 0.0","md5":"896fb06c7b3bead35bb2fbe6be7d8b54","sha1":"5fd34acb5d590d495415c8045f49533d4cfb6798","sha256":"6dfdf411a70ae4d26942efdf1034e66976435758d29f2a7d556d77e08b9e2412","sha512":"a6367dfb471742fdf96a60d4454d7078005d6820841474b365bfdef8f55c48ba546126581eefd5a405f6b99384e5dca8cf2b2a344e98710028b4732f5b84dea7","ssdeep":"1536:RzxyCka0UoOqKixt5EQkxykWrZYOv+rCa2+J:hxua0eRixrJHFfYCF+J","tlshash":"d4631222c0ef459afb442fb9e47e0da64a819fd787dd39b90f1cb432d449168e309359","first_seen":"2023-04-19T13:33:03Z","last_seen":"2026-09-15T18:41:43.936406Z","times_seen":442,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/themes/lyra/theme-files/public/fonts/fontello/font/flo-icons.woff2?27082654","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.236Z","timestamp":1789497659236,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/themes/lyra/theme-files/public/fonts/fontello/font/flo-icons.woff2?27082654 HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rawtales.live/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff2\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c3524927ee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 799\r\ncache-control: max-age=10368000\r\netag: \"6a469fb2-1eb4\"\r\nexpires: Wed, 13 Jan 2027 18:27:38 GMT\r\nlast-modified: Thu, 02 Jul 2026 17:28:18 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IZngGoXhbRuxZVVSYr75zOFqWJ2qiZsJdk%2Fc%2FDV2uNW3eYAoI3iObMvuV5kPK%2Fgjn5qLNirKuj0FoQ2ux2vQae7PZFJas7Y%2FMbMnhgSc7oyL8j0w4q%2BA7aNG9IySt%2FII\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7860\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7860,"size_decoded":8628,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7860, version 1.0","md5":"769eeee7c835ed7dde05ea878a1066df","sha1":"7b7b504a1e01800b2c302694b8a883c73aa08557","sha256":"3cf82b95c4c1e3f2f07381de876b7186bb31123c2568946f5fca1a2ac84a1edc","sha512":"4ec4866e2e5f29c12f2d9159e3fd850be915b6208fcaa96d40f3c520acc1eabc2c386273d6a9934a5b9d2d03ced2ba812ef79a38d1aac1f7ca20c0b8968bc285","ssdeep":"96:wjtPk4ql0WchVA0G0vtRXcsi4r3IVFEb3W4ZGOI+fWLi1RE0ETWl47GQyeqTkjCE:WzXVBG0bMsxbIVM3lGaTRXhQyeWDZUXV","tlshash":"a9f1bf1c2355db63f0b1b97e0a948051b739fc8d495afaa4840fca4e8f763bfc421224","first_seen":"2023-11-27T11:52:45Z","last_seen":"2026-09-15T18:41:43.941577Z","times_seen":23,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/themes/lyra/theme-files/public/fonts/default/Stylekit-1/Roboto-Regular.woff","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.241Z","timestamp":1789497659241,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/themes/lyra/theme-files/public/fonts/default/Stylekit-1/Roboto-Regular.woff HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rawtales.live/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c352492dee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 793\r\ncache-control: max-age=10368000\r\netag: \"6a469fb2-16ccc\"\r\nexpires: Wed, 13 Jan 2027 18:27:45 GMT\r\nlast-modified: Thu, 02 Jul 2026 17:28:18 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xxGolMBju9OZr3ymOTIDqJGjtuAa%2BuvQ9gCZlx5VMRvW066CTMmFwx3IwCyZ77D60%2FIo%2Fye9cn%2Bkjdi6EeNszYPqN9aMNwGUdBo7ifVN5ZzkJCqfZBEWdqCPD6gbRcve\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 93388\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":93388,"size_decoded":94153,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 93388, version 0.0","md5":"94dac78eee406a8c8f0406b69b85ac2b","sha1":"e9e77fc073e302b714e30698276fad6adaf179cd","sha256":"18ab5ae448dcec1f31abbbaa7dce8dcb1d890479f1bc4670a89c95f10063cf3e","sha512":"ce66be3046a71d53f78cca307c08c36341045ecbaca317a5cd90ad9f749158f213901208e73361223be4ff50c0c34dd172a015116bb16c753476843ea97b7adc","ssdeep":"1536:hPsAKi/Zo1QIvgyHUOhuCnN1XQh8CZuZGSu475n58Dj+ARY3niXdWowsO:BsVi/SpvrHgCXpquo475n5uj+AR8nwdc","tlshash":"29930286d3c7b47a3e1e037d994692ca12b184a3a86d489fbd1bc24898c6b0dfc5d265","first_seen":"2023-04-06T20:46:16Z","last_seen":"2026-09-15T20:29:25.739747Z","times_seen":1845,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/plugins/wp-performance-score-booster//assets/js/page-preloader.js","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.245Z","timestamp":1789497659245,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/plugins/wp-performance-score-booster//assets/js/page-preloader.js HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-encoding: zstd\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\ncache-control: public, max-age=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9MGga5uW0%2B2OP%2BItKw0SxGMVaFTz%2BzFp6q8Pe1zCSh5ZPFFsweGbwzxBoVhd6JM6ollosQBa8WFWS8%2FAMlYtzi9h9R84R3%2BWvhfynQn%2FZDNoJP9qJIjRAIClkwpwqFVl\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a3b9c3525932ee1a-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3051,"size_decoded":1961,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2959)","md5":"e8cc2683737633b8ec0a7b6f8d3dac68","sha1":"928b3fc955ce4166c9bf424bf0a38930b2f8557b","sha256":"8b3644ac5b264c8d3d09222feeea6aa208432f4e46900037dd60bc9834b3c250","sha512":"99f91f1637350e153a35d33de3cf4224b5deb40af63a7b07045c73b87caed9c1f852dcc2907c8e5eefeebe3b7634f50f091b89281099ec99765bb306c689297d","ssdeep":"","tlshash":"235150e9b21221b601f657f621ffa380b635214530039021587e9cd85e3ffea2253e6f","first_seen":"2023-03-30T00:01:52Z","last_seen":"2026-09-15T18:41:43.945122Z","times_seen":4303,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/flex/fonts/Roboto-Regular.woff","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.388Z","timestamp":1789497659388,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/flex/fonts/Roboto-Regular.woff HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3b9c353396bee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 800\r\ncache-control: max-age=10368000\r\netag: \"5fe9d513-16ccc\"\r\nexpires: Wed, 13 Jan 2027 18:27:39 GMT\r\nlast-modified: Mon, 28 Dec 2020 12:52:35 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b58QNZs1Jw7jR52hlpLcZvIqtgspTbv4rZQ3faP3EWrBVLWJ%2B4Cxd1J0RyT98DNUzCDE%2FmLCKuf9s1aeO85Cn3PqI%2BhBWy4bZGePrngIum6WGbhS81HQPof5BEjqpj7J\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 93388\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":93388,"size_decoded":94151,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 93388, version 0.0","md5":"94dac78eee406a8c8f0406b69b85ac2b","sha1":"e9e77fc073e302b714e30698276fad6adaf179cd","sha256":"18ab5ae448dcec1f31abbbaa7dce8dcb1d890479f1bc4670a89c95f10063cf3e","sha512":"ce66be3046a71d53f78cca307c08c36341045ecbaca317a5cd90ad9f749158f213901208e73361223be4ff50c0c34dd172a015116bb16c753476843ea97b7adc","ssdeep":"1536:hPsAKi/Zo1QIvgyHUOhuCnN1XQh8CZuZGSu475n58Dj+ARY3niXdWowsO:BsVi/SpvrHgCXpquo475n5uj+AR8nwdc","tlshash":"29930286d3c7b47a3e1e037d994692ca12b184a3a86d489fbd1bc24898c6b0dfc5d265","first_seen":"2023-04-06T20:46:16Z","last_seen":"2026-09-15T20:29:25.739747Z","times_seen":1845,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/cookie_solution/iubenda_cs/1.106.0/core-it.js","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.400Z","timestamp":1789497659400,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.iubenda.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 04 Mar 2026 00:00:00 GMT","end":"Sun, 31 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"48:E7:8A:F5:24:9E:68:9C:AF:66:4E:E2:EE:C3:90:B8:84:A1:8D:4C","sha256":"43:20:4D:9B:97:2D:E4:EF:E6:8F:71:78:B9:81:E9:96:BD:9B:75:C3:A5:EC:88:84:00:DD:76:5A:3C:DC:A3:3C"}}},"request":{"raw":"GET /cookie_solution/iubenda_cs/1.106.0/core-it.js HTTP/1.1\r\nHost: cdn.iubenda.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 954456\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=31536000, public, must-revalidate, proxy-revalidate\r\ncontent-encoding: zstd\r\netag: \"6aa91f63-6d6ae\"\r\nexpires: Wed, 15 Sep 2027 11:57:40 GMT\r\nlast-modified: Tue, 15 Sep 2026 10:35:15 GMT\r\np3p: CP=\"DSP NOI COR\", policyref=\"http://www.iubenda.com/w3c/p3p.xml\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/15/2026 11:57:40\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 1fe961d72123ce9b24ecb0cd2f4efcc3\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":448174,"size_decoded":115169,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65479), with no line terminators","md5":"f0dfd29812d630908c222357c2dc9f30","sha1":"ee6a34d60afa86b157471d3a731e05e68ae6d771","sha256":"7f917ad65e7224b9b787bab6cbd1ec5461ce98124234a3013ff70dbcdef0358f","sha512":"39a29f5bd105a1ebf91e0f1e295789b15db6716060e395af60922a054fd2383348a73282243e012a94b0f0783ca6fe18a70468f3b6207411ee1e0482d213ae2c","ssdeep":"6144:vd6kuOyznbBFYGvHZcETxm5F8lkUK6s18viyT7qVAKQu84g+aifbKXvkR9CxIyFA:vQjr41UeCxIyF/I","tlshash":"c394f845b381713406d3a168083b131ea13b75549686c5bcf436ead42f98fceb1abf7a","first_seen":"2026-09-15T16:54:23.946776Z","last_seen":"2026-09-15T18:41:43.945909Z","times_seen":2,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"idb.iubenda.com/csdata?db=hits1","fqdn":"idb.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.843Z","timestamp":1789497659843,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.iubenda.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 04 Mar 2026 00:00:00 GMT","end":"Sun, 31 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"48:E7:8A:F5:24:9E:68:9C:AF:66:4E:E2:EE:C3:90:B8:84:A1:8D:4C","sha256":"43:20:4D:9B:97:2D:E4:EF:E6:8F:71:78:B9:81:E9:96:BD:9B:75:C3:A5:EC:88:84:00:DD:76:5A:3C:DC:A3:3C"}}},"request":{"raw":"POST /csdata?db=hits1 HTTP/1.1\r\nHost: idb.iubenda.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 45\r\nOrigin: https://rawtales.live\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":45,"data":"hits,cp=22163588,uiv=1,pv_nocs=1,sf=1 value=1"}},"response":{"raw":"HTTP/2 204 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 967785\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 1728000\r\ncache-control: public, max-age=0\r\nx-influxdb-build: OSS\r\nx-influxdb-version: v2.8.0\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 204\r\ncdn-cachedat: 09/15/2026 18:40:59\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 272d0f645f8219c5a7f4a2c9ba126419\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":1355,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-15T20:51:43.703029Z","times_seen":18482263,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":0,"dns":42,"connect":14,"send":0,"wait":31,"receive":0,"ssl":9},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/cache/autoptimize/css/autoptimize_b97e46b2931e564b4968d25b98b68447.css","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.040Z","timestamp":1789497659040,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/cache/autoptimize/css/autoptimize_b97e46b2931e564b4968d25b98b68447.css HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DmhOQ3kcK8rMzTLz3YcuVIeR0wnEP6J0Qyom%2B4Y7i8C3NssP82%2FV32DG8%2B1caImaB8Ihdu8vcHSRwdXam5Sto57XfqchaLZ%2BvV4x%2BliFALtt605%2FUtaQtT7eeHr2hXun\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c35108d4ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 801\r\ncache-control: public, max-age=30672000, immutable\r\ncontent-encoding: br\r\netag: W/\"6a7a98a2-9984c\"\r\nexpires: Sun, 05 Sep 2027 18:27:37 GMT\r\nlast-modified: Tue, 11 Aug 2026 03:36:02 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":628856,"size_decoded":71729,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"3b57db6229f8938693d133c9d8f16f54","sha1":"2e7e94a5d5614e901121fae84afaa3067800c9c2","sha256":"2146b0a9c5edf769c2a1e3b0ae93f1e70583159ff2379709e2fbe1464de0b805","sha512":"f7590e7d5fd29111bd7cebb247fb04181e4b81ef7a5b46347d6b49bf28af03d48990e0a0c55e5a0bcbce7337c575231f0edd19f7689bd0e45f1e0be984b5247a","ssdeep":"12288:Kk+bM2u5SOV+UQ3Zo/xHANYWI2cPf8uQ36+:Kkd2u5SOV+UQ3Zo/xHANYWI2cPf8uQ3b","tlshash":"ebd409a9a330359c142f87168bcee16c5235d801da1256eef1b6e16493cfb8419f2bdf","first_seen":"2026-09-15T18:28:22.715216Z","last_seen":"2026-09-15T18:41:43.948496Z","times_seen":2,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/flex/fonts/Steelfish-Bold.woff","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.478Z","timestamp":1789497659478,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/flex/fonts/Steelfish-Bold.woff HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff\r\npriority: u=3,i=?0\r\ncf-ray: a3b9c353c98dee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 793\r\ncache-control: max-age=10368000\r\netag: \"5fe9d513-f47c\"\r\nexpires: Wed, 13 Jan 2027 18:27:44 GMT\r\nlast-modified: Mon, 28 Dec 2020 12:52:35 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eXYDLHzhN%2B9kvUI3bkN09pQF1QZ4OGnULFFDcV5uFJlSSGSBh3QFtlH8ICqZcKr7GbK2kV06JkV4gFZgi7q%2BF68KhS8lE3MjffFevBrXayslmPaTUKZGXFWjUAp4dYtT\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 62588\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":62588,"size_decoded":63348,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 62588, version 6.0","md5":"8a7643fa221d945ff8758df425c3d155","sha1":"983fda585d7f83f53380f2ee94452845ba813194","sha256":"d86be0f9689e3a1e8b1c59278dd545e754895865deb5f790352e3325aec5e592","sha512":"73b9af3a03d29943475b39e5d370d0ab4570f984a38b00145f6a0124a4921a3c5558f75f59db0ccb1be0c6773807100f823481bd8667519d1e9723061af0621b","ssdeep":"1536:K6UWFAUEq1AqC8Vv10CvFeHJx1sKqV+kFYYamhMHQxf5/aC83:Y4/zC8V90Cv+7SVHV5hMHQxf5/dI","tlshash":"7f53f1d5c1a428dfd59f96f3c9a34f26c112c2371c6881e2199be3c25fba76381ac2d1","first_seen":"2026-05-31T05:21:10.5374Z","last_seen":"2026-09-15T18:41:43.916751Z","times_seen":2,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":37,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-L4DC0WJ05F","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.234Z","timestamp":1789497659234,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:37:41 GMT","end":"Mon, 02 Nov 2026 08:37:40 GMT"},"fingerprint":{"sha1":"DC:E6:38:9B:82:DB:20:21:19:E7:95:FC:30:E0:F0:F4:BC:CA:9A:1C","sha256":"2C:0E:42:66:EE:BA:84:59:3C:53:EB:87:C0:84:DD:32:F4:42:73:26:47:8C:4E:56:F9:5B:47:6C:AF:BA:C2:F9"}}},"request":{"raw":"GET /gtag/js?id=G-L4DC0WJ05F HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\nexpires: Tue, 15 Sep 2026 18:40:59 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 175619\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":525664,"size_decoded":176223,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6698)","md5":"544bcf832f785fa50f0cb46ce45b03b7","sha1":"90e58755e38c730433e5ca268a3dc79301964655","sha256":"009a3004f819ff7e699f0db4d2e7cdf92532bf3e0767c4f24af2256d345e832c","sha512":"9e4aa38b5dfd7901ae9621bb80aa61bb9291a800bd5fc5ca966d4741f2ee762887281d7d594e6f0abe045bd78cf2995a44700b50ec88dbcbfbad3dfcc3f8e850","ssdeep":"6144:UwXn1KcIGUPWmJhgYcYnsLg2cRtbJEqq3RtwfzA1y2EIwtgT84ifr:n88seoJfUHEIw","tlshash":"86b408ce73c674229396f174903f018ba97b28a2b45cc89af289dce42d3465a5177f7c","first_seen":"2026-09-15T18:28:22.720497Z","last_seen":"2026-09-15T18:41:43.950061Z","times_seen":2,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":3,"connect":15,"send":0,"wait":63,"receive":40,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/themes/lyra/public/fonts/fontello/font/flo-core-icons.woff2?21553760","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.237Z","timestamp":1789497659237,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/themes/lyra/public/fonts/fontello/font/flo-core-icons.woff2?21553760 HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rawtales.live/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: font/woff2\r\npriority: u=2,i=?0\r\ncf-ray: a3b9c3524928ee1a-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 799\r\ncache-control: max-age=10368000\r\netag: \"6a469fb2-ba8\"\r\nexpires: Wed, 13 Jan 2027 18:27:39 GMT\r\nlast-modified: Thu, 02 Jul 2026 17:28:18 GMT\r\nserver: cloudflare\r\nx-powered-by: PleskLin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HPb9J7UwYbtyIDbBe7DtWipE6I2dKQO17vlLXFK1h4r0tocZo%2FVEb7IM2hxGIlPwR24t8fMQosyyR2yt3UsS2ALX%2BFs3ZX0ShaEbR1eT5WZ5EePjZJ6nuvmBO7MCRwO9\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2984\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2984,"size_decoded":3743,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 2984, version 1.0","md5":"8c7188797c9218dd4740ac4fc9b0da16","sha1":"20db876e232cb7f0d17ca972377eea8d58b59108","sha256":"fe9d1e2030d8d6f5956fc11da153e95644dc79e9e8c9b40babf6ee2bfc573209","sha512":"f51516f530ca626df1402d7f9a7cec01067069e4787b650b76a6491ef0e7dd72952a5316ad9c19c0f631408b5101d1f210db45114c0877ff82b577bf05384f69","ssdeep":"","tlshash":"c4514c7505eda4fae8ace33f69881f30c93be79e5c2c6f664c460752af68101e0d2985","first_seen":"2023-05-10T10:30:17Z","last_seen":"2026-09-15T18:41:43.951455Z","times_seen":23,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/cache/autoptimize/js/autoptimize_d4a39ac9d33f52bad142f831c70beccf.js","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.246Z","timestamp":1789497659246,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/cache/autoptimize/js/autoptimize_d4a39ac9d33f52bad142f831c70beccf.js HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-encoding: zstd\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\ncache-control: public, max-age=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cmuLCOr5dLD24F6rtZV4f8I5ZQVbq6CSG2iWkFqBgBAX%2FZx1OzgMagysvRXx4a7jcdjaBjaEsnO48So8v3bkhZUSBqKz30KjFCuNlJJ0OrU0pskwRWZAFHP7U2K1P5ku\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a3b9c3525935ee1a-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":536243,"size_decoded":147303,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (52033)","md5":"155ff0c42091342c82891f8a3c5cd175","sha1":"46688df412314bf56e765f595d337486391b94c4","sha256":"57d209eb94f73d1c8441ad59ba7f41f0f4076fa6dd5261f87b2f12bd64510053","sha512":"284d46a8bf2f850acdd225e1eb1e5f0fa828bc129a11495d191c56331237b2cbc9a2c667fccfb365d88fd46d193ec3f691af4ceaef72e1c1a44e9d19d0c01dab","ssdeep":"6144:r9P4sZCwe4YxoD9fGevmRzMSZfupgbJUlNyYMZlvIqxGcTJ7PBTkW7kjVxaVwqyj:hPdwxM9Cffly","tlshash":"83b4094db240352142ff62b5102f420eb2336569b506c498b179c9fa6dbce8962f7fbd","first_seen":"2026-09-15T18:41:43.95341Z","last_seen":"2026-09-15T18:41:43.95341Z","times_seen":1,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2019/12/RT-ICO3232.png","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.584Z","timestamp":1789497659584,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2019/12/RT-ICO3232.png HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s86xZVc3a0VlnId6Kkhe2cshO77QTMQSS0jOFJItIcECw7LEBwmcUcIx1XtW%2BzLuu2yrdMvjU%2BxUzyAWurwgOjfXo5rX355V15hAhoJaHiL14dSIRkstdu6DA2hX8Oq4\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/png\r\npriority: u=6,i=?0\r\ncf-ray: a3b9c35479bfee1a-CPH\r\ncf-cache-status: HIT\r\nage: 790\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\nexpires: Wed, 13 Jan 2027 18:27:48 GMT\r\nlast-modified: Tue, 31 Dec 2019 12:25:37 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-accel-version: 0.01\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":534,"size_decoded":1345,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"3fed390fd1bdbd6249afe31490b01e8a","sha1":"b85160cd5672b97e8ba0e4e68946ab49fbb1c192","sha256":"8eda190d162906e498f262ead55dc4d7fc2a3059ea029b1e507995888f040953","sha512":"3517f110984fa8a54f0e9c901af8e01bec11a00683eae851c894868ff28bb86a53cb82714d23034db7e46721fb921fdea1f19997a6e716b05414ef24b5cde392","ssdeep":"","tlshash":"3ff075e4e2449f240232b512ed0745d184d7498a422f80dcf7b9307403f791675df787","first_seen":"2026-09-15T18:41:43.955398Z","last_seen":"2026-09-15T18:41:43.955398Z","times_seen":1,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2022/10/matrimonio-sabaudia-53.jpg","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.764Z","timestamp":1789497659764,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2022/10/matrimonio-sabaudia-53.jpg HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nCookie: _ga_L4DC0WJ05F=GS2.1.s1789497659$o1$g0$t1789497659$j60$l0$h0; _ga=GA1.1.887502287.1789497660\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0Ehg1gz1w%2BdCSReNgCHjDvRL44sgY%2BHHI5OA%2F8IwFPmxssAAtM8x%2FHulPbohdjsrz%2BmZkqtAlvVh2dPOew8vnM0cK4NjCnPc%2Fgh47bKGJwFEsJOvh0q1bBIv%2FaMTa2q5\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/jpeg\r\npriority: u=5,i\r\ncf-ray: a3b9c3559a16ee1a-CPH\r\ncf-cache-status: HIT\r\nage: 783\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\netag: W/\"633ef794-dc12\"\r\nexpires: Wed, 13 Jan 2027 18:27:56 GMT\r\nlast-modified: Thu, 06 Oct 2022 15:43:16 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":56338,"size_decoded":56537,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 683x1024, components 3","md5":"20e3928425deb24beae7581605701364","sha1":"5506f25c3234ec7c8b67981c2915c8a338fa3133","sha256":"b5edf5ecaacd7dc674647e8cb5cf223d09292b70741860164b632d6c716d3da2","sha512":"1dd972dd4272e5970f262b848519b88a174a1d1d5431e4801a6f4aa9a030bbea847d21e3e0eb935968b9590284f4643bfa228b82342f1642c7507498c72c2195","ssdeep":"768:XMqQZZSB7XhcFlctk87k9UcfIkCpQNs0J9nV3BCa9ptcjPoaSTLLDrWGtW5Gf:XM5ZsP8MNECpQ1nVxPBCPo5vaSgGf","tlshash":"dc43020353d987fac50b4aba827ad26c2120037e2f4ef6a4e2c44bc163d6776d7f5021","first_seen":"2026-09-15T18:41:43.957122Z","last_seen":"2026-09-15T18:41:43.957122Z","times_seen":1,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2024/11/matrimonio-la-librata-terracina-88.jpeg","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.767Z","timestamp":1789497659767,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2024/11/matrimonio-la-librata-terracina-88.jpeg HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nCookie: _ga_L4DC0WJ05F=GS2.1.s1789497659$o1$g0$t1789497659$j60$l0$h0; _ga=GA1.1.887502287.1789497660\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sRzP3G8hfT%2BF28AS0fSdrBfk4x7DcO3ZMW%2BKY6Fcq4%2FtxQrjnhMw08sjJleq9mYMFdo6DL2fJ3zsU4p%2BouoC%2F46vJtz7AxQGG6VBrX5KBXFUvJH3%2FYZOcDxt4q10KAQH\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/jpeg\r\npriority: u=5,i\r\ncf-ray: a3b9c3559a1aee1a-CPH\r\ncf-cache-status: HIT\r\nage: 782\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\netag: W/\"6733bd66-c4fa\"\r\nexpires: Wed, 13 Jan 2027 18:27:56 GMT\r\nlast-modified: Tue, 12 Nov 2024 20:41:10 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50426,"size_decoded":46229,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 683x1024, components 3","md5":"62ec247db2555550334a5ccd37fa6dc9","sha1":"18944b5ec6019dd82cb0f327b0648560425b5b54","sha256":"e80c190214872f56dd2c1e93c1ba625d43b4e6614aec93658433c43755ef4cd0","sha512":"08781e171920efe873c12102d1b2f368b5ca1635b8f143ab915b4535a091ed5a14b044d52b79ba8075ebc713d2f2cff73a928911cd3a97628a718eb861d4a9d3","ssdeep":"768:KpTirMF3t5qU9GJIx/tdAmjNdiMwL3BL4ZGdsPaXYjxvagUEVg1GPDn:WuOd5qU9GJIxVC2bwL3BL4dPaM/hgcT","tlshash":"4a33d0039d00abc2b4108bd4bd466d9b9f9fb26c65123ba2354fcef36f241c268a515a","first_seen":"2026-09-15T18:41:43.959136Z","last_seen":"2026-09-15T18:41:43.959136Z","times_seen":1,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-15T18:40:57.093Z","timestamp":1789497657093,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1uuQAhh3mIPzoFmMj7ei6CRGk9weE9W70ryO1b43P4SJ8gfb4uJ3lLWbH3usV7Nma%2FLlwNNWzW0eM96fGzlNkl0CN15aoSJBCRWSfyxOBxyky4uY%2BzYWzTTlq%2FbPugja\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:58 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: zstd\r\ncf-ray: a3b9c3452bcaee1a-CPH\r\ncf-cache-status: DYNAMIC\r\ncache-control: max-age=3, must-revalidate, max-age=0\r\npriority: u=0,i\r\nexpires: Tue, 15 Sep 2026 18:40:58 GMT\r\nlast-modified: Tue, 15 Sep 2026 18:25:39 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding,Cookie\r\nx-powered-by: PHP/8.1.34, PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"iubenda","description":"iubenda is a compliance software used by businesses for their websites and apps.","website":"https://www.iubenda.com","common_platform_enumeration":"","icon":"iubenda.svg","categories":["Cookie compliance"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"WordPress Super Cache","description":"WordPress Super Cache is a static caching plugin for WordPress.","website":"https://z9.io/wp-super-cache/","common_platform_enumeration":"","icon":"wp_super_cache.png","categories":["Caching","WordPress plugins"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"Yoast SEO:20.11","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP:8.1.34","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WordPress:6.2.11","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]}],"data":{"size":91562,"size_decoded":17866,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (21486)","md5":"a95fe04c0e2188427da3af263c909a5b","sha1":"0b59fbe8922ff97af97eeea2b029722ce0b3b31f","sha256":"33ff2d2e1174732d2c564aceb50539528f46662c9c822add619ca8441d17ee73","sha512":"cc6472c26411fb26437fccba06fe3f792ac5f420b9f7321db0efdb51ba508a66d7339703a5bec950198be0d89e1c75f5cb49beb2b9a58972a0c829bda7cc3738","ssdeep":"1536:akJbiQzR9xO0pHVOwiVOu9NX1O4O3HczE+Wzz+FiJ6RJnzUzmAO3MkNJDPOjRgsm:a1T0pHVOwiVOu9NX1O4O3HSiJEvAO37","tlshash":"6c93c72b773690d6006b1692793f728cb013e10e9a4199c0f2edc79e77d9d613aa1bcd","first_seen":"2026-09-15T18:28:22.713137Z","last_seen":"2026-09-15T18:41:43.961087Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1765,"timings":{"blocked":-1,"dns":4,"connect":37,"send":0,"wait":1724,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rawtales.live/wp-content/uploads/2019/12/rt300.png","fqdn":"rawtales.live","domain":"rawtales.live","tld":"live"},"ip":{"addr":"104.21.25.157","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.259Z","timestamp":1789497659259,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rawtales.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 04 Aug 2026 16:08:38 GMT","end":"Mon, 02 Nov 2026 17:06:56 GMT"},"fingerprint":{"sha1":"6F:49:02:E6:31:9B:AC:59:DF:AA:60:56:67:8E:3B:E9:C5:D1:10:F1","sha256":"57:56:2A:74:23:10:05:52:AA:62:4E:21:76:2B:08:BF:E4:F5:EE:CD:EB:5F:17:E1:6F:37:6F:34:44:47:66:9B"}}},"request":{"raw":"GET /wp-content/uploads/2019/12/rt300.png HTTP/1.1\r\nHost: rawtales.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nxEoSGq8pq3iJm1mDTDiZdY%2B6ke%2FoFc4sX0IYmcwLH6ZU7%2BEUXNVxar0thhLfRnXv3uREbaVAls%2BSXLDTHaI3fWo6c%2Bd5sZONoBWCiw2374Zodl1RUPNsGI5DLs0X7cu\"}]}\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: image/png\r\npriority: u=5,i\r\ncf-ray: a3b9c352693aee1a-CPH\r\ncf-cache-status: HIT\r\nage: 799\r\ncache-control: public, max-age=10368000\r\ncontent-encoding: gzip\r\netag: W/\"5e0a7a59-23ec\"\r\nexpires: Wed, 13 Jan 2027 18:27:38 GMT\r\nlast-modified: Mon, 30 Dec 2019 22:29:45 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9196,"size_decoded":9714,"mime_type":"image/png","magic":"PNG image data, 301 x 118, 8-bit/color RGBA, non-interlaced","md5":"6a9be915119b236d69df4385730fa10a","sha1":"3390600e06f38845b1e5165ae4b37aec7e041f25","sha256":"af262a154c1e318e3ba839a0f05b47f349b315f73e34bd040d5e0dc8bda39ede","sha512":"21233d1f2ec5f139e921fa590bcfe97418ccd278f75565acf677007250831dd5c60d53e35c1d43376883af5d844a9471d6e9f0328979747c60e784d9532cfc49","ssdeep":"192:eOC2CdVkAemyvXuHjgk4LUfyTkWQvwDQHNfImhpB297zxsUEyoS8C:ex23/mWXijgnYfyTEvwD6xh69DEyqC","tlshash":"0912bf04e80809424339ceb7b9757a9a39602c905935e26f52b6fc7e2cd10592dbf6d1","first_seen":"2026-09-15T18:41:43.962818Z","last_seen":"2026-09-15T18:41:43.962818Z","times_seen":1,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-15","alert":"Sinkholed","trigger":"rawtales.live","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-15","alert":"Phishing Block","trigger":"rawtales.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Cormorant+Garamond:700|Montserrat|Nunito+Sans|Pinyon+Script|Raleway","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.357Z","timestamp":1789497659357,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css?family=Cormorant+Garamond:700|Montserrat|Nunito+Sans|Pinyon+Script|Raleway HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 15 Sep 2026 18:40:59 GMT\r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9142,"size_decoded":1696,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"c9da52753ca6ed189d66db86c109eada","sha1":"c6f760d1a3b5791b7fea7526484f3dafd0fc5a1a","sha256":"2f9ad3abf15fda5db51892422ac398f7f7aa74c33b833b56839f360c20ed845c","sha512":"c4bf14f0e390449333947db974ff67de070221e3f1088f5e812c41c43631273e16e83ad5a0a2a409cf15677954fd5de69192ef7c1989d7724ef917894744d2d2","ssdeep":"192:k/083VWG6Ha1hJlsdveoxve8cvefvevnveXOPuPENPOJaNzphkgv:k1gwLoM89OuXe+u0y7v","tlshash":"f0121e91052bd400a7431cc633cf7d36de8ea1123045d43aaffe5c98edaad261365b5e","first_seen":"2025-09-26T20:42:04.647719Z","last_seen":"2026-09-15T18:41:43.965443Z","times_seen":33,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":2,"connect":15,"send":0,"wait":33,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.iubenda.com/iubenda_i_badge.js","fqdn":"cdn.iubenda.com","domain":"iubenda.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rawtales.live/","date":"2026-09-15T18:40:59.916Z","timestamp":1789497659916,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.iubenda.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 04 Mar 2026 00:00:00 GMT","end":"Sun, 31 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"48:E7:8A:F5:24:9E:68:9C:AF:66:4E:E2:EE:C3:90:B8:84:A1:8D:4C","sha256":"43:20:4D:9B:97:2D:E4:EF:E6:8F:71:78:B9:81:E9:96:BD:9B:75:C3:A5:EC:88:84:00:DD:76:5A:3C:DC:A3:3C"}}},"request":{"raw":"GET /iubenda_i_badge.js HTTP/1.1\r\nHost: cdn.iubenda.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rawtales.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 15 Sep 2026 18:40:59 GMT\r\ncontent-type: application/javascript\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 954456\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: max-age=3600, public, must-revalidate, proxy-revalidate\r\ncontent-encoding: zstd\r\netag: \"6aa91f6d-2dab\"\r\nexpires: Tue, 15 Sep 2026 12:58:16 GMT\r\nlast-modified: Tue, 15 Sep 2026 10:35:25 GMT\r\np3p: CP=\"DSP NOI COR\", policyref=\"http://www.iubenda.com/w3c/p3p.xml\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncdn-proxyver: 1.70\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/15/2026 11:58:16\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 3006630f2d9308e49d19429f72ba3ba9\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11691,"size_decoded":5128,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11690)","md5":"35bac0339ff36e2548ae16f02d69eded","sha1":"0589a3e91447748d8a3c1be88009234b7b832f58","sha256":"3446c86025da5c5f6caa6aea240950e84c886a92987e2b2835b69780d02bca87","sha512":"dc54624cac90d51554afeacaf4c92c2e0b746f4ca4871ab6a5655071068c9e69062913f08e38fe861ec4676a473d1fbc23f8316b2b8548ae4badc41d4980ffef","ssdeep":"192:bGvzVw/qfgVUkZAQxxrrXYGsV4XGpgmFxcmqZHH/Sph42:bGvzVzoAQxx3XFsV42pgmFx2HHqbH","tlshash":"8d32b7a9b751623450ae97dd682b0f0cf362606e5901422cb93cdcf9657ce46317bb7c","first_seen":"2026-03-16T15:42:48.524047Z","last_seen":"2026-09-15T18:56:04.705159Z","times_seen":23351,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}