{"report_id":"8fad8384-e78b-4f34-b03a-626251ae58ed","version":0,"status":"done","tags":[],"date":"2026-09-08T18:35:48Z","url":{"schema":"http","addr":"esda.mom/","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"104.21.88.184","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"esda.mom/","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"title":"Studio Tańca – East Side Dance Academy","dom":{"size":513119,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (40741)","md5":"1a6db3a9b4d585f1bbc85085224ede2b","sha1":"529f0ff4ce7c24b7f97bd06be784d2730f728d37","sha256":"baa64c4e0c4fbd77390032f43279590c187802b41db1a405cd1ab3f5acdb4dbe","sha512":"be93b0af35857b396edc58c2e84b558d135780c932534f538d48e3c9a1ab2ab693fbf6dcf6892d158af11a47ae8ffc3f9346b334892c907293cb1ebb9a4731ce","ssdeep":"6144:uSiKsOsqsGgUMIwRrlDh7IKorDng00C6eGo1U1udcoCz/L9r1z5cYF3pjdona:uSnKorDng6Go1U1udchz/Lx1zeLa","tlshash":"62b4085b2b24a079292b0dd4d2972769780d5046e20424e5f6fcc2e8fadd8e716b33df","dom_hash":"domhash99036c296f4367a0aa12e66b406ccdc1","first_seen":"2026-09-08T18:03:26.967675Z","last_seen":"2026-09-08T18:35:53.917522Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"esda.mom/","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"104.21.88.184","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-13T18:35:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"challenges.cloudflare.com","ip":{"addr":"104.18.94.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":11393,"first_seen":"2021-10-20T05:02:03Z","last_seen":"2026-09-06T23:42:44.867262Z","alert_count":0,"request_count":2,"received_data":87493,"sent_data":951,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"esda.mom","ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-14","domain_rank":0,"first_seen":"2026-09-08T18:03:21.640903Z","last_seen":"2026-09-08T18:03:21.640903Z","alert_count":325,"request_count":65,"received_data":3039421,"sent_data":32527,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Kadence WP Blocks","description":"Kadence Blocks is a plugin for WordPress that provides a collection of custom blocks for the WordPress Block Editor, allowing users to create custom layouts and designs for their website without needing to know how to code.","website":"https://www.kadencewp.com/kadence-blocks/","common_platform_enumeration":"","icon":"Kadence WP.svg","categories":["WordPress plugins"]},{"name":"MailerLite","description":"MailerLite is an email marketing tool and website builder for businesses of all shapes and sizes.","website":"https://www.mailerlite.com","common_platform_enumeration":"","icon":"MailerLite.svg","categories":["Marketing automation"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"C3.js","description":"D3 based reusable chart library","website":"https://c3js.org/","common_platform_enumeration":"","icon":"C3.js.png","categories":["JavaScript libraries"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"WordPress:7.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]}]},{"fqdn":"static.mailerlite.com","ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2010-04-09","domain_rank":201844,"first_seen":"2015-12-30T07:52:46Z","last_seen":"2026-09-08T18:03:23.563731Z","alert_count":0,"request_count":2,"received_data":142948,"sent_data":980,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"assets.mailerlite.com","ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2010-04-09","domain_rank":182442,"first_seen":"2022-04-21T07:04:49Z","last_seen":"2026-09-05T15:50:42.271369Z","alert_count":0,"request_count":2,"received_data":666,"sent_data":994,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"assets.mlcdn.com","ip":{"addr":"172.64.153.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2015-01-08","domain_rank":190482,"first_seen":"2022-03-23T15:36:48Z","last_seen":"2026-09-06T20:29:06.408446Z","alert_count":0,"request_count":1,"received_data":1868,"sent_data":494,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-06T22:43:29.090385Z","alert_count":0,"request_count":12,"received_data":412286,"sent_data":6554,"comment":"","tags":null,"fingerprints":null},{"fqdn":"esda.pl","ip":{"addr":"104.21.21.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2015-08-06","domain_rank":0,"first_seen":"2026-09-08T18:03:21.647688Z","last_seen":"2026-09-08T18:03:21.647688Z","alert_count":0,"request_count":1,"received_data":1255,"sent_data":520,"comment":"","tags":null,"fingerprints":[{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}]},{"fqdn":"fonts.mailerlite.com","ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2010-04-09","domain_rank":215001,"first_seen":"2021-09-21T11:33:35Z","last_seen":"2026-09-08T18:03:22.540526Z","alert_count":0,"request_count":5,"received_data":369467,"sent_data":7685,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"groot.mailerlite.com","ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2010-04-09","domain_rank":352304,"first_seen":"2022-02-18T13:57:17Z","last_seen":"2026-09-02T16:59:39.448025Z","alert_count":0,"request_count":2,"received_data":25894,"sent_data":996,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/cd03fcef72c1734369feb85bc018bc1d.js?ver=8bc1d","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ad59ac3c766bf2dc714639017a1282be","sha1":"002eab39c80f11e2fe75abb21c9d77f0e53e9673","sha256":"5698cfad2537364d79935a8824bae7ac1a656ef83039aa6745ec7f77d4c676a1","sha512":"3505036cd7a19397777f1e9afa5629b9c0c2a2dbb1ebc324777188a6d091e7ab407c0b3e1725d3e3d6cc31402719fad64707e04dadbe557d0322b31fd82891f8","ssdeep":"96:zVr/rF88C6uNkcSEg0Q21sBi+mipFPEzDmIzONYk:RrjF88CbkcSEPQ21S1XuzDFu","tlshash":"94a1d094714b5a1649ebe3a3308b160c247ac5385830125ef6ee9ecf6db4f0572d3b7a","size":5084,"data":"","first_seen":"2025-02-20T19:03:23.579451Z","last_seen":"2026-09-08T18:35:53.965716Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/1cbf7936ea1957afc9993a262f4592b9.js?ver=592b9","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d1776fc1150fd7de4b14a9070eacb939","sha1":"3f12b2f69ace985d22a9cc3453fe1852d50b7f68","sha256":"fd3d363d5e61cfefdcfe5f09ee579ffe2d7861dbfc7ca08eb877481715147789","sha512":"3a4350e16433ce4736d82c84dec1b5e65c09f7da03d6f5cf4784d330bca9393506e93f78fe6bc8de37d0073ffb8d42cd9cdc39c8c319d6457fc9fc5ff3981eb4","ssdeep":"","tlshash":"34111224620031176dfff0ff010b030b667dd63a4909f54060bc47e92d76a65589beba","size":1070,"data":"","first_seen":"2025-02-20T19:03:23.581399Z","last_seen":"2026-09-08T18:35:53.928231Z","times_seen":21,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/5913c5dfdfe91c7530b4eda7589255b9.js?ver=255b9","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3bfa25fef90e9fe421a977587e343b96","sha1":"84508c10a407024ad96569817f21acef23d6b486","sha256":"e5bdb53db2e08067f12522ce695c8df528dbe1e54229bc201355840b27151093","sha512":"0d080b87b9d444a0fced53c1d55dab6b2d276cef3f0bf124280ae9104bf3db76696c8ae3ebbc3f149247af711ec2e022054f0ce5842258a4715bd5389c7f7e63","ssdeep":"","tlshash":"6081e3c8b10018ba99db22e3402d944c5ab51658d9414478f1bfacaf07943ec676bfff","size":4042,"data":"","first_seen":"2025-02-20T19:03:23.582114Z","last_seen":"2026-09-08T18:35:53.957421Z","times_seen":21,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,dmFyIHRta19jb29raWVzX3NldHRpbmdzPXsiZW5hYmxlX2Jhbm5lciI6IjEiLCJtZXRhX3BpeGVsX2lkIjoiMjQ2NTcwNTYwOTU4NDU0In0=","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f8fc08516d3e86bb486bebf3f08b475b","sha1":"a650a8bdcac95a1441e9cbd9908144f0db5cde89","sha256":"e4f2df81eb6081647ff90374a06682b2573104669f1c405336be004be7cf4108","sha512":"bba258f10acedee213323f3a6ab9264c841b41f569cb68829576db7c5036732a9e3f0477ef626885c28b80acaa3bb8ff02b9d5ea177d27580e1e5521f29652b2","ssdeep":"","tlshash":"14a01281984c18ec08634865901c00221c64193682a241580014cd640619a021602242","size":80,"data":"","first_seen":"2026-09-08T18:03:27.103797Z","last_seen":"2026-09-08T18:35:53.98598Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/77691ba250db9d104026a794237393b6.js?ver=393b6","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d83151f68df18daa583b32491e6412e8","sha1":"2c036239774439c8864b7f70986632c3d363a90e","sha256":"b34ca2039a3e1ea313308a6ba41b693b92ce7cdabd5045aef4e61b49f2731f2a","sha512":"de56d1afc2ab74a350fbd3632e152b390b10bfb6476faf1c606f14d0e804024ce7442b703d04d1ae9dd17cd8e177c198cb426a9be0c572af67035880f4999eaf","ssdeep":"768:I/6VeyMdLkeSVhudyXkysHtvN9f2+5D39fv9ISncqMp80uJsCGOUmngl4l1w7EF:1e9HJtvNwGw2","tlshash":"b6138449d605176688db20e63105c00da3f7eb7cab12c1d075d987eb64be8098ad77fa","size":43418,"data":"","first_seen":"2026-09-08T18:03:27.068571Z","last_seen":"2026-09-08T18:35:53.970247Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/edsanimate-site-script-js-extra","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ea1c2b860c846db5244a93d69ac2a0a","sha1":"f1d6bb7ddd466dd946fa8259d5f940094c855276","sha256":"f26348907f1fc38374427c238dcb72b110de61d7e2cd82656c8bedb1df0c1463","sha512":"8d2c4bd3ad10689136442855c7903e9d7f3be783e3df5a57115393dbc70be6e6e43ddc122b0f7b33099cdce362fe9289e336e9ecb8d88fcf82243c76c5c28d3a","ssdeep":"","tlshash":"b0418c0ac881249103e3f2b40cd92b3a2c4c4a06c1918081740c8a24002c653ba154a0","size":1901,"data":"","first_seen":"2026-09-08T18:03:27.100475Z","last_seen":"2026-09-08T18:35:53.986959Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,ZnVuY3Rpb24gbWxfd2ViZm9ybV9zdWNjZXNzXzY2MjE3ODYoKXt2YXIgJD1tbF9qUXVlcnl8fGpRdWVyeTskKCcubWwtc3Vic2NyaWJlLWZvcm0tNjYyMTc4NiAucm93LXN1Y2Nlc3MnKS5zaG93KCk7JCgnLm1sLXN1YnNjcmliZS1mb3JtLTY2MjE3ODYgLnJvdy1mb3JtJykuaGlkZSgpfQ==","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3e58ee6b2eb68d001d3a6c05f85a3f00","sha1":"f2eacad34a980a31831a8956a4dca074e20e3a73","sha256":"b14ace7f3488418f1e58f107a73531bb256d473aad601fa6f8d63f0cb61278c3","sha512":"511ad9b7e669040cf2d2e1b74bc5ac9cd443be671e051dd75f51de52acb306517e43f7d344b96bfae6e6ceb57b145c9a3266c38b572137ae3b9576b0942fc26b","ssdeep":"","tlshash":"94c08c5a69c072a742222132a8d70e1c21300e18c180e06082e681d1f72863f6c33bd1","size":163,"data":"","first_seen":"2026-09-08T18:03:27.087815Z","last_seen":"2026-09-08T18:35:53.987868Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/109d5104c7839908fdc0924fc16a0ae8.js?ver=a0ae8","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"aedf571e8bad5a764a59fa9761565ede","sha1":"09a7def2ee80a32791907498b825118d4aab81b1","sha256":"5f551811f753f794feb53d900eea9f9197e8c2eb1fcdb9f64b3389e19bff74f8","sha512":"0dde63bbd251f3834d68d1bdb859d4892d743f011d0c2a916cba3c2d532ebedebc30cdcc2deba2bd276dbeef0f49bcb5f2feee82b9c6390002b97baf6a7e7700","ssdeep":"384:vt9plrEVcBlg6ATzgmAKmuqbsBPtWFvPIatWFvPItGThDYg+HhgN8zgbGd3KpRgk:vddEVqe6ATzgmAKm1YBPIFvnIFvsOhUW","tlshash":"32a293a17090642a92ff27f280fb07157e369611fc0195a4eaec4ca5696fa43313ef5e","size":21790,"data":"","first_seen":"2026-07-10T08:43:04.581172Z","last_seen":"2026-09-08T18:35:53.943834Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/f0c07d9915ae8435c6a4ee7d993fe5d3.js?ver=fe5d3","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0e1afb6339687f4bc99ccdc5efaa80b7","sha1":"9bcad1aa5c85676112f327c9659ba69a81fca429","sha256":"f0046ea40f3faf4fc8f8f9927b1a60aa1909a362f0d8aef69dbf650a0229ece7","sha512":"82b22722aac1e1cbb5ccff35a36421f5d213df88d26eeb69e1dc339395334bf849f5c6aa30760cc997f52fd5ee7d30f9d0e3479a7ed61a42dd94b71ab5362683","ssdeep":"1536:qMkusBZ7kSZQQFRNM9jGZSthq3+uTONdgj+sMJpxzz2WfBWPGAAPqD1Aql208FEX:nWB7XYpMx","tlshash":"b643fa057352347345de516aa03b930b72b6254e2802d09cb4bddcdb29bcdae31abbf5","size":57268,"data":"","first_seen":"2024-11-13T13:08:50.072671Z","last_seen":"2026-09-08T18:35:53.959206Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.mailerlite.com/js/w/ml_jQuery.inputmask.bundle.min.js?v3.3.1","fqdn":"static.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"775cee1998fe3d9fc0cb4450c293bbd5","sha1":"af3a53c3c3b63e59afc5e864f1050dd22a384108","sha256":"c77ae965196f7308b827ce8cef39758740e9652e49958d866454ca1967e03dae","sha512":"80d47478fd97067ea8573c2c6274a8df7a4d6fc8137ff93529af6fae0f0a96afa4b915c85a723c87c213823edc13627213c1d09f2a3bf1613c4939d26310f118","ssdeep":"768:n4EnGeFpoDyrBqnTOFAuPg7DDbsp5pKSwttCCVkv6pE54J5m872U1jVNWFaHRFUl:nJp6nTO2ulKJQCVkvQm87nFVN4aH20U","tlshash":"da63d7967b52b29a46e370f840ff8407a07aef9a34d94190f186b1c47839ed607b7e74","size":70970,"data":"","first_seen":"2023-03-07T12:08:55Z","last_seen":"2026-09-08T18:35:53.9207Z","times_seen":1850,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-08T20:16:20.746634Z","times_seen":432067,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/plugins/wp-statistics/assets/js/tracker.js","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8f1f140996d0b8b3ef69cc64972e2ad2","sha1":"a030c2dbe75f24705323ab43a43e0f532f7612e6","sha256":"3b0e963107a1f4428d7140d30b9f1290e89de3e177216624e65d5cfe9da3694a","sha512":"798f38203ed948659113744df9dda4c97b900a29289200b7cb55c3622ee8c29e721a3db55cfeca343b72aa1b88af0b22ec4b16ccfc6e211384fd4735fb78784b","ssdeep":"96:aOXKnJaAS8r16MO0zrEyhZsYgdOnGWdOZPhq0holdQl+RWAsgGR+QACVAmzx:DYUv8RjO0HEyhZNWOGAOZPSeIWAfwV9","tlshash":"4ef174967ac656f2c8f63068113a2b3d75ab0dd23602d171b868cad35818ac2d347f7a","size":7922,"data":"","first_seen":"2026-04-16T22:24:47.018507Z","last_seen":"2026-09-08T18:35:53.957998Z","times_seen":2396,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"groot.mailerlite.com/js/w/webforms.min.js?v1f25ee4b05f240a833e02c19975434a4","fqdn":"groot.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"83147fa8ce2d95cb73ece7f28b469519","sha1":"530288c27b9a22124bf9e2c239584ebaedd467c9","sha256":"95f9e26622fd9b3b0d13e3c7a4996ea40fdd00d0f26c90806b99f850d01c55e0","sha512":"79370e2287c0bef2e8aefd1156633f8765bd53ac82afd09563283d62183ba10a2e62cb1770607849e9bd5a4072e700c3689fefe568d5eb5688f76af5698deb0e","ssdeep":"192:YA3Oop38Xmt4EUJYaN5GtAG7DRxHGrGi554LkojofEdEFTwx4kP9BJamXmvC4X81:YGOop38Xmt4ZItx7DrWojofEdEFoJaXI","tlshash":"2342778575e2e1e7297704a276fbb74271b2693adc0b4000811764b13dbcd879a3abcf","size":12127,"data":"","first_seen":"2026-06-08T15:24:47.782591Z","last_seen":"2026-09-08T18:35:53.945921Z","times_seen":317,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/fd44e640747692c1a5a82a97aa1753f0.js?ver=753f0","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"59623e1f7d387cdb5ad4d9caedace73c","sha1":"2523614fede5f094ba15f9b60c3feb581a672fb6","sha256":"06e7a4acf3751a6ddf102282a57fcdf3ec68493cecd79754b7bd4e9adb6e7062","sha512":"64ca9ad85b41ff5a44d0176bea471713f01c40acb5f3e7c3ff5b27f08a4232a14d793dbdd32fdf80c573aecadc4e96c937e758d19c5248baa03b3abced9973b9","ssdeep":"768:nCUlE5CYhN9Km0GVHxWG9pTHoJFnuIY6w4bww0j7QazB2pXQz7h:he9KCRHoJxuIY6w4bwwu7KQz1","tlshash":"b9f2e97872c47a3205c36a95a0bfa341f33065d5e6818095b63edec6a9eccc61627ff4","size":37550,"data":"","first_seen":"2026-09-08T18:03:27.015058Z","last_seen":"2026-09-08T18:35:53.94154Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/a03a9c9ef65a894504359807db130d81.js?ver=30d81","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0e3575ff5bb049b26dd9de0428d52206","sha1":"9679bae222b452f365b51f9b77a1e5a05258ad9f","sha256":"10fda27861ff14d42bac718d7b8fc20a3996704a74b869c3396d4de14679ef9e","sha512":"9c7018b219afc2fcf3d8b4ac28e17f9e5d7f3ea1ecb3b919883bb79631b3de610ac72ca5276a9aecf8476fe246cf8a453b060f52cbc83fbf5d509ddd96010abd","ssdeep":"384:79MYnd4kXN4/Lez4e4PVg41RcfM9qp4q47XY:79pn7XKj1RcfMrY","tlshash":"c9c2868f33657730cdeab372512f720b67960596e5294834d51a38887c3936f42afa2f","size":26202,"data":"","first_seen":"2023-09-21T18:09:20Z","last_seen":"2026-09-08T18:35:53.969633Z","times_seen":76,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/c9f08d75ab950f22e3981e65bf87ed7f.js?ver=7ed7f","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d486693396667295dbac8def9ad05a91","sha1":"06b384bd770972d0e17e628e36151e8a85225b35","sha256":"b9bbbb9b2abd510cf3167f5405655cf4c639546eda301b56ec6457f8a716d6a4","sha512":"00f71aab782c0ffffc746840f8877d5f19930d12e88db66ad7a8745e27bc90fd6f35feaeb173880625c98ffefca04e0ada16b3cd96a95b7e96476b60f501a923","ssdeep":"96:oE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaM/:Xhgws4WTBYNB1C9aNwAMPyd0R3SGaMSe","tlshash":"50c1a8c979def056235910a594afb005e134be2870deb800aae0c4957eb44cdb1b7fba","size":5792,"data":"","first_seen":"2026-08-20T20:36:42.924411Z","last_seen":"2026-09-08T18:35:53.95861Z","times_seen":177,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,dmFyIHdwY2Y3Y2ZfZ2xvYmFsX3NldHRpbmdzPXsiYWpheHVybCI6Imh0dHBzOi8vZXNkYS5wbC93cC1hZG1pbi9hZG1pbi1hamF4LnBocCJ9","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"7da834ee260d6dd71e7042e32b80c67c","sha1":"033612f329599a24d3955695c47a8c8628184b4e","sha256":"342b3109c5a62612353bd5ab317896633971034d3371950000b78e6b6ac5df1b","sha512":"c7613b8eb0969444ff428790d15e2247bcbcb06f99a1a9a850e095cadd01cbbe3e65b27796b666dcd750fac46e92dec9a0239b12cc371cd57f97566afe15f637","ssdeep":"","tlshash":"1ba0129249400e8721612ae88114a71301305035d83970058630148441084405c14017","size":81,"data":"","first_seen":"2026-09-08T18:03:27.093395Z","last_seen":"2026-09-08T18:35:53.988788Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,dmFyIG1QUzJpZF9wYXJhbXM9eyJpbnN0YW5jZXMiOnsibVBTMmlkX2luc3RhbmNlXzAiOnsic2VsZWN0b3IiOiJhW2hyZWYqPScjJ106bm90KFtocmVmPScjJ10pIiwiYXV0b1NlbGVjdG9yTWVudUxpbmtzIjoidHJ1ZSIsImV4Y2x1ZGVTZWxlY3RvciI6ImFbaHJlZl49JyN0YWItJ10sIGFbaHJlZl49JyN0YWJzLSddLCBhW2RhdGEtdG9nZ2xlXTpub3QoW2RhdGEtdG9nZ2xlPSd0b29sdGlwJ10pLCBhW2RhdGEtc2xpZGVdLCBhW2RhdGEtdmMtdGFic10sIGFbZGF0YS12Yy1hY2NvcmRpb25dLCBhLnNjcmVlbi1yZWFkZXItdGV4dC5za2lwLWxpbmsiLCJzY3JvbGxTcGVlZCI6ODAwLCJhdXRvU2Nyb2xsU3BlZWQiOiJ0cnVlIiwic2Nyb2xsRWFzaW5nIjoiZWFzZUluT3V0UXVpbnQiLCJzY3JvbGxpbmdFYXNpbmciOiJlYXNlT3V0UXVpbnQiLCJmb3JjZVNjcm9sbEVhc2luZyI6ImZhbHNlIiwicGFnZUVuZFNtb290aFNjcm9sbCI6InRydWUiLCJzdG9wU2Nyb2xsT25Vc2VyQWN0aW9uIjoiZmFsc2UiLCJhdXRvQ29ycmVjdFNjcm9sbCI6ImZhbHNlIiwiYXV0b0NvcnJlY3RTY3JvbGxFeHRlbmQiOiJmYWxzZSIsImxheW91dCI6InZlcnRpY2FsIiwib2Zmc2V0IjoiMzAiLCJkdW1teU9mZnNldCI6ImZhbHNlIiwiaGlnaGxpZ2h0U2VsZWN0b3IiOiIiLCJjbGlja2VkQ2xhc3MiOiJtUFMyaWQtY2xpY2tlZCIsInRhcmdldENsYXNzIjoibVBTMmlkLXRhcmdldCIsImhpZ2hsaWdodENsYXNzIjoibVBTMmlkLWhpZ2hsaWdodCIsImZvcmNlU2luZ2xlSGlnaGxpZ2h0IjoiZmFsc2UiLCJrZWVwSGlnaGxpZ2h0VW50aWxOZXh0IjoiZmFsc2UiLCJoaWdobGlnaHRCeU5leHRUYXJnZXQiOiJmYWxzZSIsImFwcGVuZEhhc2giOiJmYWxzZSIsInNjcm9sbFRvSGFzaCI6InRydWUiLCJzY3JvbGxUb0hhc2hGb3JBbGwiOiJ0cnVlIiwic2Nyb2xsVG9IYXNoRGVsYXkiOjAsInNjcm9sbFRvSGFzaFVzZUVsZW1lbnREYXRhIjoidHJ1ZSIsInNjcm9sbFRvSGFzaFJlbW92ZVVybEhhc2giOiJmYWxzZSIsImRpc2FibGVQbHVnaW5CZWxvdyI6MCwiYWRtaW5EaXNwbGF5V2lkZ2V0c0lkIjoidHJ1ZSIsImFkbWluVGlueU1DRWJ1dHRvbnMiOiJ0cnVlIiwidW5iaW5kVW5yZWxhdGVkQ2xpY2tFdmVudHMiOiJmYWxzZSIsInVuYmluZFVucmVsYXRlZENsaWNrRXZlbnRzU2VsZWN0b3IiOiIiLCJub3JtYWxpemVBbmNob3JQb2ludFRhcmdldHMiOiJmYWxzZSIsImVuY29kZUxpbmtzIjoiZmFsc2UifX0sInRvdGFsX2luc3RhbmNlcyI6IjEiLCJzaG9ydGNvZGVfY2xhc3MiOiJfcHMyaWQifQ==","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3a1288d9191d91ccaac278a6b20c84fe","sha1":"1ef59812a666e5491cd4122029b8c008a5cd1869","sha256":"9ee151184eacaf1e4127a4b30060c2eda6c254da745288ec17eb20db90c270fe","sha512":"4fa10d9991b6f4bd4ad4db667448f88758354a77a6289ea3a60735e5531282825eff9a36b913187ba1fdc8dbb272f258d5903b686ecb92041e2f67bb91528490","ssdeep":"","tlshash":"bc21542816040efb63de4246e04bba69a19c40c3e3341108dcbaefbdfd6176c60c600b","size":1282,"data":"","first_seen":"2026-09-08T18:03:27.1022Z","last_seen":"2026-09-08T18:35:53.989607Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/1dd70f559ce130f8dbc891264df8368d.js?ver=8368d","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"586bfcf8b3829616f51a7e2a4aead287","sha1":"fb73b0adb250de47d067b2b2caf78879c68571b6","sha256":"57d5f320624e13606b8e6dc357482e85842aac712a80ddb4bbb0787fb1a3e803","sha512":"0b8e1125be8714dffc0e08ff49fbbbb1304c738e3d020bb2404b66ccc1f954ad6125760a58853aa42b02e1cee7fbec9c0d42623e1d529aee35f47851d267e648","ssdeep":"96:Fu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2Cio:FGIhNBcAD0NRv8XlD3wXY2yH+EoaY2o","tlshash":"abb163c43542b830e2777027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","size":5108,"data":"","first_seen":"2026-08-20T20:36:42.900883Z","last_seen":"2026-09-08T18:35:53.974751Z","times_seen":181,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/ea89ac4fca609d37452984dc94f380b9.js?ver=380b9","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ef3a48bf0d02e86cf53cb40bb6a7236f","sha1":"a7503b2af3913e15f6f66b0add26e3f79202691a","sha256":"0eb716817a932ca44114458eb649ac215fd3b2b6fe1ce9c04590a67c0fb89861","sha512":"29d20f799c060f9c6043346271013bba95b4a40627c353237b05eff37f6feb31dd7f44d1fcfce9aeaae802e8569ddf3d767a8e0e0f1211b686537afec1efaf1f","ssdeep":"","tlshash":"8b0123e8162371bb01bf2ebaca6eb2437e6270697747226501dcc8090984e434222dac","size":659,"data":"","first_seen":"2025-06-24T06:18:58.433602Z","last_seen":"2026-09-08T18:35:53.97622Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-includes/js/jquery/jquery.min.js","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-09-08T20:34:17.71605Z","times_seen":1050589,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"3270447a4bc95c3452f17b1fcb0ce499","sha1":"67b5d4a95b4fdb98543521a561721dc1e754cbe0","sha256":"621faef454599bf45df336e0b9c04f60affe7b784ab07a678cd566827651c726","sha512":"a32ce7d70ad3ac532ddd90efc4c2bb55156890aa22a1a2f6969e958851f0d85d32a30f21e2387f2730c04da689f5270b145051538883713cb4d39d677eac7b4f","ssdeep":"","tlshash":"8bc08c0a8881249103e3b2a408d52b3a2c0c4a0681918081740c8a24002c653ba154a0","size":135,"data":"","first_seen":"2026-03-04T06:27:34.95133Z","last_seen":"2026-09-08T18:35:53.990479Z","times_seen":57,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"db89040408d21db649455564f36ab97d","sha1":"7a2574928a798cdd7acc1b9f0fb757bbe0f85d53","sha256":"947c01befcc6446c4cd3d3f22b2219242fe83d274ffe96aa8bd4e6cfd3f0c431","sha512":"5bd43c8b30a536b2125324c74006e4703ade9c832efda3913c53ff4c55d9f1b3d73599d48b53fbdc314ae4914daa1f61947e0e64d33d5f85f0db39ba93b1c23f","ssdeep":"","tlshash":"f4b0929e92a82bb433b3aa3834a6a3939d6a9486c02a6019885768050428cb08090585","size":111,"data":"","first_seen":"2025-12-15T07:44:14.652164Z","last_seen":"2026-09-08T21:16:45.973714Z","times_seen":602,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7d72b80690ba108f701c1b1a5e697720","sha1":"befbf4e1dec83cfd6b3a327a909be07a4f8ab490","sha256":"0d8bef99a34b9446ad386668c9742d804417dad6f930213a1dd1cbb8dacbd6e3","sha512":"7cc76f2ee11c4395caa4a50a63bbd1668733e4f8ba3d89189a8014364a7e93873434b7b7b7c7ab37f624d4558e064d913657c064dcc9b35f892a0f05e0991130","ssdeep":"192:q6e4j3qVXlu798fbuEO4C5/hsNs35PhSkzISM8Z:bel29YFts/Swau","tlshash":"62f153497542b57f393b7071d0af220b313970a3a84b4861e9b8f6d87c789792a23d7d","size":8109,"data":"","first_seen":"2025-07-25T05:28:04.240916Z","last_seen":"2026-09-08T20:34:17.785866Z","times_seen":29740,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/325cb22eac53da46a7bee90f1ac4291f.js?ver=4291f","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7c0e2c523276cca6094c923a69da6a92","sha1":"dd22399d4ca8bdd5566d6ee8a65260c42734d9a5","sha256":"6904b27ab4ab5c4ba8cb85b02532d06b3c99c5d27a2a4b003b876edd1cbcc2df","sha512":"2ecbaee5adeba50011ebd210dda27a8eed9c23f8898085ab8b9f7c5d80713e6aaa88371a00f0bb881835ee335008a74a14864d67f827e0e3f177e467d1a23c02","ssdeep":"192:Di2aDucaTr5m4Ip24ZfZbSv9nn3X7CarTCGA11eDutq1mDeVFEuvBvjM:Di2a5afOxIbKDcvjM","tlshash":"eb22b605b678b6f610ef583bf1ef5b841b332a72c7059051b4fa848d1fb89523262a5f","size":10850,"data":"","first_seen":"2026-09-08T18:03:27.071235Z","last_seen":"2026-09-08T18:35:53.942898Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,dmFyIFdQX1N0YXRpc3RpY3NfVHJhY2tlcl9PYmplY3Q9eyJyZXF1ZXN0VXJsIjoiaHR0cHM6Ly9lc2RhLnBsL3dwLWpzb24vd3Atc3RhdGlzdGljcy92MiIsImFqYXhVcmwiOiJodHRwczovL2VzZGEucGwvd3AtYWRtaW4vYWRtaW4tYWpheC5waHAiLCJoaXRQYXJhbXMiOnsid3Bfc3RhdGlzdGljc19oaXQiOjEsInNvdXJjZV90eXBlIjoiaG9tZSIsInNvdXJjZV9pZCI6Miwic2VhcmNoX3F1ZXJ5IjoiIiwic2lnbmF0dXJlIjoiZDBhODEwMWM4NjZjM2ZmZDk4ZmY0OWRlMjNhNGM4YjUiLCJlbmRwb2ludCI6ImhpdCJ9LCJvcHRpb24iOnsiZG50RW5hYmxlZCI6IiIsImJ5cGFzc0FkQmxvY2tlcnMiOiIiLCJjb25zZW50SW50ZWdyYXRpb24iOnsibmFtZSI6bnVsbCwic3RhdHVzIjpbXX0sImlzUHJldmlldyI6ITEsInVzZXJPbmxpbmUiOiExLCJpc1dwQ29uc2VudEFwaUFjdGl2ZSI6ITF9LCJpc0xlZ2FjeUV2ZW50TG9hZGVkIjoiIiwiY3VzdG9tRXZlbnRBamF4VXJsIjoiaHR0cHM6Ly9lc2RhLnBsL3dwLWFkbWluL2FkbWluLWFqYXgucGhwP2FjdGlvbj13cF9zdGF0aXN0aWNzX2N1c3RvbV9ldmVudCZub25jZT1hMDYzMWQyM2MzIiwib25saW5lUGFyYW1zIjp7IndwX3N0YXRpc3RpY3NfaGl0IjoxLCJzb3VyY2VfdHlwZSI6ImhvbWUiLCJzb3VyY2VfaWQiOjIsInNlYXJjaF9xdWVyeSI6IiIsInNpZ25hdHVyZSI6ImQwYTgxMDFjODY2YzNmZmQ5OGZmNDlkZTIzYTRjOGI1IiwiYWN0aW9uIjoid3Bfc3RhdGlzdGljc19vbmxpbmVfY2hlY2sifSwianNDaGVja1RpbWUiOiI2MDAwMCJ9","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f4b0a15e4f3cdd2f2f639de90ad68c4f","sha1":"9f5278074a8da988edb1d1bbd3172d9799d4ea5b","sha256":"2d097f7be88f93176e8377fcdf717dbd1ea591dfaf08e757d4925b576214b142","sha512":"b2383f100a8e578d48a96460e7afec00adb55caa0a0ece849fdf621fd0fe67a0056e25854a9bb5dbb29a811dd66b23566fc395cbbef2a4163b1e8da3b37b26fa","ssdeep":"","tlshash":"a2018e39b6849fa214d27ec0010dfa2904e6e95799540bb9e2b45e9e02ac9d87713626","size":786,"data":"","first_seen":"2026-09-08T18:03:27.097407Z","last_seen":"2026-09-08T18:35:53.992184Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/206785631fd53afee78d261eeb60c7f0.js?ver=0c7f0","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"47a628aef2f254c32c3b5878700a42ce","sha1":"43814a498670a432b6a73cc80e67bdc738313ea2","sha256":"ea64f589334f647f2254d595466c036000a3d9150ad078a69eba7f845c0c0713","sha512":"2dad1648412fe67306b86320bc4ba90a681086b4e799528ea9783157fdc1fda64dede2e9e7958d0973156ed3d9084034422ed9c4794bedb5c7b8151917540671","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORl:5rprxaefKI0LP19m4q1WW+h4Mjw","tlshash":"5e52c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13578,"data":"","first_seen":"2023-08-09T06:09:09Z","last_seen":"2026-09-08T20:41:33.550079Z","times_seen":15983,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,alF1ZXJ5KGRvY3VtZW50KS5yZWFkeShmdW5jdGlvbigkKXtpZigkKCcjdG1rLW5ld3N5LWNhdC1maWx0ZXInKS5sZW5ndGgpeyQoJyN0bWstbmV3c3ktY2F0LWZpbHRlcicpLnNlbGVjdDIoe21pbmltdW1SZXN1bHRzRm9yU2VhcmNoOkluZmluaXR5fSk7JCgnI3Rtay1uZXdzeS1jYXQtZmlsdGVyJykub24oJ2NoYW5nZScsZnVuY3Rpb24oKXt3aW5kb3cubG9jYXRpb24uaHJlZj0kKHRoaXMpLnZhbCgpfSl9fSk=","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"85354aefc8b25fcf347651bee613f0f6","sha1":"3377ff897390ccfac9420ae5d6579ce07a4d98cc","sha256":"d24ef3acd149c382192d8a9dad91d5359fa876ceb2f2dedb3e860822847cadd5","sha512":"0c85387858e15ef9432e9195ef0ce4087a2be7451b048329661c7ad90ff67e5f0834bf4c418b533fa5d21e9fe5d99f452ee4263e3b40201b0f748c853c4598fb","ssdeep":"","tlshash":"71d0a7ada36442c119e3b501e837524abfdb3c1f49c0a501325c1cd4df5be7c594a40e","size":233,"data":"","first_seen":"2026-09-08T18:03:27.082355Z","last_seen":"2026-09-08T18:35:53.993111Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/88232267fbdf39c1a9506f497d270c92.js?ver=70c92","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e46ca02fdc751b77c0865e4086d08ce2","sha1":"33078f30da7cbe3c664ff7e876a9d3efdbc58822","sha256":"0e9b18056530db5cc6194584814230c96a4b2fbe251c44a244852dbb0b448e25","sha512":"8e15c65208b6f558eb7511d76a5aa76628709ee8ecd09c20bed7227b497048ed8fa4220952579a8dd3df65bf756c79f651fc768e87a2d375495bc315710d87ea","ssdeep":"","tlshash":"50619f9ee2126b1b46eff2bf001f12950e33b464494a606c32ba26d4ce1ad11772f67d","size":3221,"data":"","first_seen":"2025-02-20T19:03:23.583029Z","last_seen":"2026-09-08T18:35:53.966856Z","times_seen":21,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,bmV3IERKQWNjZXNzaWJpbGl0eSh7ImNtcyI6IndwIiwieW9vdGhlbWUiOiExLCJwb3NpdGlvbiI6ImN1c3RvbSIsIm1vYmlsZV9wb3NpdGlvbiI6ImN1c3RvbSIsImxheW91dCI6InBvcHVwIiwibW9iaWxlX2xheW91dCI6InBvcHVwIiwiYWxpZ25fcG9zaXRpb25fcG9wdXAiOiJ0b3AgcmlnaHQiLCJhbGlnbl9wb3NpdGlvbl90b29sYmFyIjoidG9wIGNlbnRlciIsImFsaWduX21vYmlsZV9wb3NpdGlvbiI6ImJvdHRvbSByaWdodCIsImJyZWFrcG9pbnQiOiI3NjciLCJkaXJlY3Rpb24iOiJ0b3AgcmlnaHQiLCJzcGFjZSI6Im9uIiwidmVyc2lvbiI6IiIsInNwZWVjaF9waXRjaCI6IjEiLCJzcGVlY2hfcmF0ZSI6IjEiLCJzcGVlY2hfdm9sdW1lIjoiMSIsImFqYXhfdXJsIjoiaHR0cHM6XC9cL2VzZGEucGxcL3dwLWFkbWluXC9hZG1pbi1hamF4LnBocCIsImFqYXhfYWN0aW9uIjoiZGphY2NfbG9hZF90ZW1wbGF0ZSJ9KQ==","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"80e28e3a19182c6928d60e2ca6715585","sha1":"616c05f0315e503ecef1d2ccb5fadf3c1b6b2140","sha256":"0277f33e63b5a188a25239ea795a30d14e88d3725f832bba2cfcb8d3e6f87486","sha512":"93c1d8aeb0d6f3282a8aae819fb28ef53b88728913c9ec0e596f62380e4b8fe20050b375ddc52e2f45fffa5a0d80b5c2e16bdcde71d7ae220040f7836637ba2d","ssdeep":"","tlshash":"96f02716b001a957419bfbf1a0692e0c92fe06112ee4052e5fcb0f4407d72a6560fe6e","size":466,"data":"","first_seen":"2026-09-08T18:03:27.09161Z","last_seen":"2026-09-08T18:35:53.994132Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/13612708f6bea5ad1c467923242afce4.js?ver=afce4","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3e71574fc61389daf15e9585bcc93fe5","sha1":"92394cddb2ae40c7060c709621db86634b25fe1a","sha256":"2f441c962e351ef150f80bda82823c79cbb9ca057e0be5761a3584a3ba89b9e6","sha512":"028551afde3dd00b87ebd86e58888da9a3c317753760af83697602d9796956e687f83e5b1d60e3844d6f9b6acfcbb9cf93088116a6872e72ea6c2fafec85c50f","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O95:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XN","tlshash":"9c4235e16197e0f0c7c338a48816c051f2bf866cb8898054fb5dcdd22d5de07626b77a","size":12513,"data":"","first_seen":"2025-03-17T01:59:03.5715Z","last_seen":"2026-09-08T18:35:53.928915Z","times_seen":10317,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,dmFyIHdwY2Y3PXsiYXBpIjp7InJvb3QiOiJodHRwczpcL1wvZXNkYS5wbFwvd3AtanNvblwvIiwibmFtZXNwYWNlIjoiY29udGFjdC1mb3JtLTdcL3YxIn0sImNhY2hlZCI6MX0=","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"155d549b0478df57300f9c915016a02f","sha1":"d779d824171ff558f11866db06ccc28267f6bc1e","sha256":"14b3b8fd4c04cfda658a93a17ef8bcafa884829ec8b919856f091349b6517ea7","sha512":"dc7b24e37bb956f0234bc6fbb3dc23f7be7a12022137e0ceab8e2f9e1b7c4581f7dd0e56f3444c618b76b2fc1f2098410679c64ba9a6d7ae5ba46fa655dbdc1b","ssdeep":"","tlshash":"34b0126d67809a4a15e1d3c9071c33317050951b8d2b239bd24401401b5e068e404072","size":101,"data":"","first_seen":"2026-09-08T18:03:27.084406Z","last_seen":"2026-09-08T18:35:53.99504Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/bf8c60d78c44bf6b9e86854cea7b16a1.js?ver=b16a1","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"886d7c72aac16b4d7fad967aaa37b029","sha1":"aaa2f737cfe7e8a77138b812dfe6f3b67797204b","sha256":"27ea21a9138e53d9f2dd561bb0ca8bc012f333be06059e0d76b389f74b179f2e","sha512":"b4e52588f59f4ab1e9ab514530a7e563323368863f98c866ed453ce2c4e3d4314ee250a7dfea207b4bcf54b3edf66f1bbda641a4871589c33a9dab84054541d8","ssdeep":"96:PwSrH5hrG6Qpw1rIN2Bkqsu6B89w1y+7Y3qv5StcXyuC0r4oYeTnf49uVhWWTfjb:PwSrq6Qpw1rI2k1u6i9woa3hSSCP9+X/","tlshash":"17b1318db7737563125aa0f2b31b430ab3b6509ea128419d765cecf39cb490a1973fb0","size":5522,"data":"","first_seen":"2023-11-11T17:21:40Z","last_seen":"2026-09-08T18:35:53.94444Z","times_seen":3716,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,ZmV0Y2goImh0dHBzOi8vYXNzZXRzLm1haWxlcmxpdGUuY29tL2pzb25wLzUyMTkxNC9mb3Jtcy85NDkzMTQ3NTI0NjM1MTYyNy90cmFjay12aWV3Iik=","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a852af7a073c51a540f600a0b01e8c03","sha1":"b4c34cc39ca5b23c6ff3a8837d7db5c177cdbde4","sha256":"f6f1277d44ed2459efebdf7e3e60b3608fe70cd9ce1bda7eb1a1ed9fc055ceb6","sha512":"48841982c45c012921a905f6f8963305dd946d6ed6d72c6ca06c255c5bb71003a68b569d1330afca030f6fd28dd59cd8dc44dbabf2b830eb970ee4b7076f0323","ssdeep":"","tlshash":"f9a012b70000a035570b364920871188455617640e40f0a1812240b0bc844c27801f09","size":86,"data":"","first_seen":"2026-09-08T18:03:27.098966Z","last_seen":"2026-09-08T18:35:53.995866Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/f94d91facbf01e686ff9cfb4651b5e8d.js?ver=b5e8d","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f4136585ce0023c32d3ce11d02e6374e","sha1":"ea8d3a5ff2d5f7a469424360689a4f816e162c64","sha256":"09b3fc8f464862318879544a6972380cc46d44349eabf89794ab889490f4ca1e","sha512":"2e2391071fd6a666eea8325f8b9d932328ca95dc7d2c0a05a366189e590de2f23acc461483856eefbfead3ffe2d04fe96060e9600534a0c1cea48d909b98fe7c","ssdeep":"","tlshash":"ea61218936ef197853fa06fd26b9a329f6236c02701ac5f4546981242cf8f07367638b","size":3247,"data":"","first_seen":"2026-09-08T18:03:26.979663Z","last_seen":"2026-09-08T18:35:53.981949Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,d3AuaTE4bi5zZXRMb2NhbGVEYXRhKHsndGV4dCBkaXJlY3Rpb25cdTAwMDRsdHInOlsnbHRyJ119KQ==","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"04a9b59b7e49f913a3926f6431334155","sha1":"35f2521d3ab3f75895b02da9c6b5419e1a35be59","sha256":"94c4eed60653e14337c021261a52581e9b6f93ae9ba512912ca30ce656b3ac64","sha512":"40068c8ae55d5f7b8bdd0fcf5eabdf443cd6b033788c1686b0a96adf4f645bfd34d50ea7f0017c9514e3029752b213826373450e791760bf8310e0c303aaa750","ssdeep":"","tlshash":"57a0028530a76805c505d1605967fc00446415cb818eaa181ae5ee30e515598748232e","size":58,"data":"","first_seen":"2023-03-07T12:09:28Z","last_seen":"2026-09-08T19:37:00.460322Z","times_seen":19226,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,KGZ1bmN0aW9uKGRvbWFpbix0cmFuc2xhdGlvbnMpe3ZhciBsb2NhbGVEYXRhPXRyYW5zbGF0aW9ucy5sb2NhbGVfZGF0YVtkb21haW5dfHx0cmFuc2xhdGlvbnMubG9jYWxlX2RhdGEubWVzc2FnZXM7bG9jYWxlRGF0YVsiIl0uZG9tYWluPWRvbWFpbjt3cC5pMThuLnNldExvY2FsZURhdGEobG9jYWxlRGF0YSxkb21haW4pfSkoImNvbnRhY3QtZm9ybS03Iix7InRyYW5zbGF0aW9uLXJldmlzaW9uLWRhdGUiOiIyMDI2LTA4LTI2IDExOjE0OjQ3KzAwMDAiLCJnZW5lcmF0b3IiOiJHbG90UHJlc3NcLzQuMS4wIiwiZG9tYWluIjoibWVzc2FnZXMiLCJsb2NhbGVfZGF0YSI6eyJtZXNzYWdlcyI6eyIiOnsiZG9tYWluIjoibWVzc2FnZXMiLCJwbHVyYWwtZm9ybXMiOiJucGx1cmFscz0zOyBwbHVyYWw9KG4gPT0gMSkgPyAwIDogKChuICUgMTAgPj0gMiAmJiBuICUgMTAgPD0gNCAmJiAobiAlIDEwMCA8IDEyIHx8IG4gJSAxMDAgPiAxNCkpID8gMSA6IDIpOyIsImxhbmciOiJwbCJ9LCJUaGlzIGNvbnRhY3QgZm9ybSBpcyBwbGFjZWQgaW4gdGhlIHdyb25nIHBsYWNlLiI6WyJUZW4gZm9ybXVsYXJ6IGtvbnRha3Rvd3kgem9zdGFcdTAxNDIgdW1pZXN6Y3pvbnkgdyBuaWV3XHUwMTQyYVx1MDE1YmNpd3ltIG1pZWpzY3UuIl0sIkVycm9yOiI6WyJCXHUwMTQyXHUwMTA1ZDoiXX19LCJjb21tZW50Ijp7InJlZmVyZW5jZSI6ImluY2x1ZGVzXC9qc1wvaW5kZXguanMifX0p","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"682628628dd4501097c750c6146be576","sha1":"dee03ba28f1d105cb0d6a6f5b13b82d9cf68d3a8","sha256":"213e039af7de4f3614075e6ff849e6997223844405a3c3575bc86b6e6a86a98b","sha512":"29e0999cd3c4b8c6f5b028a78d5042a7e89ba49f197b4615de05723c55061fa30e56000f671c5a37f62836d2b4e6660b985e184d3b4cf3a08f041e8ab43413bb","ssdeep":"","tlshash":"bf0160910cf9cc264c4241c43c2cbb0960a8fe50a16b1c453b1f058d2ba976caac324c","size":717,"data":"","first_seen":"2026-09-08T00:02:21.466549Z","last_seen":"2026-09-08T18:35:53.997292Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/11d76825842913c1abe2e28b223328b0.js?ver=328b0","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"84da02f41d9c61dec95f05d41236d497","sha1":"2bb978916e29e01050ea71d2c68a299fc61f90d3","sha256":"9d8c33c2fb6efb6c3e9778edd19c6c60bf61e327c1132787e14f66cb7cba9726","sha512":"8fb2072d48ed3c279ea005d758d64467384ff0efa72e5ffbe547dda86a6cdd3aa28741a2d342ca28d9e98cb8ee8a0c8d05fad75455d47eb858d7f4101b81e40c","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5D:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjZ","tlshash":"ab52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","size":13453,"data":"","first_seen":"2024-11-03T23:01:56.192803Z","last_seen":"2026-09-08T18:35:53.961657Z","times_seen":10595,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,dmFyIGtiX2dsaWdodGJveD17Im1vcmVUZXh0IjoiWm9iYWN6IHdpXHUwMTE5Y2VqIiwibGlnaHRCb3hBcmlhTGFiZWwiOiJEaXNwbGF5IGxpZ2h0Ym94IGltYWdlOiJ9","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2d05d7fd1199c9df912240c47742d0e1","sha1":"0fef836b405d1b57943d9299e059e2d9992f1491","sha256":"6e07492122d1e70d249cb310ccba9480a1ca81c509a81142f2a7df076d8582fe","sha512":"ff5174e06f3e83c4fb666820bdd4af6a6c07d133afbb458eadc76089b72bdcf5236ad2389d51f0c2d8776492c0cd9027b648fa0e93dc6e74157c88097cb1c759","ssdeep":"","tlshash":"56b0124d13054c5a44c8bdc30408d373273f80989450b648caf254b2411503b482b450","size":96,"data":"","first_seen":"2026-07-31T09:57:41.404883Z","last_seen":"2026-09-08T18:35:53.99793Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/cloudflare-turnstile-js-after","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a2190c8e5b69265d76832b262b5bfd90","sha1":"24834f46ed555284cdbe576e78953a7ed7b06512","sha256":"f08800d5165f904f0679b840ccb4ef32b46306afcc6c4169a98c3fd3bb28d32d","sha512":"cc85987304be93bae019d5735b2b90714282f3de15c34d2711aa33df4196308b4985de04782caf940e9d6c13119a045f77f1b119b70266dd0efa49b5edf91ec5","ssdeep":"","tlshash":"e74192aed6a82bb433b3aa3834b6a3939d6a9496c02a6019886ba8050428cb0c090585","size":1878,"data":"","first_seen":"2026-09-08T18:03:27.089547Z","last_seen":"2026-09-08T18:35:53.99849Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,IWZ1bmN0aW9uKGYsYixlLHYsbix0LHMpe2lmKGYuZmJxKXJldHVybjtuPWYuZmJxPWZ1bmN0aW9uKCl7bi5jYWxsTWV0aG9kP24uY2FsbE1ldGhvZC5hcHBseShuLGFyZ3VtZW50cyk6bi5xdWV1ZS5wdXNoKGFyZ3VtZW50cyl9O2lmKCFmLl9mYnEpZi5fZmJxPW47bi5wdXNoPW47bi5sb2FkZWQ9ITA7bi52ZXJzaW9uPScyLjAnO24ucXVldWU9W107dD1iLmNyZWF0ZUVsZW1lbnQoZSk7dC5hc3luYz0hMDt0LnNyYz12O3M9Yi5nZXRFbGVtZW50c0J5VGFnTmFtZShlKVswXTtzLnBhcmVudE5vZGUuaW5zZXJ0QmVmb3JlKHQscyl9KHdpbmRvdyxkb2N1bWVudCwnc2NyaXB0JywnaHR0cHM6Ly9jb25uZWN0LmZhY2Vib29rLm5ldC9lbl9VUy9mYmV2ZW50cy5qcycp","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"5a46cd2cfea574cd531b70cebb7822f7","sha1":"5b252a7119c576a261402cd03e96bbbdb5f03021","sha256":"d510bf7efb2de7d8c3f4f429ce7861c0bf80d689c8d5cf2244f9bf8dd7ba8b2a","sha512":"40cfd800f6556b5495d510136ef28226d9f23c54787e654d0f26aa48d21b7371351a26535a640f8834c262f7adea303a73dce45ce9dc8e266f514579b433d375","ssdeep":"","tlshash":"75e0688d2c82b02733e87a3ac233976b32610b4024828a588e26c81424718d74896c8e","size":375,"data":"","first_seen":"2023-03-07T16:59:53Z","last_seen":"2026-09-08T18:35:53.999262Z","times_seen":771,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/f57148564b177b090686fcffae44ddc3.js?ver=4ddc3","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6f73586a858d460d08feddd855aa5e33","sha1":"c558e49d50b3864b4688a085646b43024954d93d","sha256":"249d06f7811fe0b5d9e017458d1422a9179929bbe091cd11ebd292676354272e","sha512":"285825674f7f054eef89b8ba1a7d0dd8420c8e0cbca9603307957d92b24ff83ecf58e9a43c9b75c328c7a4a196e5243db771259e4a13f972e957100cb4565982","ssdeep":"","tlshash":"b401c599229a142253e19d335b7b578b9726e14435f954c9d4a4d4c0bd20c9fb306d7c","size":733,"data":"","first_seen":"2023-03-11T08:29:29Z","last_seen":"2026-09-08T18:35:53.981354Z","times_seen":159,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/c1f223ff91df93f79e5b0425eabe16c0.js?ver=e16c0","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b6f90950aaf018e4070ca7f955e3ddfe","sha1":"f0b1514d13ce7ed594af8894ae7b17d10152d756","sha256":"f81a4a9211214d226d5a01b81b8956b91089eb622ab70572dcf54e6b707521a8","sha512":"0675161dd96ac91cae531196f48a952bc1c2d2493deefb6a0385b6e2cba9e6e6c98740a60e6656b35c924cfb0db7541e40f22d5e56726096a277a0e897c3f0ab","ssdeep":"384:Ar7mIr/Dh5rA3rzB4rMhr/XWGHW/6rMz1xftF2OUVP4eAnbhfreD6dCBEOav7blR:+SxxGG2/71xftFqVP4eAnI0ROavPSCzN","tlshash":"fab2848f73407425428bf16696af020fb137655c7a4790acba6ad8db1cb984d2037fbd","size":24140,"data":"","first_seen":"2023-03-08T20:11:00Z","last_seen":"2026-09-08T18:35:53.962254Z","times_seen":798,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/d9ae71ae4f7f7b91646899e5c1b8150c.js?ver=8150c","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a3366207511a2e81bfb0579d31ae660","sha1":"e385fb4ee983e217a9ce3922ad17052267f39ccc","sha256":"9cdb9e59327fb06c4c553b8d0f1c1aa916a420aa40ddbad8b93dd0b653c3b681","sha512":"8dd0c46df12a92ae4f3aff0b10cadcebbcd44e9d98008aaaebf4e9bed25f1d3bab9a3612db1085e36d08f6a54d9d7d7fd45cd7d8b72ebb499dd6166f24d4e5fd","ssdeep":"","tlshash":"55711009a2fe1a7b05d31f77c84148f26b953a726e4b123338e58416d6d96cf01a3fa9","size":3786,"data":"","first_seen":"2026-03-28T14:00:23.212646Z","last_seen":"2026-09-08T18:35:53.918815Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"challenges.cloudflare.com/turnstile/v0/api.js","fqdn":"challenges.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.18.94.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8c293f28bf75525387922c868a2e0613","sha1":"cc0dcd1691110ac1542aec855f958dce4c6931f7","sha256":"14cbe02e19ad46e094496792226bce69d616a45074eed26f4c1850c51912ddea","sha512":"f083ef372cca3be23d53452e37d93ec761dc4df401d4eab7ecbb94881577ddbe1ff1537721cc38be1dcb0c205ec0cdb8a475964ff5c14ffb27942a947f26a32d","ssdeep":"1536:DL3dUa2dOjYj/gAmugU6aKLHXdAU7zMEBvOegEWGqcSlL:fEOjYtT6zXdzMEBvOejQR","tlshash":"e2831bc8729a787213dac1b4a07f5353b3297d35584c8850e527d8663a7ce878273fba","size":86603,"data":"","first_seen":"2026-09-08T10:35:27.937568Z","last_seen":"2026-09-08T20:13:44.907132Z","times_seen":403,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"JQMIGRATE: Migrate is installed, version 3.4.1","filename":"https://esda.mom/wp-content/litespeed/js/206785631fd53afee78d261eeb60c7f0.js?ver=0c7f0","line_number":2,"column_number":981},{"level":"log","text":"[LiteSpeed] Start Lazy Load","filename":"https://esda.mom/","line_number":1769,"column_number":13025}]},"http":[{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/d9ae71ae4f7f7b91646899e5c1b8150c.js?ver=8150c","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.092Z","timestamp":1788892516092,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/d9ae71ae4f7f7b91646899e5c1b8150c.js?ver=8150c HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d51afa932d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"eca-6aa04bf2-b465bb24d87afbb7;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:58 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=em9yAWTndGfNM5OItJ35xdv%2BPg8XyEQ%2BhyNdbHXAcw15EcW0Bzu%2FuJKPttXWfY%2FbWMOL4DQFHxftEKfOtswtIK8KLHjJ5oj5mqryGOHJbjCpN%2FF7OMNh0PQ8kJTGolfgX5fkUoyE\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1074\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":3786,"size_decoded":1933,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (3784)","md5":"7a3366207511a2e81bfb0579d31ae660","sha1":"e385fb4ee983e217a9ce3922ad17052267f39ccc","sha256":"9cdb9e59327fb06c4c553b8d0f1c1aa916a420aa40ddbad8b93dd0b653c3b681","sha512":"8dd0c46df12a92ae4f3aff0b10cadcebbcd44e9d98008aaaebf4e9bed25f1d3bab9a3612db1085e36d08f6a54d9d7d7fd45cd7d8b72ebb499dd6166f24d4e5fd","ssdeep":"","tlshash":"55711009a2fe1a7b05d31f77c84148f26b953a726e4b123338e58416d6d96cf01a3fa9","first_seen":"2026-03-28T14:00:23.212646Z","last_seen":"2026-09-08T18:35:53.918815Z","times_seen":6,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/ico-2.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.310Z","timestamp":1788892516310,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/ico-2.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d52fff232d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"2772-6a70bf7c-8e7b9662bd649f6b;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 16:19:08 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HWmNnC4%2BsZtmc5ynr6kFEnvFgJD8CUvocve41tfJ9IKbNx%2FvUVDi1S1fJ2CX3m8D%2BFUfqKBUuZFMHN%2B9%2FxSn%2BteNTeieUp%2Bfh%2FL4cbeK50oQHbHZ8m062OaNqeN5zgpKhmW3OveX\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10098\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10098,"size_decoded":10912,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4d5417a5fc5d02f67390dcf51abce4ce","sha1":"146409abb682bccabd5d5800899878d23b4fcfed","sha256":"9b3e0af12bb02609d04147b867d82c101f2f0242ad323214ad6c33504efb9ca6","sha512":"76d6c46397a182cdf5e9fa4200e24e27645d30b21c57054c39deda654ae79df4e2d01098d3fc9852d94fab2903d774c089a7b95a15a3a014127cec383921a28f","ssdeep":"192:Uu/YNMtKw8ti+ULFBnIxRlC0myZLFe9TZlY6cAz0OyNMC:UqYNg78tOin3m+LoTZlbc+CNMC","tlshash":"ed229e7a17e3ed2edd61cb34c4a86bb1c4e7132c6b334723d114cb1131a7994ae5964e","first_seen":"2026-09-08T18:03:26.975624Z","last_seen":"2026-09-08T18:35:53.919455Z","times_seen":2,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.549Z","timestamp":1788892516549,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Thu, 10 Sep 2026 18:35:16 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hf65JooE3nwkPfwdCrfWARcPoTBfeTVizab8VNmRnLPjhNA%2BzJfRP7uh1f02WHYUeBbc7BxMtPz0OYOqjADIJ7WJTSQsDsDoH%2BtAqPyFk1T%2B4rJeXmalVTPBXA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\nserver: cloudflare\r\ncf-ray: a3800d54786732d7-CPH\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1284,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-08T20:16:20.746634Z","times_seen":432067,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.mailerlite.com/js/w/ml_jQuery.inputmask.bundle.min.js?v3.3.1","fqdn":"static.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.602Z","timestamp":1788892516602,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /js/w/ml_jQuery.inputmask.bundle.min.js?v3.3.1 HTTP/1.1\r\nHost: static.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 07 Sep 2026 11:15:33 GMT\r\nvary: Accept-Encoding\r\netag: \"6a9e9cd5-1153a\"\r\nstrict-transport-security: max-age=63072000\r\ncontent-encoding: br\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=3,i=?0\r\nage: 6744\r\nexpires: Sun, 13 Sep 2026 18:35:16 GMT\r\ncache-control: public, max-age=432000\r\ncf-cache-status: HIT\r\ncf-ray: a3800d54cc860731-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":70970,"size_decoded":19370,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32046)","md5":"775cee1998fe3d9fc0cb4450c293bbd5","sha1":"af3a53c3c3b63e59afc5e864f1050dd22a384108","sha256":"c77ae965196f7308b827ce8cef39758740e9652e49958d866454ca1967e03dae","sha512":"80d47478fd97067ea8573c2c6274a8df7a4d6fc8137ff93529af6fae0f0a96afa4b915c85a723c87c213823edc13627213c1d09f2a3bf1613c4939d26310f118","ssdeep":"768:n4EnGeFpoDyrBqnTOFAuPg7DDbsp5pKSwttCCVkv6pE54J5m872U1jVNWFaHRFUl:nJp6nTO2ulKJQCVkvQm87nFVN4aH20U","tlshash":"da63d7967b52b29a46e370f840ff8407a07aef9a34d94190f186b1c47839ed607b7e74","first_seen":"2023-03-07T12:08:55Z","last_seen":"2026-09-08T18:35:53.9207Z","times_seen":1850,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":2,"connect":2,"send":0,"wait":35,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/66ea9795278d1cb2fbccc0fd70c4e957.css?ver=4e957","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.817Z","timestamp":1788892515817,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/66ea9795278d1cb2fbccc0fd70c4e957.css?ver=4e957 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fef1632d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"b5c-6aa04c5a-e3ee0c1a89d19dab;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PTqrFTwbyx3BeR2lKLIgBe%2FfEAg8n%2FrWZLV9AhrHNPnZcmZAEorZwu%2FJSV15YvnR8P5Vmv9V2%2BUs0GKwS2jwzCqfUNI96CnBc5mLcbE74XAJ7R6%2Fho%2F8iw5WKfebp2Kw7Nmtux0i\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":2908,"size_decoded":1531,"mime_type":"text/css","magic":"ASCII text, with very long lines (2908), with no line terminators","md5":"8ec742c0dff59a53604509ce68ee260e","sha1":"95f4624478ea4b0df7aa47864b34aa901dc285d0","sha256":"4a2982900b5cad4775aa5874c54c491c0c002f671bcf2145fdb7ce9334d700cc","sha512":"0e1f425732d00c8d26c6737958f6538a8e7c3025d7300f8c2c5067d1884ba4a32184d5450e800297f7aadc99acd3f9e3c0531cc99859df74457f9ba5f54d25f8","ssdeep":"","tlshash":"d051cad57364966d2f2e8bdcd21b115b6118f0c2d50e2a84b11fc5e0a3cf3e22ed25a3","first_seen":"2025-08-16T01:02:42.323106Z","last_seen":"2026-09-08T18:35:53.921238Z","times_seen":590,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/ico-1.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.078Z","timestamp":1788892516078,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/ico-1.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d518f9932d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"2e28-6a70bf7b-45c441559df9f167;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 16:19:07 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ll2bAqCc91oGCJo7z1k8Cu8f7w7AEjA0zJQ5HV14KwO12%2FTMtHamqn476KaCFV8%2Bk7Fc6F2WrJZ8H9nX1u4zkTrCnuap%2Bq%2Fp5NgqPNMybrbB9qiav6PsmVpZN2UuQL0%2BoAD49soT\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11816\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11816,"size_decoded":12624,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"10f0a5734e8c027c2a93ba1876a206ea","sha1":"eac1d3a064e6c60a94b6604325a8bddd33b2d321","sha256":"46f5021422321bb1c672d6f5adad3db320e1c4b82b314c323ac4165ccf4adbd4","sha512":"ee043cb639e10231db81d64a05519620e970c69bbfee70965e4eeae69048f5f219c54557031abe59897b84777d77f01749ac3bb7b2111625f4bee7b46e82475b","ssdeep":"192:Pu/YNMtKwF22WlOjumkehH7UPVrzSaQIJoiuR4xn8x/gsYhgooE90:PqYNg7FClIRkb1CiRktpEm","tlshash":"1332aebfd7879e5ede26b37469ac7af2d011834e87b602236448e711719c1c84a4564e","first_seen":"2026-09-08T18:03:27.059623Z","last_seen":"2026-09-08T18:35:53.922192Z","times_seen":2,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.287Z","timestamp":1788892516287,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 35156\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 18:27:47 GMT\r\nexpires: Thu, 02 Sep 2027 18:27:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 518849\r\nlast-modified: Mon, 15 Sep 2025 16:30:01 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":35156,"size_decoded":35969,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 35156, version 1.0","md5":"062c1f2aaf2d4de07ad2a2f21c17ffc0","sha1":"3fd1f07343bd33a53cd374f7f107dbdf9effae03","sha256":"d5bab8e28732fe3d10dcef4f77b9c248605bbb2a87d289a2539251ceafab536a","sha512":"7ab522d8bc41128be5a15f2cb91f851f6dc5e437afbb90e6191bbe63d9b94a35911f04701fb2b291362b2ae0f0cc639dec2d15e53928afc5769590a2937e81cf","ssdeep":"768:is48okTArkNSgZJAf5jkRcaUNt8wrNPCbJktQV+n+NUB/wo8IEH:5hNTtNSgZJMjkRBUMwrNPC9NV+n+o81H","tlshash":"22f2e172c3787192ae0985760d60cec8986bb2098f7658b0143fdd38ee45345a3f6e6c","first_seen":"2025-05-29T19:30:52.507782Z","last_seen":"2026-09-08T20:06:38.24593Z","times_seen":25694,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":21,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/antonio/v22/gNMEW3NwSYq_9WD3yHQiFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.290Z","timestamp":1788892516290,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/antonio/v22/gNMEW3NwSYq_9WD3yHQiFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 26592\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 18:50:35 GMT\r\nexpires: Thu, 02 Sep 2027 18:50:35 GMT\r\ncache-control: public, max-age=31536000\r\nage: 517481\r\nlast-modified: Thu, 04 Sep 2025 17:35:30 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26592,"size_decoded":27405,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26592, version 1.0","md5":"9ffb4e65d3fabc3e6b4d5d592ba92226","sha1":"6723345bc609421681cb916105476c4cc3f92db1","sha256":"82661feca9e5b933308629a630caa991566250273379a213b6af257fbdfaa71a","sha512":"875d8c78514e049f096b0a14b842b7a8e5fda5cdf82e834dab85409017abee37006801f2d966731a7de9f82761dcaf0fbd41577d055c03c8993cf3cfebdab03d","ssdeep":"384:M71UJO6FUW3VVcdSpjAjWf33IucscRM+lDgary6sSfUHx1NYmdMCEocIR4yf:M71UJv53V/rydgAFsSfUHxjnJEo/ayf","tlshash":"17c2f2433d9f606c935b88b2b069b596875810b4e3a1763bddc967146ff0cf19ad2070","first_seen":"2025-06-04T00:24:55.422247Z","last_seen":"2026-09-08T18:35:53.925008Z","times_seen":568,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":46,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.292Z","timestamp":1788892516292,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48320\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 08 Sep 2026 04:06:14 GMT\r\nexpires: Wed, 08 Sep 2027 04:06:14 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:30:41 GMT\r\ncontent-type: font/woff2\r\nage: 52142\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48320,"size_decoded":49132,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48320, version 1.0","md5":"dcf31ebe107435bd68e0164d59e19b87","sha1":"b68160c9333af833fe483928b3ef7128c07a56a0","sha256":"d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0","sha512":"130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08","ssdeep":"768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE","tlshash":"1623f218f29471f7edecd4d500a18c72baa528d442f116ed07b8d53ca36ca817a729fb","first_seen":"2025-09-17T00:07:53.723302Z","last_seen":"2026-09-08T20:26:56.275017Z","times_seen":339166,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":41,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/themes/esda/img/menu/menu-link.png","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.296Z","timestamp":1788892516296,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/themes/esda/img/menu/menu-link.png HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/wp-content/litespeed/css/7b79541c953d1f75f907f6e31ae9bcb6.css?ver=9bcb6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/png\r\npriority: u=4,i\r\ncf-ray: a3800d52efe832d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"59-6a5fa107-60c17e2944546431;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 21 Jul 2026 16:40:39 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DBKMsB6z5n5cMyTNwAs0JfvykcUQVo98PT%2FfPBgIkOlzFWo6aKdxNYu5%2B74oGzVF3WRrhuDBE0%2BtRTL2NLDfexJ1CdLjkjT%2BE9O33qmutQmyKho4fDf8a3831tycKnzQl2ImLIq5\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 89\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":89,"size_decoded":889,"mime_type":"image/png","magic":"PNG image data, 7 x 120, 8-bit gray+alpha, non-interlaced","md5":"01432c669bc16d61d0079a587189aa91","sha1":"1e6a37890065ffa1722e7040cf57a1097ba3f493","sha256":"1d3dd51e41f131449dbf841346523c1c2e619d984b93d13c0c46a10f29511b5e","sha512":"7a452aa0193a8d7616189102fde6c6a851ccb7be422e9f55697a7d64d02c1bbfb2b4006b739a30ce3ad2c8b48445a5fe275baad7db5edca7b9f8637f58dd9ed1","ssdeep":"","tlshash":"44b012c155805e28d76b13b3020ca027d8b14086942309c90205842a6001348069e357","first_seen":"2026-09-08T18:03:27.017899Z","last_seen":"2026-09-08T18:35:53.92634Z","times_seen":2,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.pl/wp-json/wp-statistics/v2/hit","fqdn":"esda.pl","domain":"esda.pl","tld":"pl"},"ip":{"addr":"104.21.21.235","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.632Z","timestamp":1788892516632,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.pl","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 23 Aug 2026 16:00:35 GMT","end":"Sat, 21 Nov 2026 16:58:14 GMT"},"fingerprint":{"sha1":"4A:08:B1:8A:F7:E7:55:9E:B7:2B:BC:C6:4D:F6:FF:71:E9:AA:AE:13","sha256":"72:59:A2:C4:42:93:92:33:C0:7C:44:9F:8D:32:71:53:DA:98:AD:F2:7F:C4:7A:86:2A:56:FC:58:FC:45:53:46"}}},"request":{"raw":"POST /wp-json/wp-statistics/v2/hit HTTP/1.1\r\nHost: esda.pl\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 146\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":146,"data":"wp_statistics_hit=1\u0026source_type=home\u0026source_id=2\u0026search_query=\u0026signature=d0a8101c866c3ffd98ff49de23a4c8b5\u0026endpoint=hit\u0026referred=\u0026page_uri=Lw%3D%3D"}},"response":{"raw":"HTTP/3 200 \r\nx-dns-prefetch-control: on\r\ncontent-type: application/json; charset=UTF-8\r\nlink: \u003chttps://esda.pl/wp-json/\u003e; rel=\"https://api.w.org/\"\r\nx-content-type-options: nosniff\r\naccess-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link\r\naccess-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type\r\nx-robots-tag: noindex, nofollow\r\ncache-control: no-cache\r\nallow: POST\r\naccess-control-allow-origin: https://esda.mom\r\naccess-control-allow-methods: OPTIONS, GET, POST, PUT, PATCH, DELETE\r\naccess-control-allow-credentials: true\r\nvary: Origin,Accept-Encoding\r\nx-litespeed-cache-control: no-cache\r\nserver-timing: cfExtPri\r\ncontent-encoding: br\r\ndate: Tue, 08 Sep 2026 18:35:17 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zjWH8Xqk1wG3jepkxJ55E8Us3dsQLqTpEy7%2BuYXTHL1ZAw7DMjCOCPn9A08E%2Fs%2BRGBAVIjd5YIzY7hX0iPqCVNIX4OGqMRGjBLiU1cIi4MLIPX2LV5zWOTDt\"}]}\r\ncf-ray: a3800d557d8eccdf-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 40\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":36,"size_decoded":1259,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"ca28500b2b40001a3684591484d04d82","sha1":"dc9efe1ac5d634e7fd9177dd917023ef2e6fb7c5","sha256":"39e0415d19ac657ae6f479d2f89c179bbd43cefdb25aa1ae0e7e16fa53fe95d9","sha512":"9ab2ba0182e703f4b11aafac5d186f10a0c01fb46739672634228ee8a868f250e2a87f3b89cb2d81287842c9c8e3509c861aee6395ce447255537aa8c22d0b91","ssdeep":"","tlshash":"5e800404340004144d4005d37301001037101701d00d1140544d515570450d1741cc15","first_seen":"2025-01-26T06:35:28.864306Z","last_seen":"2026-09-08T18:35:53.927036Z","times_seen":151,"resource_available":false,"data":null}},"time_used":1052,"timings":{"blocked":0,"dns":45,"connect":29,"send":0,"wait":977,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/1cbf7936ea1957afc9993a262f4592b9.js?ver=592b9","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.049Z","timestamp":1788892516049,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/1cbf7936ea1957afc9993a262f4592b9.js?ver=592b9 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d515f7232d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"42e-6aa04c5a-7208edbb07ffd3f;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yXswAdA0uwN%2F05W4hIp1EkV4%2B%2B8XTVvznYxZdgq1CZAbYeE6kgU0Jpai%2F2pQmVI89Gc7iDZfbXuVUoXlX9rQMnHikjOZX6JQxHDTEMTbdCCMttCZBVR4z55Is4GGcxv%2FXiUQPoYf\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 409\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":1070,"size_decoded":1266,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (505)","md5":"d1776fc1150fd7de4b14a9070eacb939","sha1":"3f12b2f69ace985d22a9cc3453fe1852d50b7f68","sha256":"fd3d363d5e61cfefdcfe5f09ee579ffe2d7861dbfc7ca08eb877481715147789","sha512":"3a4350e16433ce4736d82c84dec1b5e65c09f7da03d6f5cf4784d330bca9393506e93f78fe6bc8de37d0073ffb8d42cd9cdc39c8c319d6457fc9fc5ff3981eb4","ssdeep":"","tlshash":"34111224620031176dfff0ff010b030b667dd63a4909f54060bc47e92d76a65589beba","first_seen":"2025-02-20T19:03:23.581399Z","last_seen":"2026-09-08T18:35:53.928231Z","times_seen":21,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/13612708f6bea5ad1c467923242afce4.js?ver=afce4","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.069Z","timestamp":1788892516069,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/13612708f6bea5ad1c467923242afce4.js?ver=afce4 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d517f8e32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"30e1-6aa04c5a-2ed658be8c72bf7b;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JocMGueiOtMAv%2BSYh%2Bw3LDi6%2FYCsq1bmmFUsEO8QSMhlpQ9u4U0I79AJmlXtgBdpvRjsZMAJ4DoqKDMCAaZ1JecRCQEXp3udJ%2F5GZ6CnV4lB5mpQtVLPJZ9MOqNlLdz7gYH%2FH8B%2B\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3372\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":12513,"size_decoded":4234,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (12511)","md5":"3e71574fc61389daf15e9585bcc93fe5","sha1":"92394cddb2ae40c7060c709621db86634b25fe1a","sha256":"2f441c962e351ef150f80bda82823c79cbb9ca057e0be5761a3584a3ba89b9e6","sha512":"028551afde3dd00b87ebd86e58888da9a3c317753760af83697602d9796956e687f83e5b1d60e3844d6f9b6acfcbb9cf93088116a6872e72ea6c2fafec85c50f","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O95:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XN","tlshash":"9c4235e16197e0f0c7c338a48816c051f2bf866cb8898054fb5dcdd22d5de07626b77a","first_seen":"2025-03-17T01:59:03.5715Z","last_seen":"2026-09-08T18:35:53.928915Z","times_seen":10317,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/1e4721c33cea38ca73a367436f7d7109.css?ver=d7109","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.809Z","timestamp":1788892515809,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/1e4721c33cea38ca73a367436f7d7109.css?ver=d7109 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fdf1032d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"1ca-6aa04c5a-9e127cab5c0d0b04;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QBGdGtInh4cGLp9iUa2BdUGJOJLep1VpM8bNfgqG4y3fnlXVi4%2Fa5vdiVh4u08MrvrgliBT2G8Q0I2krf1bggNlTk%2BYQL9A3e9M6T1OrHfeX1g0xqfaKpbNMuTnLGSehezIbWLtV\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":458,"size_decoded":999,"mime_type":"text/css","magic":"ASCII text, with very long lines (458), with no line terminators","md5":"3beeb2018ca3035c847bcc1061ad9fb8","sha1":"5fb36c134b44e1dd1ec8b7fdeeb48b788a7115bb","sha256":"1ae19e0d1ee8eec69e2497f4ef75ebc2948d80224d3631e47689ab16139935bb","sha512":"d571ccd47bbcb4864405146a89365dc4f9bd08e38e6b83bd628f9f712bd2698e7de4ee46f06b29542f3b332b2a1f437fb03559ea7755c767be248c5b87122910","ssdeep":"","tlshash":"56f0a021171c70284c33da2261a7f04951e59037f3a214fe5efbd807e5271d50aa37db","first_seen":"2026-09-08T18:03:26.978356Z","last_seen":"2026-09-08T18:35:53.929695Z","times_seen":2,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/fg-9-200x300.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.831Z","timestamp":1788892515831,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/fg-9-200x300.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: image/webp\r\npriority: u=3,i\r\ncf-ray: a3800d4fff2132d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"d384-6a7edddd-5fb471bade39307d;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Fri, 14 Aug 2026 09:20:29 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fqQSC73ocwVT7ZJVl6fdHjxYMS6ZsFAiBCt4GHjTVqImJilI6664Ta4LVTTReiY5GjJA6f7qbUr6j4Qq2RVtX%2FxwSt1MTtaalZkWCnl%2FW6ryP1yyOiJrcFU6JEGjmuN7Z8FJx%2FVY\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 54148\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":54148,"size_decoded":54952,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f37c06594a81d4cfeb1667ca7084ce38","sha1":"7e58abf69c90d03a71d5740267f1be1b9de4a425","sha256":"c205780fc44443b6afe82a145a9a95cd95176d118731e3803703bd628942183a","sha512":"9cf8cb5b50e1403da92208d0a85507afedf73962eca888b239d519d825260765e1f30d281a5b51b61bcaae367aac3c574653565c8b717a22f4406ebb9d876086","ssdeep":"768:cJxz3o3g9BuYu1AwfFwTwy81zgDDlNPnrK7vZ6IA7VXfy+WTF50h:cbzlQPyTz8eZ5rKV6f7U+th","tlshash":"6433e714ede232da942aadb7e88234cdcfa3879adc50020fb6ccf7151f5056d5dab14a","first_seen":"2026-09-08T18:03:26.995044Z","last_seen":"2026-09-08T18:35:53.931502Z","times_seen":2,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/themes/esda/img/menu/ico-accessability.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.076Z","timestamp":1788892516076,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/themes/esda/img/menu/ico-accessability.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d518f9132d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"5b8-6a5fa107-a01272622ca0172;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 21 Jul 2026 16:40:39 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LoUH%2FrZDOlU%2B9WkYB%2Bq9unOofhPbg8ztaJi7l%2Fk%2BCpRrJiGOsqA%2B4sbOr%2BkbkuTzxUJ8BdW%2FktMk08lFrLROdLdEQjXGzXTax1awyNl00VPnKjdQsu8hf%2Bxg1a7EF9ClJ18tX0pD\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1464\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":1464,"size_decoded":2277,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ef7f54b6a402f0ac4b7208640395df44","sha1":"392014ccdc5d8b3788467a82e01c6f57c17f951e","sha256":"0ff5ff83bf02275fd7e4ee36dccfc1692bf2d67ab57b7726ff81fd9e49808013","sha512":"9827ae4bde1ac5c1dfda3831c947403fd896be247441dc15b727a1e2d95850f27cfe6f24eabd110e6fdde14786f510d7cb2b59dce30340a3f34605003440b2d7","ssdeep":"","tlshash":"d031e902d4e84a93c560b67903b3d770a1d84861fa6c9f52372a10a86876be7d324868","first_seen":"2026-09-08T18:03:27.044498Z","last_seen":"2026-09-08T18:35:53.935872Z","times_seen":2,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.280Z","timestamp":1788892516280,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48320\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 08 Sep 2026 04:06:14 GMT\r\nexpires: Wed, 08 Sep 2027 04:06:14 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:30:41 GMT\r\ncontent-type: font/woff2\r\nage: 52142\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48320,"size_decoded":49132,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48320, version 1.0","md5":"dcf31ebe107435bd68e0164d59e19b87","sha1":"b68160c9333af833fe483928b3ef7128c07a56a0","sha256":"d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0","sha512":"130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08","ssdeep":"768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE","tlshash":"1623f218f29471f7edecd4d500a18c72baa528d442f116ed07b8d53ca36ca817a729fb","first_seen":"2025-09-17T00:07:53.723302Z","last_seen":"2026-09-08T20:26:56.275017Z","times_seen":339166,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":12,"connect":24,"send":0,"wait":24,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/themes/esda/img/menu/menu-link-end.png","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.297Z","timestamp":1788892516297,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/themes/esda/img/menu/menu-link-end.png HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/wp-content/litespeed/css/7b79541c953d1f75f907f6e31ae9bcb6.css?ver=9bcb6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/png\r\npriority: u=4,i\r\ncf-ray: a3800d52efe932d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"59-6a5fa107-d2431e067e3f020f;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 21 Jul 2026 16:40:39 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VVo7AXOLLJdfmjHtNiDrbFeBK%2BYGqekW78EEs%2BbqgeHbkwPK8Yybpva9ji80w7inHEuomWeZ718hO9cdvhDSN72HjW0d1z%2F8SC2B9cKPtJQ%2BEvHkd1s3fFF5JXB%2F5hym1og91sJe\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 89\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89,"size_decoded":891,"mime_type":"image/png","magic":"PNG image data, 7 x 120, 8-bit gray+alpha, non-interlaced","md5":"385ccc58c46fa53ebe6c72a7a2d4ddfd","sha1":"8c167b99d9638d40a93ec31acf752b97758f980d","sha256":"fd22232734826a8008709f7027048901624213f64edd094b89caaf2fc4498098","sha512":"a46db12559442357a7b77a5b48f7aaa828254d4a0aae42ba442636984d80ce831057bdcb561d4a909e5c966e34d397b47155c9863960a7bdfed0001504d3b796","ssdeep":"","tlshash":"2ab012c2d5001938d60f033300146032dcb9030644231985020e511e545520042492ab","first_seen":"2026-09-08T18:03:26.970717Z","last_seen":"2026-09-08T18:35:53.938064Z","times_seen":2,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.mailerlite.com/fonts/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2","fqdn":"fonts.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.495Z","timestamp":1788892516495,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /fonts/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2 HTTP/1.1\r\nHost: fonts.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.mailerlite.com/css?family=Roboto:400,400i,700,700i|Merriweather:400,900i,900,700i,700,300,300i,400i|Lato:400,400i,700,700i|Montserrat:400,400i,700,700i|Montserrat+Alternates:400,400i,700,700i|Open+Sans:400,400i,700,700i|PT+Sans:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i|Roboto+Slab:400,700|Ubuntu:400,400i,700,700i|Titillium+Web:400,400i,700,700i|Nunito:400,400i,700,700i|Cabin:400,400i,700,700i|Oswald:400,700|Work+Sans:400,700|Exo:400,400i,700,700i|Comfortaa:400,700|Raleway:400,400i,700,700i|Oxygen:400,700|Poppins:400,400i,700,700i|Playfair+Display:400,400i,700,700i|Shadows+Into+Light+Two|PT+Serif:400,400italic,700,700italic|Josefin+Slab:400,400italic,700,700italic|Arvo:400,700,700italic,400italic|Vollkorn:400,400italic,700,700italic|Karla:400,400italic,700,700italic|Noto+Sans:400,400italic,700,700italic|Barlow+Condensed:400,400italic,700,700italic|Anton|Inter:400,700|Abril+Fatface|Yeseva+One|Poiret+One|Marck+Script|Pacifico|Fira+Sans|Rubik\u0026subset=cyrillic,cyrillic-ext,latin-ext\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: font/woff2\r\ncache-control: public, max-age=432000\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\nx-content-type-options: nosniff\r\nx-cache: HIT\r\nx-envoy-upstream-service-time: 1\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\nage: 24464\r\nlast-modified: Tue, 08 Sep 2026 18:02:46 GMT\r\nexpires: Sun, 13 Sep 2026 18:35:16 GMT\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: a3800d541a460731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42964,"size_decoded":43525,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 42964, version 1.0","md5":"23145c7141614ebba8c5dd949478c01e","sha1":"b1aaf991a2646a862ebc2d5cae3d2e2dc9951b7c","sha256":"441af0def989ebfdbd6ad85ffaed85e967ab21a05f1dd342f16259464a206dd0","sha512":"6f16ee54881abe3bc609da213a0d44c72fbbc16f7c4df0f27a971ec8ba9400d1f29718d58fa00b92a4b2e9d8f4f646122e00d21d562e2e7c44cab17ca76ab260","ssdeep":"768:5PffQbtnceACc7f8PRBB0/z2awp3Pw0/kGrziGewCqu1N9CCn2M1X2HjpGbceBch:NkSr1oPGz2aO3o4biGeLqu1bB1X2H0b4","tlshash":"8213f173a21d7958f5bd7aa232478a03626df095feb2dd0c9150984d07b286f23d5a32","first_seen":"2025-09-17T00:14:07.581362Z","last_seen":"2026-09-08T18:35:53.939444Z","times_seen":15280,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/74de1e63fefa7fcefbf915465e5b28d4.css?ver=b28d4","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.797Z","timestamp":1788892515797,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/74de1e63fefa7fcefbf915465e5b28d4.css?ver=b28d4 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fcf0732d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"3eb0-6aa04bf1-8b210dd5b71825bb;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:57 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z9E0CyRx3sV7k1LYIHDm4Fxg8l7vtsmRs4Hab0TJitphrtbjvmnPyLVMlDF9x9SswAA7cHvl7pMVLeDQ%2FS4SDSfxXYwtYFWYqkmAmL8HFMM1WhQMbFicGFzmC8LzLLoVSQKB7dQQ\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":16048,"size_decoded":3557,"mime_type":"text/css","magic":"ASCII text, with very long lines (16048), with no line terminators","md5":"741b85d6f113e77553562793047baeac","sha1":"c3832fd6f1d7a49d6b93b58fe3800396408db4da","sha256":"9629f9c0a19390cc89b9713169bd8440426e789461529fb0fb592feaeaa63c82","sha512":"27e4948b28738893a3c3545c55b7a2cc97a97b2fda77778a062993dc6c1781cde791f8ad0bc56983b49c73704d00a6feec315b1fe952344079d70fb80d6c8824","ssdeep":"192:dRCD6WirLKYABTFJ5vshiYQqSIdGhMBQa:F8E4a","tlshash":"337244165b41321490a78a5e1adcd6a807adc133ea325fff77c1ea91c7c3b8714b3686","first_seen":"2025-02-20T14:35:33.129447Z","last_seen":"2026-09-08T19:50:59.282539Z","times_seen":563,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/d5129c9b8b9fcd421a3da1eeb14b93be.css?ver=b93be","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.812Z","timestamp":1788892515812,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/d5129c9b8b9fcd421a3da1eeb14b93be.css?ver=b93be HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fdf1232d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"27a3-6aa04c5a-c327435bd9452723;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zLRNBTAv%2BwzZqkGg04b0V0nZ0BSWtEfQNTWyDT5T2%2B3tHC1%2F%2B7ryYugsf4viD%2B8r0j5fR1i7n6TShcJelAr34RPtM7PConqGe2d1d43z4jP6%2BGmdvbpeawKLbH6ZG6w2hz1cLfYi\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10147,"size_decoded":2591,"mime_type":"text/css","magic":"ASCII text, with very long lines (10147), with no line terminators","md5":"a95c503d356e41ca4901ebc3fcc64eb2","sha1":"d9f9ff4919239001c5e4e345b02544d4f8bc1962","sha256":"400ef8c0bfe71021fc8abb8bfffd2fbd22735803b89d38b48df7822091a09100","sha512":"14a0d7a2fc2d5952b4928c2f26651ce4877620652a02ca73c3cddec99311b4572bf45ea58f0c4dbb534a318207609e6e892f6bf118dd7feef6cdf4cc191cbbbb","ssdeep":"192:fS0I5ZxnzOIqqUnzWn6tEstSIY3yTwiDlHU5l69CwC36qgfjvLsM4A27+hyCn:fS0I5ZRDhUnzWn6tEstSN3niDlHU5l69","tlshash":"92221f12467569bc68fb3a00c859b82d9649f844d5292beef1abc93170ef0c214de7cb","first_seen":"2026-01-24T22:58:19.199463Z","last_seen":"2026-09-08T18:35:53.940863Z","times_seen":433,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/fd44e640747692c1a5a82a97aa1753f0.js?ver=753f0","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.052Z","timestamp":1788892516052,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/fd44e640747692c1a5a82a97aa1753f0.js?ver=753f0 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d515f7d32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"92ae-6aa04c5a-9a45f671cefa777c;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Uflrd44CUCLwUzkBH8nzPp34%2BcstKaqDzF%2FvkJPTPcXM%2Bj9Midc%2Bp4vBdKEQc8BFA1WY5XW9kwXyVHA%2BoISAN0yDqGm%2F6bXo%2Fzzx9HtIe7n4FfX4ZQSQUNahIsrof8zjuBqIjvZk\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9010\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":37550,"size_decoded":9874,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (37548)","md5":"59623e1f7d387cdb5ad4d9caedace73c","sha1":"2523614fede5f094ba15f9b60c3feb581a672fb6","sha256":"06e7a4acf3751a6ddf102282a57fcdf3ec68493cecd79754b7bd4e9adb6e7062","sha512":"64ca9ad85b41ff5a44d0176bea471713f01c40acb5f3e7c3ff5b27f08a4232a14d793dbdd32fdf80c573aecadc4e96c937e758d19c5248baa03b3abced9973b9","ssdeep":"768:nCUlE5CYhN9Km0GVHxWG9pTHoJFnuIY6w4bww0j7QazB2pXQz7h:he9KCRHoJxuIY6w4bwwu7KQz1","tlshash":"b9f2e97872c47a3205c36a95a0bfa341f33065d5e6818095b63edec6a9eccc61627ff4","first_seen":"2026-09-08T18:03:27.015058Z","last_seen":"2026-09-08T18:35:53.94154Z","times_seen":2,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/325cb22eac53da46a7bee90f1ac4291f.js?ver=4291f","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.060Z","timestamp":1788892516060,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/325cb22eac53da46a7bee90f1ac4291f.js?ver=4291f HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d516f8632d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"2a62-6aa04c5a-fbf55576b6eafb51;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xrrkgnwa4dlutizCRfhFxxeS4o3Fli8tFmGdIcTq3lExQlkbUALBSc2MVAMAVL94sqEhvL%2BgaY%2BE1eNpQ8H27KkKxn8JilP9saIuM54A8KKfAZvgpAYT%2F7e48W12J8hLYFrI2m0l\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3019\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10850,"size_decoded":3875,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1127)","md5":"7c0e2c523276cca6094c923a69da6a92","sha1":"dd22399d4ca8bdd5566d6ee8a65260c42734d9a5","sha256":"6904b27ab4ab5c4ba8cb85b02532d06b3c99c5d27a2a4b003b876edd1cbcc2df","sha512":"2ecbaee5adeba50011ebd210dda27a8eed9c23f8898085ab8b9f7c5d80713e6aaa88371a00f0bb881835ee335008a74a14864d67f827e0e3f177e467d1a23c02","ssdeep":"192:Di2aDucaTr5m4Ip24ZfZbSv9nn3X7CarTCGA11eDutq1mDeVFEuvBvjM:Di2a5afOxIbKDcvjM","tlshash":"eb22b605b678b6f610ef583bf1ef5b841b332a72c7059051b4fa848d1fb89523262a5f","first_seen":"2026-09-08T18:03:27.071235Z","last_seen":"2026-09-08T18:35:53.942898Z","times_seen":2,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/109d5104c7839908fdc0924fc16a0ae8.js?ver=a0ae8","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.079Z","timestamp":1788892516079,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/109d5104c7839908fdc0924fc16a0ae8.js?ver=a0ae8 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d518f9832d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"551e-6aa04c5a-79cf6e9c9644f51b;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZhDdmvVh3MB36h80Z1usqFx4WYQUcFZEvjIfSrEB04P0jryN4nNki18IoYgOvr0j%2FCKqNmgkxsCOHomIz3VYWRPZhmW7kFhq8RqJi93J0Ko1shlFJgNgDfeLgYWZC9x%2F1Gd2NOM%2F\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5838\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":21790,"size_decoded":6694,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1707)","md5":"aedf571e8bad5a764a59fa9761565ede","sha1":"09a7def2ee80a32791907498b825118d4aab81b1","sha256":"5f551811f753f794feb53d900eea9f9197e8c2eb1fcdb9f64b3389e19bff74f8","sha512":"0dde63bbd251f3834d68d1bdb859d4892d743f011d0c2a916cba3c2d532ebedebc30cdcc2deba2bd276dbeef0f49bcb5f2feee82b9c6390002b97baf6a7e7700","ssdeep":"384:vt9plrEVcBlg6ATzgmAKmuqbsBPtWFvPIatWFvPItGThDYg+HhgN8zgbGd3KpRgk:vddEVqe6ATzgmAKm1YBPIFvnIFvsOhUW","tlshash":"32a293a17090642a92ff27f280fb07157e369611fc0195a4eaec4ca5696fa43313ef5e","first_seen":"2026-07-10T08:43:04.581172Z","last_seen":"2026-09-08T18:35:53.943834Z","times_seen":14,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/bf8c60d78c44bf6b9e86854cea7b16a1.js?ver=b16a1","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.080Z","timestamp":1788892516080,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/bf8c60d78c44bf6b9e86854cea7b16a1.js?ver=b16a1 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d518f9a32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"1592-6aa04bf2-ff5f3c3de5a2b394;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:58 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e6apnVb7IXsM1th%2F5hnS2uC92LaOD2pcbm1n0Ox%2FnyuwO%2BfvTTuDATC6%2Bi2HOFvYnpJhjptdun1q2JF9X0HemD4x0XRXOsk71yR%2F40M6ob08Puuef8B5DDEwy0WW%2B5zraAplwgku\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1689\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5522,"size_decoded":2551,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (4358)","md5":"886d7c72aac16b4d7fad967aaa37b029","sha1":"aaa2f737cfe7e8a77138b812dfe6f3b67797204b","sha256":"27ea21a9138e53d9f2dd561bb0ca8bc012f333be06059e0d76b389f74b179f2e","sha512":"b4e52588f59f4ab1e9ab514530a7e563323368863f98c866ed453ce2c4e3d4314ee250a7dfea207b4bcf54b3edf66f1bbda641a4871589c33a9dab84054541d8","ssdeep":"96:PwSrH5hrG6Qpw1rIN2Bkqsu6B89w1y+7Y3qv5StcXyuC0r4oYeTnf49uVhWWTfjb:PwSrq6Qpw1rI2k1u6i9woa3hSSCP9+X/","tlshash":"17b1318db7737563125aa0f2b31b430ab3b6509ea128419d765cecf39cb490a1973fb0","first_seen":"2023-11-11T17:21:40Z","last_seen":"2026-09-08T18:35:53.94444Z","times_seen":3716,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/ico-3.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.311Z","timestamp":1788892516311,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/ico-3.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d52fff132d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"2c58-6a70bf7d-33f6998d2a1c2d63;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 16:19:09 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eNJE2u6KuX%2FJXfT8K4lT%2B3QQWfEZNkMal%2BDF7YQ5uMD%2B8N%2BAxaSr5oeYmgT3LdjHwG%2FtUcR0gUchQXBTRq8%2FF6QVTIGoKw7c%2BHCvOXv4L9tz19NUV5tUNxxR5c7N15g%2FZzqOEfIy\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11352\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":11352,"size_decoded":12168,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"88879ba1e24ce9ddb4ee277f90b0657a","sha1":"46bc10d7e0249d6189ac9fe068ff6bac6f456456","sha256":"eca55427ab40bf9e58b93e537497be8b25a4e0155ed1178885b7cea0d96314cd","sha512":"8599ea5a24b0ce51676eedd4e5b2edbe9b3f063c2e7ad1ce5a5849940f6cec1596d0db48853d4148bad9f5372ecc906e0a8f789cfa581f10b7d1f989c2445792","ssdeep":"192:5u/YNMtKwwcO2ouk2cmHRk9EXPbRLL9k5tkLct/fL/Ptkex:5qYNg7wAHu+PbRetkgpL/h","tlshash":"6432af35ebd18d97de31d3b48afcbaf14222a73d5f5431f39134a61ab7e92245888188","first_seen":"2026-09-08T18:03:27.011423Z","last_seen":"2026-09-08T18:35:53.945104Z","times_seen":2,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"groot.mailerlite.com/js/w/webforms.min.js?v1f25ee4b05f240a833e02c19975434a4","fqdn":"groot.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.044Z","timestamp":1788892516044,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /js/w/webforms.min.js?v1f25ee4b05f240a833e02c19975434a4 HTTP/1.1\r\nHost: groot.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nlast-modified: Thu, 03 Sep 2026 16:25:20 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-MailerLite-Account,X-MailerLite-Token\r\nx-envoy-upstream-service-time: 0\r\npriority: u=3,i=?0\r\nage: 94\r\nexpires: Sun, 13 Sep 2026 18:35:16 GMT\r\ncache-control: public, max-age=432000\r\ncf-cache-status: HIT\r\netag: W/\"6a999f70-2f5f\"\r\ncontent-encoding: br\r\ncf-ray: a3800d5168670731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12127,"size_decoded":4397,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (12127), with no line terminators","md5":"83147fa8ce2d95cb73ece7f28b469519","sha1":"530288c27b9a22124bf9e2c239584ebaedd467c9","sha256":"95f9e26622fd9b3b0d13e3c7a4996ea40fdd00d0f26c90806b99f850d01c55e0","sha512":"79370e2287c0bef2e8aefd1156633f8765bd53ac82afd09563283d62183ba10a2e62cb1770607849e9bd5a4072e700c3689fefe568d5eb5688f76af5698deb0e","ssdeep":"192:YA3Oop38Xmt4EUJYaN5GtAG7DRxHGrGi554LkojofEdEFTwx4kP9BJamXmvC4X81:YGOop38Xmt4ZItx7DrWojofEdEFoJaXI","tlshash":"2342778575e2e1e7297704a276fbb74271b2693adc0b4000811764b13dbcd879a3abcf","first_seen":"2026-06-08T15:24:47.782591Z","last_seen":"2026-09-08T18:35:53.945921Z","times_seen":317,"resource_available":true,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":12,"connect":10,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/slider-2.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.087Z","timestamp":1788892516087,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/slider-2.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d519fa232d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"1b914-6a70da93-963eeee4e27b1773;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 18:14:43 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R%2Fu7tCQdulYjQjHN714DMLD%2F7iRszuu0epwwnHGw3cJfJHKouNSnKTpJZW%2FW%2BC7vP%2B7osO0lR3EDccc2mgBtYLViobzvijB6aH2riZgYE2NeAj8Q0EXS4RDu8Oc72%2Fe7HSLqsNYJ\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 112916\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":112916,"size_decoded":113728,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2e5f910612c54fec3eb9b5e46ca116eb","sha1":"7d5c7fab85962f6dc17c1920febb2d405a4a87dd","sha256":"0badb7c5bbdc2061c66dbf516e27c959265ed65ae86523b023158d390c35df4b","sha512":"f740fe724c7b159a3a144081f22b1eb6559b802da67c3134b5e35cf1f0b02e5d0c78d905d898b741f17473ac250198552973d5c1dbc9b2bb6dba3f4e9d1015cc","ssdeep":"1536:/Bc9C1QdqXvhw/00CwklD5LgZkQlkhtglpJZ7NVWIrUfFkj4jFuSF0dIsp:/O7qfhw5CwkthOhNVWzFkj4jb8V","tlshash":"0bb3f12ceed16548da66bdf3e86565cdcd33c309e881081fbacc93192f5265e0caf612","first_seen":"2026-09-08T18:03:27.02634Z","last_seen":"2026-09-08T18:35:53.946434Z","times_seen":2,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/slider-7.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.093Z","timestamp":1788892516093,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/slider-7.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d51afaa32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"1a0c0-6a70da99-fb4fb85d28ced031;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 18:14:49 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KFM3uLaf6y9tvDqU7EXr%2BCWBCAHG45%2BthpDX4b%2FrFw%2F7%2F2tThO%2BNztY7lU%2BKUSliJxDiYKKk%2BnROxbsnrOZdw12CCYVODWLUc1HN%2BoxU7XjQk9MbxUrIz201X9CDG8Z9DxDlDA1h\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 106688\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":106688,"size_decoded":107506,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a6c70f0a628db9722ea8fe57070030e9","sha1":"8eb2e75117a0a75f3bfd2f1a3e1db05255d7d7da","sha256":"d43df246f816ade4a9c9640fbfba8d79ceb49c645b7ee57c4dfbcef462189814","sha512":"01df2b6600ed4318f6cb67c94cc65f03ca8017d6a1680bf0d11b0a252c501e21e7884b6bc87e02952969e59ac882cbe1c43148e6b7e4797b503d499221912a5a","ssdeep":"1536:cb/EzBQY9KLQ1diCWaPc7l5yC133z5ys7/z6HB10VCDrY4qsWZfUxU7oGS95rS2X:yJOFPi551nVh7/QU884qsHgS9wZnzeHN","tlshash":"eea312e83296934b671dfc71253abcb82ec79c2022414679ff44d175c498ee6d8b29b3","first_seen":"2026-09-08T18:03:27.063405Z","last_seen":"2026-09-08T18:35:53.947752Z","times_seen":2,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.286Z","timestamp":1788892516286,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48320\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 08 Sep 2026 04:06:14 GMT\r\nexpires: Wed, 08 Sep 2027 04:06:14 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:30:41 GMT\r\ncontent-type: font/woff2\r\nage: 52142\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48320,"size_decoded":49132,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48320, version 1.0","md5":"dcf31ebe107435bd68e0164d59e19b87","sha1":"b68160c9333af833fe483928b3ef7128c07a56a0","sha256":"d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0","sha512":"130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08","ssdeep":"768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE","tlshash":"1623f218f29471f7edecd4d500a18c72baa528d442f116ed07b8d53ca36ca817a729fb","first_seen":"2025-09-17T00:07:53.723302Z","last_seen":"2026-09-08T20:26:56.275017Z","times_seen":339166,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":37,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/intro.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.298Z","timestamp":1788892516298,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/intro.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a3800d52efea32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"1ef5a-6a70b45d-4ef7cc1ba76c74b0;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 15:31:41 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bobd39JBeN6JmEBcYDjANIHg3BCLsmfTwyQR%2FxD8a2rVZxxXMh7vRR7M2p4q245q0%2FB%2BX4xEP383utJHcqaM3waJ74ovTqSGH3O2BGTQlQgYDr%2BynBZW48cGuhH1vtoQr%2BbMpaOF\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 126810\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":126810,"size_decoded":127620,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8e1fec6d338ee195d7c313a387d3aa73","sha1":"c52d72693b7cb628b692b6b478b93cc0b4184739","sha256":"992a815c5cc84b5cfd32d19cf5e2ddb3c31c96c9ce7211d278118cabb4565127","sha512":"576b93ed51ded812fe846d729f31af4703aef28d9e872dd2ef35ba5d6081ea4073292d926f4c144823f01ad7ebd62220eb8de0b4abb34a4cd2b462cdfcf47e76","ssdeep":"3072:NZchm8bMBqvlEFaPkX22cHmKmrHOJ6KHhET:WmZVa307C6b","tlshash":"72c312b75f045e69ecbb4631d54a23c8f267ef34d522b1b09a5086178b30106be2fb5e","first_seen":"2026-09-08T18:03:27.047312Z","last_seen":"2026-09-08T18:35:53.948658Z","times_seen":2,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"assets.mailerlite.com/jsonp/521914/forms/94931475246351627/track-view","fqdn":"assets.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.604Z","timestamp":1788892516604,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /jsonp/521914/forms/94931475246351627/track-view HTTP/1.1\r\nHost: assets.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://esda.mom/\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 204 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncache-control: no-cache, private\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-envoy-upstream-service-time: 21\r\ncf-cache-status: BYPASS\r\nvary: accept-encoding\r\ncf-ray: a3800d54eb3e35a6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":333,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-08T20:34:11.144457Z","times_seen":18352374,"resource_available":true,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":127,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/favico-150x150.png","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.850Z","timestamp":1788892516850,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/favico-150x150.png HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/png\r\npriority: u=6,i=?0\r\ncf-ray: a3800d5658ea32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"21a6-6a71fcb6-fba76f8d1e17d86b;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:47 GMT\r\nlast-modified: Tue, 04 Aug 2026 14:52:38 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Tp9%2F4tQsjdpQhI0Lkvx6ncsflJ48wCMYcjVkWvUGtBZBlJJU5urLXx0MCkWg5w4DU9qST0AxLhq1TkAgDy7cxEwVkH3XHZbFdy064IvlDbh4lly4PyG07f1zmHzKnqMpSDzydMzj\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8614\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":8614,"size_decoded":9415,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"a683071da0c3a540ca759ccf174e4b21","sha1":"4830ac573c1d24bb95ad4a47ed95ddae07fba317","sha256":"bbad67f423154c5fddf224a8e542cc9eb2c775acb62bd111d3da0f55e2435761","sha512":"8a9add845e17d05f0480c2f8643f4dbc8b78db22d2613cc022604e1dca10a7309013e11d0bbf843e5d38d6ae9d3dae1dd07bfd38a6389aa2544df5a1cf47cc48","ssdeep":"192:haqTVhsvWRrR7jXbKR982AWB4Kkq4iVqDdDDu0I3z8OQq5tQ9s8yW:hzhsvWXXru7vlcI8OQMa97yW","tlshash":"6c02afa995b06a4c230e3d1a132d06172cccc1f0e76298d3529bfd5b1e990e85ef7683","first_seen":"2026-09-08T18:03:26.993265Z","last_seen":"2026-09-08T18:35:53.950162Z","times_seen":2,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/206785631fd53afee78d261eeb60c7f0.js?ver=0c7f0","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.824Z","timestamp":1788892515824,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/206785631fd53afee78d261eeb60c7f0.js?ver=0c7f0 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d4fff1e32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"350a-6aa04c5a-e067327ecc386108;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bhi2VfTVZguOJVWbe8xlGQHt8HuJtxT1GsMd3y%2F9%2FbuaPybfcaWs5pp5zf3k3GZ%2FtPnnwMv8%2BtaCSVIkuYPVFtciayck8PFWBSII50H2kyl84OYn5P7Z8ZlJk5pN8y5BnF3zQ%2FBH\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4680\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":13578,"size_decoded":5540,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"47a628aef2f254c32c3b5878700a42ce","sha1":"43814a498670a432b6a73cc80e67bdc738313ea2","sha256":"ea64f589334f647f2254d595466c036000a3d9150ad078a69eba7f845c0c0713","sha512":"2dad1648412fe67306b86320bc4ba90a681086b4e799528ea9783157fdc1fda64dede2e9e7958d0973156ed3d9084034422ed9c4794bedb5c7b8151917540671","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORl:5rprxaefKI0LP19m4q1WW+h4Mjw","tlshash":"5e52c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-08-09T06:09:09Z","last_seen":"2026-09-08T20:41:33.550079Z","times_seen":15983,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/slider-3.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.088Z","timestamp":1788892516088,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/slider-3.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d519fa332d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"3fbc0-6a70da94-f4755310d85233c;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 18:14:44 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dLHxfNY%2FerzYb%2Bbi4cRl6nHczn5%2BTUDX%2BjnCDpAu1F7A3lFFkPmLLNPFbA79B8LAmb4gefvmauNQqrH4A1unPwdIjk9MpqDMQ18aVICzIh%2FMU2UQB58tbnZvJgULiBPv3QdXm2D1\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 261056\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":261056,"size_decoded":261865,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"fbdf92884edbf1ee238f5ae0d04b0c55","sha1":"8b8f345d36bc47a9be2884f81b060b6ba16cf335","sha256":"63010bedb2febd914b1703c3d910b30a4aef8bcff1ae7630c5502861d3ddc7ac","sha512":"18319ee6f74ea7b2f09907c7491a725d78abd7faacd2c8edfb75fa6efd1e75835ff1f1e62c8b18ea2ae2f2965b5e1a8aac54a9302c0021ae86bed2be04056a79","ssdeep":"6144:wh7LJvVcqBvZanlMAG9CZ9LdvRPDVjijG+LvEePzH:cdvVZByMb9C1lDwj2ePzH","tlshash":"ec44231821139d938c5799b8df93f93c0dc5a221d8aa7a36b173c13cb9d22a49f563dc","first_seen":"2026-09-08T18:03:27.0086Z","last_seen":"2026-09-08T18:35:53.951815Z","times_seen":2,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":72,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/slider-5.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.090Z","timestamp":1788892516090,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/slider-5.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d519fa632d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"4fbe6-6a70da96-3f487b040e5f7280;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 18:14:46 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GhXOIg5aCTZWtk6xJSb76%2Fi47sj3Ja0uzCLTicveqAGb4TTAuvBwLrmfG2KAgJ9jIdxgymBrWFc%2BU%2Bh%2FDcqmhTmfqzX2qfwWkorYsyP0Wz2BYijBYhQLYr2decMjKK%2FepOWP3Fpz\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 326630\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":326630,"size_decoded":327440,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e575df2f3ac8a4b6a5c62e1e745fd210","sha1":"884acafd265e25fcc6deb2352b1ab266792b891c","sha256":"57eb795fd208ba9f25cf3fa806ea7eb7b5abad1135919492d0daf6e0745fe7b1","sha512":"a013e733e34e8f119f016f9f95d26f905ab7e2656bae9c4b40ca33c832db5744ee4ca1ee86f045b9e6e76277abe0f753c9de161b110caa587a8b82ee6aa005a0","ssdeep":"6144:0laglt88y5cj/zAPWDEIUdwvOzEoy5+jVAAmAA8oD/xy27Bxm5ztPEMjwJXPIIWt:0laQY5SAxIUWmglw5PxORPCxPEMjgX0t","tlshash":"e2642303501eba58d5ef4fb588f3bd79a2d50df2fa0e167fe050d1c8a51748e2568e28","first_seen":"2026-09-08T18:03:27.028154Z","last_seen":"2026-09-08T18:35:53.952882Z","times_seen":2,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":73,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/23b482abab50fee763b9930fc51e7984.css?ver=e7984","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.804Z","timestamp":1788892515804,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/23b482abab50fee763b9930fc51e7984.css?ver=e7984 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fdf0d32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"967-6aa04c5a-e9fdfc111da1da6c;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JbfRZMasFV3mmwAlHdv4mO6qaSH%2FSm13o7Bmm%2FVDwLhnVammzeXt4g1N3ScZfKJHvo%2B8lNJW4QAveqwo0JAG1lU46k1XNBy5a51tBVz01jr9UduWhYV3RGNgUXAXDBhG2KGCVvrB\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":2407,"size_decoded":1478,"mime_type":"text/css","magic":"ASCII text, with very long lines (2407), with no line terminators","md5":"6c89b9e1c5e9302377293ff3fceb18f1","sha1":"67cc4cb4b8ccc09d8517bc295457c7d5e372983d","sha256":"e16a60621983c70c78c496f0fad4a9f5b72f998e0d8c99f146f241c408695dab","sha512":"d489f785a3d7aaf3e0c07a7c3145e5c12b0ff436af9e80c1f624cf41bba1e411c64c546cafea77412496944904928329e7a053b8b509b8f6b84ef745e516e38d","ssdeep":"","tlshash":"f541d0d034e8827832feb5759c81016530e6ad31e522fdfe5b48f4748ae4b5239e5743","first_seen":"2026-09-08T18:03:27.005669Z","last_seen":"2026-09-08T18:35:53.953866Z","times_seen":2,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/a770b1bde6b711540307e8e64ff72b37.css?ver=72b37","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.821Z","timestamp":1788892515821,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/a770b1bde6b711540307e8e64ff72b37.css?ver=72b37 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fef1932d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"9a48-6aa04bf2-fdbf915a4dd08c34;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:58 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LxCde1crwQiFUUC8MA%2Bsm1OUAh2AqlfqQtr7lhU9cRaCxgJ4Zp6lxsgqr4gGRUJvNyVgGd8iUU06QGKtgAd3AHjCpn0ywTJJtyqMbzzUtGzN3%2FDNNSfF1tTvTpBuQI8gGboqSrkZ\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39496,"size_decoded":4332,"mime_type":"text/css","magic":"ASCII text, with very long lines (39496), with no line terminators","md5":"efc29a0696af6615bd4cc9d5c4fd2be0","sha1":"641e863a08fa69e101c059f8e7c87c889030b952","sha256":"1c873b99bf1d746c7baa7885a63c8b99c7c5ed2f6d90c2a6d377505c95f6c455","sha512":"767692c4cf43ee144de4a0d64eb26973d878628680685700e84b7737ef58cf9c8a5149919d7b265bf1a76c11c26b2306ced1ca433f14ace76fb834ded721248d","ssdeep":"768:6I+1i0hmNhGlZWiOZ4IFd67e3e+dI+dR9ZG0DUzF2IhD02YeR3mEPlkaNbygLXLT:m1i0hmN8lZWiOzd67e3e+XdRHG0DUzFf","tlshash":"69038c1d367e16b60af7f258c8edc16288d679048b0213ebe8dbd06671c65c224e5bdf","first_seen":"2026-08-06T06:23:21.440231Z","last_seen":"2026-09-08T18:35:53.954763Z","times_seen":11,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/1feaabbc73da0c8e0b87ece1ef79dd6c.css?ver=9dd6c","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.828Z","timestamp":1788892515828,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/1feaabbc73da0c8e0b87ece1ef79dd6c.css?ver=9dd6c HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fff1f32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"d7a-6aa04c5a-e9d40a42275d6915;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5RKbA%2F0zmzi0jTfsjicGV%2FxQ4RuA%2BpUyXMKgJM3KDljaJxFGjLtzPj7v3E7ikCeeC%2Bg%2BLlOqVHdD4b1TimePWyPLacL2zYGacePFS6yxdvV9GkvnI9pVgHtN4Dhsj7YMcE0ys7Se\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":3450,"size_decoded":1559,"mime_type":"text/css","magic":"ASCII text, with very long lines (3450), with no line terminators","md5":"fde01807a1a29ebc5ae15e344c064237","sha1":"c2412958aaf3fbbff256389dfd6756e3044bb428","sha256":"0c6bdf2151e5bf30f383f02ed57de002627f69d08886a9be4dce94b5453552c4","sha512":"57c407e7fe82881972ae48a5efb568053b2c29c005bc006b20ea82f430b4a9c56feb0d3ad4109c403ce042d30cfbbbc5bb7b44c84485e95b5883f690a2023f99","ssdeep":"","tlshash":"d8617d867169d3ee2d2ec670d126055b6c20f583d6fbf19da10ba7d00fda0c215c8aeb","first_seen":"2023-05-09T17:47:16Z","last_seen":"2026-09-08T18:35:53.955406Z","times_seen":1102,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.281Z","timestamp":1788892516281,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48320\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 08 Sep 2026 04:06:14 GMT\r\nexpires: Wed, 08 Sep 2027 04:06:14 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:30:41 GMT\r\ncontent-type: font/woff2\r\nage: 52142\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48320,"size_decoded":49132,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48320, version 1.0","md5":"dcf31ebe107435bd68e0164d59e19b87","sha1":"b68160c9333af833fe483928b3ef7128c07a56a0","sha256":"d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0","sha512":"130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08","ssdeep":"768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE","tlshash":"1623f218f29471f7edecd4d500a18c72baa528d442f116ed07b8d53ca36ca817a729fb","first_seen":"2025-09-17T00:07:53.723302Z","last_seen":"2026-09-08T20:26:56.275017Z","times_seen":339166,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":43,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/antonio/v22/gNMEW3NwSYq_9WD3yHQiFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.283Z","timestamp":1788892516283,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/antonio/v22/gNMEW3NwSYq_9WD3yHQiFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 26592\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 18:50:35 GMT\r\nexpires: Thu, 02 Sep 2027 18:50:35 GMT\r\ncache-control: public, max-age=31536000\r\nage: 517481\r\nlast-modified: Thu, 04 Sep 2025 17:35:30 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26592,"size_decoded":27405,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26592, version 1.0","md5":"9ffb4e65d3fabc3e6b4d5d592ba92226","sha1":"6723345bc609421681cb916105476c4cc3f92db1","sha256":"82661feca9e5b933308629a630caa991566250273379a213b6af257fbdfaa71a","sha512":"875d8c78514e049f096b0a14b842b7a8e5fda5cdf82e834dab85409017abee37006801f2d966731a7de9f82761dcaf0fbd41577d055c03c8993cf3cfebdab03d","ssdeep":"384:M71UJO6FUW3VVcdSpjAjWf33IucscRM+lDgary6sSfUHx1NYmdMCEocIR4yf:M71UJv53V/rydgAFsSfUHxjnJEo/ayf","tlshash":"17c2f2433d9f606c935b88b2b069b596875810b4e3a1763bddc967146ff0cf19ad2070","first_seen":"2025-06-04T00:24:55.422247Z","last_seen":"2026-09-08T18:35:53.925008Z","times_seen":568,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":32,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.mailerlite.com/css?family=Roboto:400,400i,700,700i|Merriweather:400,900i,900,700i,700,300,300i,400i|Lato:400,400i,700,700i|Montserrat:400,400i,700,700i|Montserrat+Alternates:400,400i,700,700i|Open+Sans:400,400i,700,700i|PT+Sans:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i|Roboto+Slab:400,700|Ubuntu:400,400i,700,700i|Titillium+Web:400,400i,700,700i|Nunito:400,400i,700,700i|Cabin:400,400i,700,700i|Oswald:400,700|Work+Sans:400,700|Exo:400,400i,700,700i|Comfortaa:400,700|Raleway:400,400i,700,700i|Oxygen:400,700|Poppins:400,400i,700,700i|Playfair+Display:400,400i,700,700i|Shadows+Into+Light+Two|PT+Serif:400,400italic,700,700italic|Josefin+Slab:400,400italic,700,700italic|Arvo:400,700,700italic,400italic|Vollkorn:400,400italic,700,700italic|Karla:400,400italic,700,700italic|Noto+Sans:400,400italic,700,700italic|Barlow+Condensed:400,400italic,700,700italic|Anton|Inter:400,700|Abril+Fatface|Yeseva+One|Poiret+One|Marck+Script|Pacifico|Fira+Sans|Rubik\u0026subset=cyrillic,cyrillic-ext,latin-ext","fqdn":"fonts.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.302Z","timestamp":1788892516302,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /css?family=Roboto:400,400i,700,700i|Merriweather:400,900i,900,700i,700,300,300i,400i|Lato:400,400i,700,700i|Montserrat:400,400i,700,700i|Montserrat+Alternates:400,400i,700,700i|Open+Sans:400,400i,700,700i|PT+Sans:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i|Roboto+Slab:400,700|Ubuntu:400,400i,700,700i|Titillium+Web:400,400i,700,700i|Nunito:400,400i,700,700i|Cabin:400,400i,700,700i|Oswald:400,700|Work+Sans:400,700|Exo:400,400i,700,700i|Comfortaa:400,700|Raleway:400,400i,700,700i|Oxygen:400,700|Poppins:400,400i,700,700i|Playfair+Display:400,400i,700,700i|Shadows+Into+Light+Two|PT+Serif:400,400italic,700,700italic|Josefin+Slab:400,400italic,700,700italic|Arvo:400,700,700italic,400italic|Vollkorn:400,400italic,700,700italic|Karla:400,400italic,700,700italic|Noto+Sans:400,400italic,700,700italic|Barlow+Condensed:400,400italic,700,700italic|Anton|Inter:400,700|Abril+Fatface|Yeseva+One|Poiret+One|Marck+Script|Pacifico|Fira+Sans|Rubik\u0026subset=cyrillic,cyrillic-ext,latin-ext HTTP/1.1\r\nHost: fonts.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://assets.mlcdn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/css; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=432000\r\nx-cache: MISS\r\nx-envoy-upstream-service-time: 44\r\nserver: cloudflare\r\npriority: u=2,i=?0\r\nage: 50497\r\nlast-modified: Tue, 08 Sep 2026 04:33:49 GMT\r\nexpires: Sun, 13 Sep 2026 18:35:16 GMT\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: a3800d52ed840731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":219545,"size_decoded":8586,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"a7908ae65a9b5214d0608b8fd5657d38","sha1":"30f4d8ef6f8d863f65d03d54895719e96bb32710","sha256":"5553ad1eac44091c2b99109ce4cfff4cc744d26aa6a84cc581634c2ee09234b1","sha512":"c4f95f5e73ed8906f12de441834a0d0ca70afb7b48d1d861f2dd5a1be3b5bbca064d0167ce3f66a129256190ab9e38ebd5395b00ffed971b7fe7c7d137144f7c","ssdeep":"768:vYkKqE3yszLy7JbkR7cRi7MFi1Fsv/zgAjeJpTsVR49kAySJXNvrm06D:bKqNUya7c072ifku9TU","tlshash":"0f2431a2082b3140a3831ccb33de7e36de4fa2657444d4356bfe199aecf6c265261b1d","first_seen":"2026-02-22T06:48:06.655812Z","last_seen":"2026-09-08T18:35:53.956109Z","times_seen":576,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.mailerlite.com/fonts/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2","fqdn":"fonts.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.497Z","timestamp":1788892516497,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /fonts/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2 HTTP/1.1\r\nHost: fonts.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.mailerlite.com/css?family=Roboto:400,400i,700,700i|Merriweather:400,900i,900,700i,700,300,300i,400i|Lato:400,400i,700,700i|Montserrat:400,400i,700,700i|Montserrat+Alternates:400,400i,700,700i|Open+Sans:400,400i,700,700i|PT+Sans:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i|Roboto+Slab:400,700|Ubuntu:400,400i,700,700i|Titillium+Web:400,400i,700,700i|Nunito:400,400i,700,700i|Cabin:400,400i,700,700i|Oswald:400,700|Work+Sans:400,700|Exo:400,400i,700,700i|Comfortaa:400,700|Raleway:400,400i,700,700i|Oxygen:400,700|Poppins:400,400i,700,700i|Playfair+Display:400,400i,700,700i|Shadows+Into+Light+Two|PT+Serif:400,400italic,700,700italic|Josefin+Slab:400,400italic,700,700italic|Arvo:400,700,700italic,400italic|Vollkorn:400,400italic,700,700italic|Karla:400,400italic,700,700italic|Noto+Sans:400,400italic,700,700italic|Barlow+Condensed:400,400italic,700,700italic|Anton|Inter:400,700|Abril+Fatface|Yeseva+One|Poiret+One|Marck+Script|Pacifico|Fira+Sans|Rubik\u0026subset=cyrillic,cyrillic-ext,latin-ext\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: font/woff2\r\ncache-control: public, max-age=432000\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\nx-content-type-options: nosniff\r\nx-cache: HIT\r\nx-envoy-upstream-service-time: 1\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\nage: 24464\r\nlast-modified: Tue, 08 Sep 2026 18:02:46 GMT\r\nexpires: Sun, 13 Sep 2026 18:35:16 GMT\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: a3800d541a4f0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":42964,"size_decoded":43525,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 42964, version 1.0","md5":"23145c7141614ebba8c5dd949478c01e","sha1":"b1aaf991a2646a862ebc2d5cae3d2e2dc9951b7c","sha256":"441af0def989ebfdbd6ad85ffaed85e967ab21a05f1dd342f16259464a206dd0","sha512":"6f16ee54881abe3bc609da213a0d44c72fbbc16f7c4df0f27a971ec8ba9400d1f29718d58fa00b92a4b2e9d8f4f646122e00d21d562e2e7c44cab17ca76ab260","ssdeep":"768:5PffQbtnceACc7f8PRBB0/z2awp3Pw0/kGrziGewCqu1N9CCn2M1X2HjpGbceBch:NkSr1oPGz2aO3o4biGeLqu1bB1X2H0b4","tlshash":"8213f173a21d7958f5bd7aa232478a03626df095feb2dd0c9150984d07b286f23d5a32","first_seen":"2025-09-17T00:14:07.581362Z","last_seen":"2026-09-08T18:35:53.939444Z","times_seen":15280,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/66b36517ffb452540b4c86d90a7376ab.css?ver=376ab","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.822Z","timestamp":1788892515822,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/66b36517ffb452540b4c86d90a7376ab.css?ver=376ab HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fef1a32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"8ea-6aa04bf2-33685fc78bf30662;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:58 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=42NGIwik4JMhNiGjdXYys8zM8EU6hR7qpsddq81pgtnqM92cJsEiisV7He%2BIlDqAjxChKC4b%2FxmJ0J03Q1xsWeQ11qNB40WC35Vl3q7szRqFTbuB9L09CeDDCDQACapqmQufPwy2\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":2282,"size_decoded":1200,"mime_type":"text/css","magic":"ASCII text, with very long lines (2282), with no line terminators","md5":"d9caf4f9b80f70f6c2aa1b903c94b9fc","sha1":"ac0de5cf9b1500b3da6db2018f94ac927197981b","sha256":"fa46f0f815334872b51def4b2bfa4a5f207e1c3f3ec9132c54c59e8e91432fcd","sha512":"6eaa80788dbf68d947daf5e85df8f160aa14dc305528662e01ecf35e4fc9ef12c2e5f6198393fe641f0221591a3f97f9ba4fd6fd65c0aef5423ecf5dd0fbf7ef","ssdeep":"","tlshash":"4e418f317d36009c05beea21dc815d589096814d99a304c9f167ee3de54f9ef0efae87","first_seen":"2024-01-13T22:48:45Z","last_seen":"2026-09-08T18:35:53.956782Z","times_seen":542,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/5913c5dfdfe91c7530b4eda7589255b9.js?ver=255b9","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.050Z","timestamp":1788892516050,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/5913c5dfdfe91c7530b4eda7589255b9.js?ver=255b9 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d515f7432d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"fca-6aa04c5a-d59b1d1c239034f2;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oj2nM4OfuozRquIxhh7bxY3cfxWWb%2BNYDmBt6C%2BjYN6jjKcOP8A13CY14OD67mPMmmHDVbfGXWkQ0uZlKm3QHSIj3xVmivU3aQqzdWcRSwuzY4KdEhBGwl56NKsBtGKtcw7RwozF\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 953\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":4042,"size_decoded":1805,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (2307)","md5":"3bfa25fef90e9fe421a977587e343b96","sha1":"84508c10a407024ad96569817f21acef23d6b486","sha256":"e5bdb53db2e08067f12522ce695c8df528dbe1e54229bc201355840b27151093","sha512":"0d080b87b9d444a0fced53c1d55dab6b2d276cef3f0bf124280ae9104bf3db76696c8ae3ebbc3f149247af711ec2e022054f0ce5842258a4715bd5389c7f7e63","ssdeep":"","tlshash":"6081e3c8b10018ba99db22e3402d944c5ab51658d9414478f1bfacaf07943ec676bfff","first_seen":"2025-02-20T19:03:23.582114Z","last_seen":"2026-09-08T18:35:53.957421Z","times_seen":21,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/plugins/wp-statistics/assets/js/tracker.js","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.066Z","timestamp":1788892516066,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/plugins/wp-statistics/assets/js/tracker.js HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d517f8932d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"1ef2-6a9d518f-517266d1fd73cffa;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Sun, 06 Sep 2026 11:42:07 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k%2F%2BF%2F6x%2BbatClFNMRlDg2LZon7HWVV4LeEVMdiA32zbNZGRg9S7B3Attvw29CJRWSGGWcFFBXp4xW68ax7iiH9aaRaKo%2FHbQ5woC6qnDVtqOmxZUig9TUtFs%2FjFd48xWQPIt7uJO\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2552\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7922,"size_decoded":3414,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (3502)","md5":"8f1f140996d0b8b3ef69cc64972e2ad2","sha1":"a030c2dbe75f24705323ab43a43e0f532f7612e6","sha256":"3b0e963107a1f4428d7140d30b9f1290e89de3e177216624e65d5cfe9da3694a","sha512":"798f38203ed948659113744df9dda4c97b900a29289200b7cb55c3622ee8c29e721a3db55cfeca343b72aa1b88af0b22ec4b16ccfc6e211384fd4735fb78784b","ssdeep":"96:aOXKnJaAS8r16MO0zrEyhZsYgdOnGWdOZPhq0holdQl+RWAsgGR+QACVAmzx:DYUv8RjO0HEyhZNWOGAOZPSeIWAfwV9","tlshash":"4ef174967ac656f2c8f63068113a2b3d75ab0dd23602d171b868cad35818ac2d347f7a","first_seen":"2026-04-16T22:24:47.018507Z","last_seen":"2026-09-08T18:35:53.957998Z","times_seen":2396,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/c9f08d75ab950f22e3981e65bf87ed7f.js?ver=7ed7f","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.068Z","timestamp":1788892516068,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/c9f08d75ab950f22e3981e65bf87ed7f.js?ver=7ed7f HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d517f8c32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"16a0-6aa04c5a-966394a84e6b0f11;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jgGPN5BKPLgV5MKSCXeZy6WZPO53ZZ3K1tNU9bJY2eL2QtkagjZ6kEc0M3lhiFMZvV8d76N8spJ3LJ%2BzX6eSiZ7yQ8zxj8Kc8vkzjTvFtHT493O2y155Hwuaxr9p0nquUTP6t2uT\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2380\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5792,"size_decoded":3232,"mime_type":"text/javascript","magic":"data","md5":"d486693396667295dbac8def9ad05a91","sha1":"06b384bd770972d0e17e628e36151e8a85225b35","sha256":"b9bbbb9b2abd510cf3167f5405655cf4c639546eda301b56ec6457f8a716d6a4","sha512":"00f71aab782c0ffffc746840f8877d5f19930d12e88db66ad7a8745e27bc90fd6f35feaeb173880625c98ffefca04e0ada16b3cd96a95b7e96476b60f501a923","ssdeep":"96:oE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaM/:Xhgws4WTBYNB1C9aNwAMPyd0R3SGaMSe","tlshash":"50c1a8c979def056235910a594afb005e134be2870deb800aae0c4957eb44cdb1b7fba","first_seen":"2026-08-20T20:36:42.924411Z","last_seen":"2026-09-08T18:35:53.95861Z","times_seen":177,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/f0c07d9915ae8435c6a4ee7d993fe5d3.js?ver=fe5d3","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.086Z","timestamp":1788892516086,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/f0c07d9915ae8435c6a4ee7d993fe5d3.js?ver=fe5d3 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d519fa132d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"dfb4-6aa04bf2-1892070d3ade18e;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:58 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b6GyVkKSY23eiICI%2FGzE3N8n3u0xzQfRXvvxdY7%2FHWjDHXtzC%2B18oSgk%2FNDfxoXyHASACXlUG80Kigo0uixpBfAtF831YUTuOGwVWHXg2ca5Z2qnE57c24fwxIsI0vqpvJ%2FCvlzO\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15421\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":57268,"size_decoded":16281,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (57266)","md5":"0e1afb6339687f4bc99ccdc5efaa80b7","sha1":"9bcad1aa5c85676112f327c9659ba69a81fca429","sha256":"f0046ea40f3faf4fc8f8f9927b1a60aa1909a362f0d8aef69dbf650a0229ece7","sha512":"82b22722aac1e1cbb5ccff35a36421f5d213df88d26eeb69e1dc339395334bf849f5c6aa30760cc997f52fd5ee7d30f9d0e3479a7ed61a42dd94b71ab5362683","ssdeep":"1536:qMkusBZ7kSZQQFRNM9jGZSthq3+uTONdgj+sMJpxzz2WfBWPGAAPqD1Aql208FEX:nWB7XYpMx","tlshash":"b643fa057352347345de516aa03b930b72b6254e2802d09cb4bddcdb29bcdae31abbf5","first_seen":"2024-11-13T13:08:50.072671Z","last_seen":"2026-09-08T18:35:53.959206Z","times_seen":30,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/antonio/v22/gNMEW3NwSYq_9WD3yHQiFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.285Z","timestamp":1788892516285,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/antonio/v22/gNMEW3NwSYq_9WD3yHQiFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 26592\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 18:50:35 GMT\r\nexpires: Thu, 02 Sep 2027 18:50:35 GMT\r\ncache-control: public, max-age=31536000\r\nage: 517481\r\nlast-modified: Thu, 04 Sep 2025 17:35:30 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26592,"size_decoded":27405,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26592, version 1.0","md5":"9ffb4e65d3fabc3e6b4d5d592ba92226","sha1":"6723345bc609421681cb916105476c4cc3f92db1","sha256":"82661feca9e5b933308629a630caa991566250273379a213b6af257fbdfaa71a","sha512":"875d8c78514e049f096b0a14b842b7a8e5fda5cdf82e834dab85409017abee37006801f2d966731a7de9f82761dcaf0fbd41577d055c03c8993cf3cfebdab03d","ssdeep":"384:M71UJO6FUW3VVcdSpjAjWf33IucscRM+lDgary6sSfUHx1NYmdMCEocIR4yf:M71UJv53V/rydgAFsSfUHxjnJEo/ayf","tlshash":"17c2f2433d9f606c935b88b2b069b596875810b4e3a1763bddc967146ff0cf19ad2070","first_seen":"2025-06-04T00:24:55.422247Z","last_seen":"2026-09-08T18:35:53.925008Z","times_seen":568,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/62bba6c57be55b2661f08e321644c492.css?ver=4c492","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.802Z","timestamp":1788892515802,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/62bba6c57be55b2661f08e321644c492.css?ver=4c492 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fdf0c32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"587c-6aa04c5a-ee36333f6095b26b;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FlWMg%2B3sIRJIdSY6vKYtAgU404j7dYMnaGMRCekCgHklpMuMWi59junGyQcFZ8r1%2Fg%2BtEHo%2BnGAFW6N5%2FofpFqnUsuf%2FTroIblPxV7QrwhtHQhtIj2e5m5TjYolKJ7DZHGkDyhgG\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":22652,"size_decoded":3874,"mime_type":"text/css","magic":"ASCII text, with very long lines (22652), with no line terminators","md5":"eda8241cb603052cd9ab05b9ef346a4d","sha1":"f171d67479f87f768682a05a7ce5c591e5053dd0","sha256":"c1ffd0a602f8a058d2640df4a9484e811145cd5800f0bcc4d3ae4b0004420ee7","sha512":"820138312bb423fe6ba6c65dbbe93e3eff32839c2019600b666e3cdc5b4533588ba875c8e0b32768be3a7744b3102c41f61bb0479b79cba116b68494b1139fa4","ssdeep":"384:u40spp1BqEJ5xmJvDRGZnbMgtqgdJCsYcbe:gOW","tlshash":"a6a2dbbaa24b249950b7d326c1c0e3e57b1ca1c4e7224fe7e65677b100cfed15c6986c","first_seen":"2025-10-20T15:39:21.64806Z","last_seen":"2026-09-08T18:35:53.959774Z","times_seen":3,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/f2a80e2743357d1cddf30bd217615ed3.css?ver=15ed3","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.819Z","timestamp":1788892515819,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/f2a80e2743357d1cddf30bd217615ed3.css?ver=15ed3 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fef1732d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"11cd-6aa04bf2-c9ec0d81f85634c0;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:58 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aNgaLFCcXHpDszqJUHd%2Ff1NWAGoB19rvC85dmCbltO3Aw22D01nhg9FUDjJvIAFjF7%2BtRaBvFgP0V7nnsarhHdI%2FXR%2BK7E2YNPB51A1xyb5gZ2uu3cTucyJ4kaFMGLkczMkoGTfC\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":4557,"size_decoded":1882,"mime_type":"text/css","magic":"ASCII text, with very long lines (4557), with no line terminators","md5":"525c9496ba0fdf5126511ce197ac1464","sha1":"6598a1535c3ec26f737a07e9ab79686cc7ff46b3","sha256":"bf497c8dbdb1efa879321a20c594c56084de036805c0d19e2d14eb7e08b2f5b3","sha512":"709e7ba76f04c8e9aa4b8b93137c366b289381c547d3baacc168187b0f2aaf0eb15888a0b65e08dc62b1624873b53f4fdd532e16bb8642198b63068fd15860e7","ssdeep":"48:90TWuKWzfwInzjnqKdkyz8tyR5feEX8Q0zA/I+/4pdQ8bMsobZijn0oiiDYt0QJ5:eTTvmxY0WeakAQ+QdM7APD20aKPF6","tlshash":"f7913200332a0cfa483fcb84f5da60651c2dbd89935edfc6a59dd050728e5d74d67a2b","first_seen":"2025-04-13T03:49:42.757055Z","last_seen":"2026-09-08T18:35:53.960377Z","times_seen":624,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/antonio/v22/gNMEW3NwSYq_9WD3yHoiFbez.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.284Z","timestamp":1788892516284,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/antonio/v22/gNMEW3NwSYq_9WD3yHoiFbez.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 16288\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 08 Sep 2026 05:26:48 GMT\r\nexpires: Wed, 08 Sep 2027 05:26:48 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:35:31 GMT\r\ncontent-type: font/woff2\r\nage: 47308\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":16288,"size_decoded":17100,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 16288, version 1.0","md5":"83b48059d2c874141bb19206b9294c58","sha1":"f7d53831dae76417d334ba61589ab10df1448396","sha256":"3152e914d8adaf5a1045916103a25107248deb993e1606b108c7e901adc2119e","sha512":"b9b2d78ed307a293c5666bb9a78c3115c559b0813848ce9d5014b4c89bba63f0065e004fd1a17260536c4aba061b2bcf99e1ddb3f031535219e839fe8f546549","ssdeep":"384:eqTj3pirdwF1ulPz6rY4RuO0wKH6J986jIStUJS7PlDgb:eo3p2e6T0ue/H86jISwo6","tlshash":"4772e15208604b19474904b8aacc5ff29390f4e394f9e39ff190d178ae85f7a5a745b3","first_seen":"2025-10-21T19:21:31.288102Z","last_seen":"2026-09-08T18:35:53.960995Z","times_seen":17,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/antonio/v22/gNMEW3NwSYq_9WD3yHQiFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.289Z","timestamp":1788892516289,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/antonio/v22/gNMEW3NwSYq_9WD3yHQiFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 26592\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 18:50:35 GMT\r\nexpires: Thu, 02 Sep 2027 18:50:35 GMT\r\ncache-control: public, max-age=31536000\r\nage: 517481\r\nlast-modified: Thu, 04 Sep 2025 17:35:30 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26592,"size_decoded":27405,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26592, version 1.0","md5":"9ffb4e65d3fabc3e6b4d5d592ba92226","sha1":"6723345bc609421681cb916105476c4cc3f92db1","sha256":"82661feca9e5b933308629a630caa991566250273379a213b6af257fbdfaa71a","sha512":"875d8c78514e049f096b0a14b842b7a8e5fda5cdf82e834dab85409017abee37006801f2d966731a7de9f82761dcaf0fbd41577d055c03c8993cf3cfebdab03d","ssdeep":"384:M71UJO6FUW3VVcdSpjAjWf33IucscRM+lDgary6sSfUHx1NYmdMCEocIR4yf:M71UJv53V/rydgAFsSfUHxjnJEo/ayf","tlshash":"17c2f2433d9f606c935b88b2b069b596875810b4e3a1763bddc967146ff0cf19ad2070","first_seen":"2025-06-04T00:24:55.422247Z","last_seen":"2026-09-08T18:35:53.925008Z","times_seen":568,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":48,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"groot.mailerlite.com/js/w/webforms.min.js?v1f25ee4b05f240a833e02c19975434a4","fqdn":"groot.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.546Z","timestamp":1788892516546,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /js/w/webforms.min.js?v1f25ee4b05f240a833e02c19975434a4 HTTP/1.1\r\nHost: groot.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nlast-modified: Thu, 03 Sep 2026 16:25:20 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-MailerLite-Account,X-MailerLite-Token\r\nx-envoy-upstream-service-time: 0\r\npriority: u=3,i=?0\r\nage: 95\r\nexpires: Sun, 13 Sep 2026 18:35:16 GMT\r\ncache-control: public, max-age=432000\r\ncf-cache-status: HIT\r\netag: W/\"6a999f70-2f5f\"\r\ncontent-encoding: br\r\ncf-ray: a3800d546b470731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12127,"size_decoded":4397,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (12127), with no line terminators","md5":"83147fa8ce2d95cb73ece7f28b469519","sha1":"530288c27b9a22124bf9e2c239584ebaedd467c9","sha256":"95f9e26622fd9b3b0d13e3c7a4996ea40fdd00d0f26c90806b99f850d01c55e0","sha512":"79370e2287c0bef2e8aefd1156633f8765bd53ac82afd09563283d62183ba10a2e62cb1770607849e9bd5a4072e700c3689fefe568d5eb5688f76af5698deb0e","ssdeep":"192:YA3Oop38Xmt4EUJYaN5GtAG7DRxHGrGi554LkojofEdEFTwx4kP9BJamXmvC4X81:YGOop38Xmt4ZItx7DrWojofEdEFoJaXI","tlshash":"2342778575e2e1e7297704a276fbb74271b2693adc0b4000811764b13dbcd879a3abcf","first_seen":"2026-06-08T15:24:47.782591Z","last_seen":"2026-09-08T18:35:53.945921Z","times_seen":317,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"challenges.cloudflare.com/turnstile/v0/api.js","fqdn":"challenges.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.18.94.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.058Z","timestamp":1788892516058,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"challenges.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 14 Aug 2026 21:10:25 GMT","end":"Thu, 12 Nov 2026 22:10:06 GMT"},"fingerprint":{"sha1":"79:90:42:E8:74:20:D2:D0:39:4A:8D:45:CE:B8:4F:AB:BC:6F:44:CB","sha256":"19:83:5B:D3:2C:DF:FE:44:CC:51:73:F6:5E:98:2B:5C:42:6D:3A:01:F4:37:63:E0:EC:11:45:78:B5:24:15:3D"}}},"request":{"raw":"GET /turnstile/v0/api.js HTTP/1.1\r\nHost: challenges.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-length: 0\r\naccess-control-allow-origin: *\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public\r\ncross-origin-resource-policy: cross-origin\r\nlocation: /turnstile/v0/b/41b097bd224e/api.js\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a3800d518c48b515-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-08T20:34:11.144457Z","times_seen":18352374,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":9,"connect":13,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/11d76825842913c1abe2e28b223328b0.js?ver=328b0","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.075Z","timestamp":1788892516075,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/11d76825842913c1abe2e28b223328b0.js?ver=328b0 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d518f9032d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"348d-6aa04c5a-3618029fec538177;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dsfNvZiaxB%2B2YZFabd7Yw7AGRK%2FuL4X5cP9gBD225jpVj7M4AScL4BDGLE8ycif6c7x7e9qni%2Fh46LQnGa5YQK%2FEsc5JVzzlnYdA0966rq56UMz%2BALUZeLAefEUaAzI%2BXcFd9VnP\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4011\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":13453,"size_decoded":4873,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (13451)","md5":"84da02f41d9c61dec95f05d41236d497","sha1":"2bb978916e29e01050ea71d2c68a299fc61f90d3","sha256":"9d8c33c2fb6efb6c3e9778edd19c6c60bf61e327c1132787e14f66cb7cba9726","sha512":"8fb2072d48ed3c279ea005d758d64467384ff0efa72e5ffbe547dda86a6cdd3aa28741a2d342ca28d9e98cb8ee8a0c8d05fad75455d47eb858d7f4101b81e40c","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5D:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjZ","tlshash":"ab52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","first_seen":"2024-11-03T23:01:56.192803Z","last_seen":"2026-09-08T18:35:53.961657Z","times_seen":10595,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/c1f223ff91df93f79e5b0425eabe16c0.js?ver=e16c0","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.081Z","timestamp":1788892516081,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/c1f223ff91df93f79e5b0425eabe16c0.js?ver=e16c0 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d518f9b32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"5e4c-6aa04bf2-4fb26775f7403142;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:58 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y5HLsodA%2BreSwUVHy6QVhuphesSMkdXDRytpXabnAHn4pcETz7ofvdPjoV1r%2Bd2EqVy%2BPzO5wTPyQhjG0knBIzkT6dz%2B%2FE3UMTlK02nBQJ2dd8ekdfJ2swTP81yeG1rDe6HogGRf\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7117\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":24140,"size_decoded":7977,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (23966)","md5":"b6f90950aaf018e4070ca7f955e3ddfe","sha1":"f0b1514d13ce7ed594af8894ae7b17d10152d756","sha256":"f81a4a9211214d226d5a01b81b8956b91089eb622ab70572dcf54e6b707521a8","sha512":"0675161dd96ac91cae531196f48a952bc1c2d2493deefb6a0385b6e2cba9e6e6c98740a60e6656b35c924cfb0db7541e40f22d5e56726096a277a0e897c3f0ab","ssdeep":"384:Ar7mIr/Dh5rA3rzB4rMhr/XWGHW/6rMz1xftF2OUVP4eAnbhfreD6dCBEOav7blR:+SxxGG2/71xftFqVP4eAnI0ROavPSCzN","tlshash":"fab2848f73407425428bf16696af020fb137655c7a4790acba6ad8db1cb984d2037fbd","first_seen":"2023-03-08T20:11:00Z","last_seen":"2026-09-08T18:35:53.962254Z","times_seen":798,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/themes/esda/img/button/ico-arrow.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.299Z","timestamp":1788892516299,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/themes/esda/img/button/ico-arrow.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/wp-content/litespeed/css/7b79541c953d1f75f907f6e31ae9bcb6.css?ver=9bcb6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a3800d52efeb32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"1ea-6a5fa107-336b1ec7465e9a9c;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 21 Jul 2026 16:40:39 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FXt%2F0Bg%2ByfgnqDGcV%2FSq1wNorVkUhCBz0Jt34tR5lj%2BefFPFOOjel8d3WknKrwulint%2BbuI9XJnOjN9p7JRY0v4I%2Bi%2BCEr%2BxYEOyhWNn53v89u2za3iQuKIvCUh3Edm6aO%2FVaGMt\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 490\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":490,"size_decoded":1303,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4d4ebb20076ec9557459897fb21c39a7","sha1":"7e4882ca75278a3d3bf36a8be2cd18fb6afc9c53","sha256":"6230a42b21fa729687cd754ff903d0493b585434a716d7e9e03233a54316d5a5","sha512":"572ba8994470b6f2d9180c163404248ff907ada99abd7713fcab71c7f2f044ffb6db4a57bdf3e12046888d4d6881f686a05c621670b5a713133c1abf69976f91","ssdeep":"","tlshash":"c0f0548cafd681abc4912b36ca16e961221282154b39cb4864ae53f50d20b00abe4d44","first_seen":"2026-09-08T18:03:27.01009Z","last_seen":"2026-09-08T18:35:53.962893Z","times_seen":2,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"assets.mailerlite.com/jsonp/521914/forms/94931475246351627/track-view","fqdn":"assets.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.606Z","timestamp":1788892516606,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /jsonp/521914/forms/94931475246351627/track-view HTTP/1.1\r\nHost: assets.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://esda.mom/\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 204 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncache-control: no-cache, private\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-envoy-upstream-service-time: 29\r\ncf-cache-status: BYPASS\r\nvary: accept-encoding\r\ncf-ray: a3800d54eb3835a6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":333,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-08T20:34:11.144457Z","times_seen":18352374,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":0,"dns":1,"connect":1,"send":0,"wait":107,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.mailerlite.com/fonts/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu0SC55K5gw.woff2","fqdn":"fonts.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.650Z","timestamp":1788892516650,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /fonts/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu0SC55K5gw.woff2 HTTP/1.1\r\nHost: fonts.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.mailerlite.com/css?family=Roboto:400,400i,700,700i|Merriweather:400,900i,900,700i,700,300,300i,400i|Lato:400,400i,700,700i|Montserrat:400,400i,700,700i|Montserrat+Alternates:400,400i,700,700i|Open+Sans:400,400i,700,700i|PT+Sans:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i|Roboto+Slab:400,700|Ubuntu:400,400i,700,700i|Titillium+Web:400,400i,700,700i|Nunito:400,400i,700,700i|Cabin:400,400i,700,700i|Oswald:400,700|Work+Sans:400,700|Exo:400,400i,700,700i|Comfortaa:400,700|Raleway:400,400i,700,700i|Oxygen:400,700|Poppins:400,400i,700,700i|Playfair+Display:400,400i,700,700i|Shadows+Into+Light+Two|PT+Serif:400,400italic,700,700italic|Josefin+Slab:400,400italic,700,700italic|Arvo:400,700,700italic,400italic|Vollkorn:400,400italic,700,700italic|Karla:400,400italic,700,700italic|Noto+Sans:400,400italic,700,700italic|Barlow+Condensed:400,400italic,700,700italic|Anton|Inter:400,700|Abril+Fatface|Yeseva+One|Poiret+One|Marck+Script|Pacifico|Fira+Sans|Rubik\u0026subset=cyrillic,cyrillic-ext,latin-ext\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: font/woff2\r\ncache-control: public, max-age=432000\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\nx-content-type-options: nosniff\r\nx-cache: HIT\r\nx-envoy-upstream-service-time: 1\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\nage: 24464\r\nlast-modified: Tue, 08 Sep 2026 18:02:46 GMT\r\nexpires: Sun, 13 Sep 2026 18:35:16 GMT\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: a3800d551d730731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30624,"size_decoded":31185,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30624, version 1.0","md5":"7f28d9acd0a8a4c1464195d229d07842","sha1":"35bbf23933fd8acce9191cd6ebd7b9eda82babfb","sha256":"2d4c25a2a206d16537302b054f6a3b847ff79175207963a5fed6e12af26dd8e0","sha512":"b5cdd937b0fe2239b3cc0d11ba9da8287018c7dde80b926ed29ad0dfeffb9e23ec8ae3b8fb20762bb3e5577a9c52628e8b871509aa6869a1b705ff6042eef19f","ssdeep":"768:3rVg7tfGrzmvMKLyC+cTLBD7cvnDRbc40d1bkjKniV:3ryf0mvMKhAnlb4ry","tlshash":"44d2f115aaeec3dbc8288f3ff0af0f0943a797173454bdb26275d86ea291f006105724","first_seen":"2025-06-05T03:41:41.778476Z","last_seen":"2026-09-08T18:35:53.963946Z","times_seen":595,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/favico-300x300.png","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.848Z","timestamp":1788892516848,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/favico-300x300.png HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/png\r\npriority: u=6,i=?0\r\ncf-ray: a3800d5658e932d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"4a57-6a71fcb5-f7ab6f1d554a3fb4;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:47 GMT\r\nlast-modified: Tue, 04 Aug 2026 14:52:37 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zY1n5FrVTocl436tfv1yJopbfOTlsCn3OZKeH1FnW9%2BMC%2B%2BBM2aNIPEDO7zIDaLtfJmT416y3Bs9a9vxWBWSUOjQFuNJyHdSq4pq%2BpD0q%2BU7wIiOom0e%2BaBYpf5rH1ygtwNxPRge\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19031\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":19031,"size_decoded":19843,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"b306987f07f6f46a86090b8cb4dfa4eb","sha1":"e98959670d18940d83d51c07aa99fb4f62492cc9","sha256":"f3cd75c4b0e355d27808f74f6dbd92430c6cd7a466127c1d3af4f85b7a944378","sha512":"f16393894ec1779900474a9e37e312d6c87954a0597b6b9de6908a485f463844f6a87830e6fde0977300592e5c034891a81291af005d25274fe5b6671ec00a71","ssdeep":"384:felwyb2uLfsUoUhuwCMpnrmsG9fi/cYjetQnbN+NC:felF1fsUoQuwCqisRjv0NC","tlshash":"f682d00207d3bbd680aeaf4a77cfc71c7017e496786211485122a22a9cc32835f621bd","first_seen":"2026-09-08T18:03:27.054844Z","last_seen":"2026-09-08T18:35:53.964616Z","times_seen":2,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/cd03fcef72c1734369feb85bc018bc1d.js?ver=8bc1d","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.047Z","timestamp":1788892516047,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/cd03fcef72c1734369feb85bc018bc1d.js?ver=8bc1d HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d515f6e32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"13dc-6aa04c5a-fed2f71618bb6e4f;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZheEu3sZLw0x8zSnTXOe4Jt7r2cOSfO%2BYK%2FMfOSYyKnXQoCQubikbe32zfavPjWJvv2IW58oEqZT7E6DQVbikzGaUvKUiTY8krpSlPi84FzmWDqa5RythnZdd1cBVWEBdy6iwGYQ\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1295\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5084,"size_decoded":2149,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (5082)","md5":"ad59ac3c766bf2dc714639017a1282be","sha1":"002eab39c80f11e2fe75abb21c9d77f0e53e9673","sha256":"5698cfad2537364d79935a8824bae7ac1a656ef83039aa6745ec7f77d4c676a1","sha512":"3505036cd7a19397777f1e9afa5629b9c0c2a2dbb1ebc324777188a6d091e7ab407c0b3e1725d3e3d6cc31402719fad64707e04dadbe557d0322b31fd82891f8","ssdeep":"96:zVr/rF88C6uNkcSEg0Q21sBi+mipFPEzDmIzONYk:RrjF88CbkcSEPQ21S1XuzDFu","tlshash":"94a1d094714b5a1649ebe3a3308b160c247ac5385830125ef6ee9ecf6db4f0572d3b7a","first_seen":"2025-02-20T19:03:23.579451Z","last_seen":"2026-09-08T18:35:53.965716Z","times_seen":20,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/88232267fbdf39c1a9506f497d270c92.js?ver=70c92","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.051Z","timestamp":1788892516051,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/88232267fbdf39c1a9506f497d270c92.js?ver=70c92 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d515f7532d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"c95-6aa04c5a-4eb482f0c20deb75;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hA5qqaMvEKOLb99Jochd0lhFcVMOQLrVmo4CXxFZsm0CNBQitX5UuJnj0LihrnRTgXuYEXeCjA7Kdj3FJ%2FJa%2BW0soD8OWy6pXkmJGMIDtZUUbHUCQPbuyQVCoLRTl3lvfPuYfjkb\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 894\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3221,"size_decoded":1746,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (824)","md5":"e46ca02fdc751b77c0865e4086d08ce2","sha1":"33078f30da7cbe3c664ff7e876a9d3efdbc58822","sha256":"0e9b18056530db5cc6194584814230c96a4b2fbe251c44a244852dbb0b448e25","sha512":"8e15c65208b6f558eb7511d76a5aa76628709ee8ecd09c20bed7227b497048ed8fa4220952579a8dd3df65bf756c79f651fc768e87a2d375495bc315710d87ea","ssdeep":"","tlshash":"50619f9ee2126b1b46eff2bf001f12950e33b464494a606c32ba26d4ce1ad11772f67d","first_seen":"2025-02-20T19:03:23.583029Z","last_seen":"2026-09-08T18:35:53.966856Z","times_seen":21,"resource_available":true,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/slider-1.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.085Z","timestamp":1788892516085,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/slider-1.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d519fa032d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"1da6c-6a70da92-bad1a5bb2b7470bc;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 18:14:42 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Fx4bnAr3%2BF3Hp1tia1h3I9yF2JFFgqZ2UzAycJ6Co9zBcaxj7x9CeJH16nPPeMpvvMMNRcTN2LDv7gK5mGclgjs%2FOB8e0JmQmxWVdQx9kadUx0x6WdxonuJIr9GWOSZtVVyHzeh%2B\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 121452\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":121452,"size_decoded":122260,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"33b0f49dfb524e29698237f8e8e4415e","sha1":"ee001b523ed00be5aeb2e001da6a9ee7a00745fd","sha256":"513ab3961b8a360bc49145a707d954c966afda17dca0c71f4fb411d2bd3af46e","sha512":"e0c1ec1120dd0c16a9c35c7745cc4ba2ae8958703813d019f96fd85d90b1c7529277cb2ced5d4c62a3e4252cc7935b8177b585128a3846ec0562c04df0d6cd03","ssdeep":"3072:nihp4/xB4EklAhB9RzNSKy5USPNKaqtECo1M:niv4/xlk6jLQ1PYtm+","tlshash":"31c312c441bc741a8c71b64a1ea59f70619d5332afa207845f0a504bf4fec1a69ffeac","first_seen":"2026-09-08T18:03:27.061349Z","last_seen":"2026-09-08T18:35:53.967544Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":62,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/slider-4.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.089Z","timestamp":1788892516089,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/slider-4.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d519fa432d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"3edbe-6a70da95-240a745b192ea99c;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 18:14:45 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fhhuQFeA4oqnfSiqXPY3AYwqYvCslrdeDfqegX%2FXgnlDTBL5AmTyh0NjJA12xpwvUmUO3AV%2FtJz42T6%2FN%2FCJNQU235jxWDxAOVEwXdfK9An27LH%2FjpiMgbNyT62UEux79zJ4Q4t9\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 257470\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":257470,"size_decoded":258280,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"12ab3a859daf2f27cde905193220df52","sha1":"ee071dbb625c64762de487e32b5e481a83aa3754","sha256":"d908337e385c3f590b17ecfb80638ae3c2fefc43d2e2dd058a19e583e2f7578d","sha512":"0f521eaf6c44f06d45d87c2ecf4f0bbb8bd39c52edc2098e6285ef1925b41c5f6260fbf8ea2201f589f61ef2bc17633a67e632fac0ee1703306d03ffd1d22a85","ssdeep":"6144:X8nTEBjfTeJ33aEW6bM7sBv1++K3CxnliuYncmbWzx5Jqq:8TsjfTS33afg+z38nliwmbWzx5Jqq","tlshash":"6f44226c9e03a026013f1c75652754ae3c3607a2feda6f14929d3103aefdeb1b11b6d5","first_seen":"2026-09-08T18:03:27.003401Z","last_seen":"2026-09-08T18:35:53.968576Z","times_seen":2,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/antonio/v22/gNMEW3NwSYq_9WD3yHoiFbez.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.291Z","timestamp":1788892516291,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/antonio/v22/gNMEW3NwSYq_9WD3yHoiFbez.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 16288\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 08 Sep 2026 05:26:48 GMT\r\nexpires: Wed, 08 Sep 2027 05:26:48 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Sep 2025 17:35:31 GMT\r\ncontent-type: font/woff2\r\nage: 47308\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":16288,"size_decoded":17100,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 16288, version 1.0","md5":"83b48059d2c874141bb19206b9294c58","sha1":"f7d53831dae76417d334ba61589ab10df1448396","sha256":"3152e914d8adaf5a1045916103a25107248deb993e1606b108c7e901adc2119e","sha512":"b9b2d78ed307a293c5666bb9a78c3115c559b0813848ce9d5014b4c89bba63f0065e004fd1a17260536c4aba061b2bcf99e1ddb3f031535219e839fe8f546549","ssdeep":"384:eqTj3pirdwF1ulPz6rY4RuO0wKH6J986jIStUJS7PlDgb:eo3p2e6T0ue/H86jISwo6","tlshash":"4772e15208604b19474904b8aacc5ff29390f4e394f9e39ff190d178ae85f7a5a745b3","first_seen":"2025-10-21T19:21:31.288102Z","last_seen":"2026-09-08T18:35:53.960995Z","times_seen":17,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.mailerlite.com/fonts/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu0SC55K5gw.woff2","fqdn":"fonts.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.498Z","timestamp":1788892516498,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /fonts/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu0SC55K5gw.woff2 HTTP/1.1\r\nHost: fonts.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.mailerlite.com/css?family=Roboto:400,400i,700,700i|Merriweather:400,900i,900,700i,700,300,300i,400i|Lato:400,400i,700,700i|Montserrat:400,400i,700,700i|Montserrat+Alternates:400,400i,700,700i|Open+Sans:400,400i,700,700i|PT+Sans:400,400i,700,700i|Source+Sans+Pro:400,400i,700,700i|Roboto+Slab:400,700|Ubuntu:400,400i,700,700i|Titillium+Web:400,400i,700,700i|Nunito:400,400i,700,700i|Cabin:400,400i,700,700i|Oswald:400,700|Work+Sans:400,700|Exo:400,400i,700,700i|Comfortaa:400,700|Raleway:400,400i,700,700i|Oxygen:400,700|Poppins:400,400i,700,700i|Playfair+Display:400,400i,700,700i|Shadows+Into+Light+Two|PT+Serif:400,400italic,700,700italic|Josefin+Slab:400,400italic,700,700italic|Arvo:400,700,700italic,400italic|Vollkorn:400,400italic,700,700italic|Karla:400,400italic,700,700italic|Noto+Sans:400,400italic,700,700italic|Barlow+Condensed:400,400italic,700,700italic|Anton|Inter:400,700|Abril+Fatface|Yeseva+One|Poiret+One|Marck+Script|Pacifico|Fira+Sans|Rubik\u0026subset=cyrillic,cyrillic-ext,latin-ext\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: font/woff2\r\ncache-control: public, max-age=432000\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\nx-content-type-options: nosniff\r\nx-cache: HIT\r\nx-envoy-upstream-service-time: 1\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\nage: 24464\r\nlast-modified: Tue, 08 Sep 2026 18:02:46 GMT\r\nexpires: Sun, 13 Sep 2026 18:35:16 GMT\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: a3800d541a590731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30624,"size_decoded":31185,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30624, version 1.0","md5":"7f28d9acd0a8a4c1464195d229d07842","sha1":"35bbf23933fd8acce9191cd6ebd7b9eda82babfb","sha256":"2d4c25a2a206d16537302b054f6a3b847ff79175207963a5fed6e12af26dd8e0","sha512":"b5cdd937b0fe2239b3cc0d11ba9da8287018c7dde80b926ed29ad0dfeffb9e23ec8ae3b8fb20762bb3e5577a9c52628e8b871509aa6869a1b705ff6042eef19f","ssdeep":"768:3rVg7tfGrzmvMKLyC+cTLBD7cvnDRbc40d1bkjKniV:3ryf0mvMKhAnlb4ry","tlshash":"44d2f115aaeec3dbc8288f3ff0af0f0943a797173454bdb26275d86ea291f006105724","first_seen":"2025-06-05T03:41:41.778476Z","last_seen":"2026-09-08T18:35:53.963946Z","times_seen":595,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/a03a9c9ef65a894504359807db130d81.js?ver=30d81","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.054Z","timestamp":1788892516054,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/a03a9c9ef65a894504359807db130d81.js?ver=30d81 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d516f8332d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"665a-6aa04c5a-d8037e13e6eddabb;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TRiT3IhkrdFzDogX7DlJeqV16IgMO5cXa7%2FZ1uRd8yxcyQtt%2BlcYEwABY4ayU5o8FtIMVjrXMBV9WCPZqXL%2FIiLPU3CK3Qk%2F9H83h43byeq8DWDlXtWi2D8qXNAovcV4umPNbTkW\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6125\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":26202,"size_decoded":6983,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (26160)","md5":"0e3575ff5bb049b26dd9de0428d52206","sha1":"9679bae222b452f365b51f9b77a1e5a05258ad9f","sha256":"10fda27861ff14d42bac718d7b8fc20a3996704a74b869c3396d4de14679ef9e","sha512":"9c7018b219afc2fcf3d8b4ac28e17f9e5d7f3ea1ecb3b919883bb79631b3de610ac72ca5276a9aecf8476fe246cf8a453b060f52cbc83fbf5d509ddd96010abd","ssdeep":"384:79MYnd4kXN4/Lez4e4PVg41RcfM9qp4q47XY:79pn7XKj1RcfMrY","tlshash":"c9c2868f33657730cdeab372512f720b67960596e5294834d51a38887c3936f42afa2f","first_seen":"2023-09-21T18:09:20Z","last_seen":"2026-09-08T18:35:53.969633Z","times_seen":76,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/77691ba250db9d104026a794237393b6.js?ver=393b6","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.059Z","timestamp":1788892516059,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/77691ba250db9d104026a794237393b6.js?ver=393b6 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d516f8532d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"a99a-6aa04c5a-a8577ac80c92773f;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zZoa0OApOaTnNqwY3jh4PEJnVR3tR0FwmH2HNRELTWaELoKqRTNyhCxpkw9k4BBQLFfFDhXztuAfU8ZesFFSIRPBOS6caDiVxlCY53RhL9pI8daDiydPni5Q7FvjrowffMCsKsNg\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10001\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43418,"size_decoded":10852,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (43416)","md5":"d83151f68df18daa583b32491e6412e8","sha1":"2c036239774439c8864b7f70986632c3d363a90e","sha256":"b34ca2039a3e1ea313308a6ba41b693b92ce7cdabd5045aef4e61b49f2731f2a","sha512":"de56d1afc2ab74a350fbd3632e152b390b10bfb6476faf1c606f14d0e804024ce7442b703d04d1ae9dd17cd8e177c198cb426a9be0c572af67035880f4999eaf","ssdeep":"768:I/6VeyMdLkeSVhudyXkysHtvN9f2+5D39fv9ISncqMp80uJsCGOUmngl4l1w7EF:1e9HJtvNwGw2","tlshash":"b6138449d605176688db20e63105c00da3f7eb7cab12c1d075d987eb64be8098ad77fa","first_seen":"2026-09-08T18:03:27.068571Z","last_seen":"2026-09-08T18:35:53.970247Z","times_seen":2,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/07/grafik.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.300Z","timestamp":1788892516300,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/grafik.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a3800d52efed32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"31e80-6a6ccb8b-c0bc9cd4da5c475b;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Fri, 31 Jul 2026 16:21:31 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9TD7kWufnZvVE0VJkXePLoSeTt0T8qMDGzFUZpMy6KEjerThxetYenEgRj1xabVg9EYvETKIpcInh6UV4iWWJBmyQAnTDk52i9ghkquXd2n%2FVllJ6ZAfA2ar46jHO881SyQuP2UR\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 204416\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":204416,"size_decoded":205218,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2a97a53d0b8acae5531e55ac55166797","sha1":"5b23e5a607e2f6265c6691993b1bf08d77fa5ec3","sha256":"184b0b283b16fcaf659eacbc3214a51cf7cac7ee9c26448624092575390a10b7","sha512":"9b08c4b83ce302c9ad837cf4f4a97576682541dc7cb712a48f6c53c33709aac07a1439725b5b158079931f465f66042ce054a8b06cb2df4b15d53fc9b2d3f126","ssdeep":"6144:/0rqFz1T/SnbIuIAnlqUDnSlBi0SmrNrTuITKUJk:/0ri1TanbPLqU7G7SmrlqIuh","tlshash":"a31412264afd7347ee5336e05990631813fd4908cef95a72aea71ed72235c28f05da23","first_seen":"2026-09-08T18:03:27.052794Z","last_seen":"2026-09-08T18:35:53.971283Z","times_seen":2,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/skrzydla-01.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.301Z","timestamp":1788892516301,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/skrzydla-01.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a3800d52efef32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"2b0c-6a70c83b-1fd9ff7bbba5464;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 16:56:27 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uBdEIVv7cc2FYIcxp6b8e6rEbNa%2BiIFdscg2dPA7HnnVYm4HpAhzu%2F5m%2FGWEVz4G7cCrLn5CqYpIEvx7qDj51qEhybbK23IYy3GGRy1%2Ff6g%2BY9a%2FU3lhc8YDSgYmU7PHm%2FWK5z4W\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11020\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":11020,"size_decoded":11831,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a442f4e5028b2f5f4c6f07ba162e6cf2","sha1":"b364ee9d84e3f286b3c984211df4557f961d7cc5","sha256":"09abb49c19f763e6f4bb4dd50eb535150084c546bee61a3f8e35307bf344b9a7","sha512":"d1cc1469d08a85a865484b6f4fadf5f6c74a7d959d53dc1c626a367100c5f17d18bbbd393f677bf55e5602233766ea136c87e46b68b0dc11cd6c3e5d2499121d","ssdeep":"192:dSRsuv7lL5or/SKIs2b9KhjJ6eiNUqNOz8hSm2oIUhqB98UlA0l:d+5LKrtbVJrRqo8hSm+UMPlA0l","tlshash":"1232bf0ce15942d6d2c799a65d6768bd5207f73023ab598233ac3f8e39200bf9e28462","first_seen":"2026-09-08T18:03:27.030131Z","last_seen":"2026-09-08T18:35:53.972214Z","times_seen":2,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.mailerlite.com/js/w/ml_jQuery.inputmask.bundle.min.js?v3.3.1","fqdn":"static.mailerlite.com","domain":"mailerlite.com","tld":"com"},"ip":{"addr":"172.64.150.190","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.603Z","timestamp":1788892516603,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mailerlite.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 09:34:59 GMT","end":"Fri, 13 Nov 2026 10:34:57 GMT"},"fingerprint":{"sha1":"A4:8E:C9:89:97:E0:32:76:AA:8D:83:D4:65:62:55:EA:8F:E3:16:E0","sha256":"F2:95:D2:C5:7C:B6:FB:04:40:A7:15:FF:1B:21:D8:6A:8E:2B:18:29:0D:7F:14:14:F2:F8:B6:E1:90:F3:1F:AF"}}},"request":{"raw":"GET /js/w/ml_jQuery.inputmask.bundle.min.js?v3.3.1 HTTP/1.1\r\nHost: static.mailerlite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 07 Sep 2026 11:15:33 GMT\r\nvary: Accept-Encoding\r\netag: \"6a9e9cd5-1153a\"\r\nstrict-transport-security: max-age=63072000\r\ncontent-encoding: br\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=3,i=?0\r\nage: 6744\r\nexpires: Sun, 13 Sep 2026 18:35:16 GMT\r\ncache-control: public, max-age=432000\r\ncf-cache-status: HIT\r\ncf-ray: a3800d54cc890731-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":70970,"size_decoded":19370,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32046)","md5":"775cee1998fe3d9fc0cb4450c293bbd5","sha1":"af3a53c3c3b63e59afc5e864f1050dd22a384108","sha256":"c77ae965196f7308b827ce8cef39758740e9652e49958d866454ca1967e03dae","sha512":"80d47478fd97067ea8573c2c6274a8df7a4d6fc8137ff93529af6fae0f0a96afa4b915c85a723c87c213823edc13627213c1d09f2a3bf1613c4939d26310f118","ssdeep":"768:n4EnGeFpoDyrBqnTOFAuPg7DDbsp5pKSwttCCVkv6pE54J5m872U1jVNWFaHRFUl:nJp6nTO2ulKJQCVkvQm87nFVN4aH20U","tlshash":"da63d7967b52b29a46e370f840ff8407a07aef9a34d94190f186b1c47839ed607b7e74","first_seen":"2023-03-07T12:08:55Z","last_seen":"2026-09-08T18:35:53.9207Z","times_seen":1850,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-08T18:35:15.169Z","timestamp":1788892515169,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncf-ray: a3800d4cbcebc6fc-CPH\r\ncf-cache-status: DYNAMIC\r\nlink: \u003chttps://esda.pl/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://esda.pl/wp-json/wp/v2/pages/2\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://esda.pl/\u003e; rel=shortlink\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UanVa5VaeFCCcdbFnS8Orj2i7nRmVmZTaIXy8rCa38ObSQ3%2BMSGyMNs%2BtKpSpsJNZiSVXk5XBM5%2BghkZgZMP35cVgHA9XtWBifRXtQFQbNVAezDRh0LIr%2FYn9bQ3%2B8dXm19TNdSn\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-dns-prefetch-control: on\r\nx-litespeed-cache: hit\r\nx-turbo-charged-by: LiteSpeed\r\ncontent-encoding: zstd\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Kadence WP Blocks","description":"Kadence Blocks is a plugin for WordPress that provides a collection of custom blocks for the WordPress Block Editor, allowing users to create custom layouts and designs for their website without needing to know how to code.","website":"https://www.kadencewp.com/kadence-blocks/","common_platform_enumeration":"","icon":"Kadence WP.svg","categories":["WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"MailerLite","description":"MailerLite is an email marketing tool and website builder for businesses of all shapes and sizes.","website":"https://www.mailerlite.com","common_platform_enumeration":"","icon":"MailerLite.svg","categories":["Marketing automation"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"C3.js","description":"D3 based reusable chart library","website":"https://c3js.org/","common_platform_enumeration":"","icon":"C3.js.png","categories":["JavaScript libraries"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"WordPress:7.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":472154,"size_decoded":58078,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (40759)","md5":"b179d6272429f72544687870277dcb0f","sha1":"4b8ac4d146c732ed168d6a3b3f69a5f7316f8676","sha256":"8981ff857e878e51dd8dda16f7c91a47cdc0dc5208f77b3ddabccdfb3d62b74a","sha512":"c9ee8fb5525bd781e87ae11588c64522ef90c974ea691d0c158f8f72c68a38bc3dc1f14903bffbe3d176264c35b83196cf0e5fdadbee3e60c8cae05e6017fe83","ssdeep":"6144:rSLKsOsqsGgUMIwRrlDh7hKlrDJx/jC0sGn1eGGwcoCzQL9d7zXp/Fbdmdoer:rSBKlrDJx6Gn1eGGwchzQLv7zZGr","tlshash":"24a4f8572718a079292b0dd4d6d62769b80d6047d20864e5f6f8c2e8facd8e316b33df","first_seen":"2026-09-08T18:35:53.973277Z","last_seen":"2026-09-08T18:35:53.973277Z","times_seen":1,"resource_available":false,"data":null}},"time_used":407,"timings":{"blocked":-1,"dns":53,"connect":15,"send":0,"wait":273,"receive":0,"ssl":66},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/39860a2b8be4aae1812b8e9fc486a7ac.css?ver=6a7ac","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.799Z","timestamp":1788892515799,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/39860a2b8be4aae1812b8e9fc486a7ac.css?ver=6a7ac HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fcf0932d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"0-6aa04bf1-f9516faafd0d71ca;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:57 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=58PavQGAd3vqt63yb4Mg%2F4Aa1hbacKMj8%2BNuK903EcwqPnfeltBsgoNnPWWkWbqi1ptLw%2F%2B0Dln%2Btfb3naRDDsFxtdoIrXoUw3%2BDA1H6rM1Yz3gHNS1c2o6WfeeHoWdriGObpYBm\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":804,"mime_type":"text/css","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-08T20:34:11.144457Z","times_seen":18352374,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.036Z","timestamp":1788892516036,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Thu, 10 Sep 2026 18:35:16 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kGyrkfTLQnrB1uLdGDx%2F0QfMrXHhPoGz0B%2FaNSIe7hDzcE5JumwDs4Kz3JTSSbLOl8r%2BxVnVkHagDEsnAOT2ODEvq5iX1Dwt50zQP6gJZfZjHVyT9jlQEC6YcQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\nserver: cloudflare\r\ncf-ray: a3800d514f6832d7-CPH\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1284,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-08T20:16:20.746634Z","times_seen":432067,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/1dd70f559ce130f8dbc891264df8368d.js?ver=8368d","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.067Z","timestamp":1788892516067,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/1dd70f559ce130f8dbc891264df8368d.js?ver=8368d HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d517f8a32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"13f4-6aa04c5a-cafcfbcd042551ed;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1xxV6w1w4V5f4U9PgNR6%2BAmBNZSTbnCvDk3%2BUpFqU1d2kXPZ%2BvZsBeI2FAXC6cAPvEUodF5MDlvtRSbeYxju%2B8qJD4iIA4XlMJpQyqpVvWISTLZv7xu6tYJaQdSG%2BS0chZnSnCRw\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1759\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":5108,"size_decoded":2619,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (5014)","md5":"586bfcf8b3829616f51a7e2a4aead287","sha1":"fb73b0adb250de47d067b2b2caf78879c68571b6","sha256":"57d5f320624e13606b8e6dc357482e85842aac712a80ddb4bbb0787fb1a3e803","sha512":"0b8e1125be8714dffc0e08ff49fbbbb1304c738e3d020bb2404b66ccc1f954ad6125760a58853aa42b02e1cee7fbec9c0d42623e1d529aee35f47851d267e648","ssdeep":"96:Fu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2Cio:FGIhNBcAD0NRv8XlD3wXY2yH+EoaY2o","tlshash":"abb163c43542b830e2777027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","first_seen":"2026-08-20T20:36:42.900883Z","last_seen":"2026-09-08T18:35:53.974751Z","times_seen":181,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/fg-1-200x300.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.083Z","timestamp":1788892516083,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/fg-1-200x300.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d519f9d32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"157ce-6a7eddd1-c70d52a664b728e;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Fri, 14 Aug 2026 09:20:17 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QMzyZEUMzP65kJ1al89shYWR80VxEuwwn7gikuPrAOBVXW6Kwx0baQFxxN75MPMJkV3LZEiOGuTDlC0xZye%2BYpXD4KYzZBkIgqy9xQYkkFI%2BdNUPAOtcGAS1zB%2FUBxBsorXFR0kJ\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 88014\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":88014,"size_decoded":88818,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"24384f58a37fbe66b33b2463e38155ec","sha1":"a9a005dec23c7bc88cd32b6d29e63335996336b5","sha256":"273a5a7095d7713d3ac8b1287ffc844bc7683ff58b5c9788882ff56328fabff2","sha512":"cdba425d146492c6b099c425208238788462c78b0d3c9ec2048cfb4f2201886ff4eeb493a2c55619f2ed02b571ec5c34553533a9cec71b2bbe89468cb8592ac2","ssdeep":"1536:7gWv7jOSRX7sSlNcO22G6uvH+EDSrXwt3nnYT3ImXF3+lw:D7qaXDNcyYnKwt3nYT4C","tlshash":"9e836c149de632eb886e9db3f44231cddea393aadca0060f76cdf3052f2055d499b646","first_seen":"2026-09-08T18:03:26.981Z","last_seen":"2026-09-08T18:35:53.975356Z","times_seen":2,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":49,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/ea89ac4fca609d37452984dc94f380b9.js?ver=380b9","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.084Z","timestamp":1788892516084,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/ea89ac4fca609d37452984dc94f380b9.js?ver=380b9 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d519f9e32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"293-6aa04bf2-b7a260da32eee585;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:54:58 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z0%2F%2FYga0QNlkN%2FSP37V7nMIfOJvN7fWXozTPM%2FC6YNweEkKUR4INjg4sky2dG092R1uJoBp9hd7efH6FGH9CiAdlzDQ2RRxsdRaV27iivtaNBK%2Bxph18qPdhnsMn6gQAme1UMdno\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 335\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":659,"size_decoded":1193,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (657)","md5":"ef3a48bf0d02e86cf53cb40bb6a7236f","sha1":"a7503b2af3913e15f6f66b0add26e3f79202691a","sha256":"0eb716817a932ca44114458eb649ac215fd3b2b6fe1ce9c04590a67c0fb89861","sha512":"29d20f799c060f9c6043346271013bba95b4a40627c353237b05eff37f6feb31dd7f44d1fcfce9aeaae802e8569ddf3d767a8e0e0f1211b686537afec1efaf1f","ssdeep":"","tlshash":"8b0123e8162371bb01bf2ebaca6eb2437e6270697747226501dcc8090984e434222dac","first_seen":"2025-06-24T06:18:58.433602Z","last_seen":"2026-09-08T18:35:53.97622Z","times_seen":23,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"challenges.cloudflare.com/turnstile/v0/b/41b097bd224e/api.js","fqdn":"challenges.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.18.94.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.305Z","timestamp":1788892516305,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"challenges.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 14 Aug 2026 21:10:25 GMT","end":"Thu, 12 Nov 2026 22:10:06 GMT"},"fingerprint":{"sha1":"79:90:42:E8:74:20:D2:D0:39:4A:8D:45:CE:B8:4F:AB:BC:6F:44:CB","sha256":"19:83:5B:D3:2C:DF:FE:44:CC:51:73:F6:5E:98:2B:5C:42:6D:3A:01:F4:37:63:E0:EC:11:45:78:B5:24:15:3D"}}},"request":{"raw":"GET /turnstile/v0/b/41b097bd224e/api.js HTTP/1.1\r\nHost: challenges.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://esda.mom/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nx-content-type-options: nosniff\r\ncache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\npriority: u=3,i=?0\r\netag: W/\"41b097bd224e-api\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a3800d52edbfb515-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86603,"size_decoded":28407,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65501)","md5":"8c293f28bf75525387922c868a2e0613","sha1":"cc0dcd1691110ac1542aec855f958dce4c6931f7","sha256":"14cbe02e19ad46e094496792226bce69d616a45074eed26f4c1850c51912ddea","sha512":"f083ef372cca3be23d53452e37d93ec761dc4df401d4eab7ecbb94881577ddbe1ff1537721cc38be1dcb0c205ec0cdb8a475964ff5c14ffb27942a947f26a32d","ssdeep":"1536:DL3dUa2dOjYj/gAmugU6aKLHXdAU7zMEBvOegEWGqcSlL:fEOjYtT6zXdzMEBvOejQR","tlshash":"e2831bc8729a787213dac1b4a07f5353b3297d35584c8850e527d8663a7ce878273fba","first_seen":"2026-09-08T10:35:27.937568Z","last_seen":"2026-09-08T20:13:44.907132Z","times_seen":403,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/7b79541c953d1f75f907f6e31ae9bcb6.css?ver=9bcb6","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.795Z","timestamp":1788892515795,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/7b79541c953d1f75f907f6e31ae9bcb6.css?ver=9bcb6 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fcf0532d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"12ddc-6aa04c5a-a38af8f0c5b6d059;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WN1AO176apfDU1y8gbm1qDx%2FmDuYkCmQPDOHAHGSpcYdoNVtbkpg58M%2F5ZwywshxK%2FqNiYehPYfp9l8%2BhL%2Bo72QMmz09qYdlnQHyv54xc8%2FNNfWkxVRkZ3cpzfoxscprcPjSKU01\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":77276,"size_decoded":13411,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"75e7efb39f101c5de707750d17b19f8c","sha1":"feee7f99aa4f0462b7632ebf39bd219632755c63","sha256":"8b7870605b16821cd11f1d53ef6c8a4dc6d115e3b401744192e8c3d2c4ba8d08","sha512":"a6eb05b4ce65117582470a2c4edc9cb5afff2c1df5b215c3c294181c3d8472a6f95be84217604b740400ad0a0eea45966cd127395aee73caa64f5d202a260f76","ssdeep":"768:ZOw6xCFQl7ZwaT63aVw+1kL44PAR+gpfx9EDo4RZLOt+iSiF4Uv:4waT63aVwlKYQKnlC","tlshash":"dc73c722a5d4622874fbc132a9d673acb77cc403e3130af9b59563b9c6d51d702f274a","first_seen":"2026-09-08T18:03:27.021654Z","last_seen":"2026-09-08T18:35:53.97749Z","times_seen":2,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/7176fda6ead5a50de0ffe0a9bf57da42.css?ver=7da42","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.810Z","timestamp":1788892515810,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/7176fda6ead5a50de0ffe0a9bf57da42.css?ver=7da42 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fdf1132d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"50c-6aa04c5a-7a34a3fa946cd0d0;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q5sfw9YfSZqUrvynXOCp470Af1rXsffeXmhneJ1bazZpf4Srzob%2F0JovvH8OGolpOBeaZMj%2FoHTRKXSaX%2BJ08ehTpS6P7dQ4QrhO3JxqrAFXOktg1uBCHOMczgfqz9Mu4oFZ4IsG\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1292,"size_decoded":1195,"mime_type":"text/css","magic":"ASCII text, with very long lines (1292), with no line terminators","md5":"fb10fd33e49d07d5628586270cd642ba","sha1":"ccd036baa67a353bc5f6a6ca29eb32b17b5281b1","sha256":"a7ca249e3bf46459feb9db1f63cee4ba11c431e1c6f1eb87b0155ba1d8278406","sha512":"f822a8cb5005f980894c66b679c9c7dc6bf18b288cb6298f65074ac395f2353341282ad605317ba2451945db200a3a8241b2cff4c4c977f9e5e26bca50155424","ssdeep":"","tlshash":"6f217bd15596220b39f650b901f5a3af60669889d607739bfcfe6db548fd0a00932244","first_seen":"2026-05-07T22:07:08.844956Z","last_seen":"2026-09-08T18:35:53.978318Z","times_seen":100,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/c4feec4fc1afcc3bbbe8b4515cb2e794.css?ver=2e794","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.814Z","timestamp":1788892515814,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/c4feec4fc1afcc3bbbe8b4515cb2e794.css?ver=2e794 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fef1532d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"5b2-6aa04c5a-e5dcc76912575e69;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2JMRzL%2Fqs7fyakVLsXwi6KkzXSwU6pfZ0GfiUztm1ctmv1Pl6cTCqAZsVnftoWZ1Z%2BusO2YFYuRSI%2BWoCiiLkZnfMWV42P2qC%2Ff2d6iG6vMRbpXljw%2B%2F5eANW8w3IGWMsUdxWSW4\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1458,"size_decoded":1253,"mime_type":"text/css","magic":"ASCII text, with very long lines (1458), with no line terminators","md5":"1f2cf78de270ae991365687b1a5901a9","sha1":"597b3f7affdf409e7010b399d27cb899ba607a3e","sha256":"6adbc9c5389d6f42b7c351e7f47488e7fdecd4d399faf11b2b56a961fde49a20","sha512":"68fb729ff51af8a25c3334020b7af2f71d338975b106eff2326e9286ad0573c895864aa354b498cd7f04d5e4577908a9e03d2fa851aba64a806032049f41577a","ssdeep":"","tlshash":"1c31d313593836b9442b9712a4ab7618833df980ff7614cdb539c260679e3411c57deb","first_seen":"2025-04-13T03:49:42.743289Z","last_seen":"2026-09-08T18:35:53.978898Z","times_seen":770,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-includes/js/jquery/jquery.min.js","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.823Z","timestamp":1788892515823,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/javascript\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fff1d32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"15601-64ecd5ef-49bc19befaaf02e1;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Mon, 28 Aug 2023 17:14:23 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HDP1%2BOQbhDSzNc7gLnu8vQezWmxgdafyqHAgaCVc2Z6ZI22fLupUuSYGvl9tsNOOBAQ5XrFdszNOajxrZFg61C5RN5a8SANIqn1%2BTGslO3nRjdExIzOxcZOtY2DSFYrmACr9MvFU\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 29744\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87553,"size_decoded":30600,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-09-08T20:34:17.71605Z","times_seen":1050589,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"assets.mlcdn.com/fonts.css?version=1690293","fqdn":"assets.mlcdn.com","domain":"mlcdn.com","tld":"com"},"ip":{"addr":"172.64.153.218","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.034Z","timestamp":1788892516034,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mlcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 02 Sep 2026 16:30:43 GMT","end":"Tue, 01 Dec 2026 17:30:30 GMT"},"fingerprint":{"sha1":"9F:48:1E:47:AB:39:86:C1:29:E4:96:84:02:C5:5C:F2:67:DA:AC:F5","sha256":"20:A5:7B:00:24:F8:98:A8:75:5F:CB:1E:24:3C:CF:CE:7E:34:62:02:5B:BC:3B:0E:B2:C7:E7:1F:5B:DF:D4:6A"}}},"request":{"raw":"GET /fonts.css?version=1690293 HTTP/1.1\r\nHost: assets.mlcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/css\r\nx-guploader-uploadid: AJjja9aUvbOnvUQaLkC_nGehPgYTYxXp-UjHnxVahtDkcLdSTjE_88ym2RW0X7Ud51NTBXmi\r\nx-goog-generation: 1735900051460116\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 1030\r\nx-goog-meta-x-goog-reserved-source-generation: 1681397793746101\r\nx-goog-hash: crc32c=bgna3Q==, md5=8KDtZ8JaN/tOR9dqJDTX9Q==\r\nx-goog-storage-class: REGIONAL\r\nserver: cloudflare\r\nvia: 1.1 google\r\nexpires: Wed, 16 Sep 2026 18:35:16 GMT\r\ncache-control: public, max-age=691200\r\nlast-modified: Fri, 03 Jan 2025 10:27:31 GMT\r\naccess-control-allow-origin: *\r\nvary: accept-encoding\r\nage: 3433\r\ncf-cache-status: HIT\r\netag: W/\"f0a0ed67c25a37fb4e47d76a2434d7f5\"\r\ncontent-encoding: gzip\r\ncf-ray: a3800d516e7e56a2-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]}],"data":{"size":1030,"size_decoded":1272,"mime_type":"text/css","magic":"ASCII text, with very long lines (1029)","md5":"f0a0ed67c25a37fb4e47d76a2434d7f5","sha1":"f859daac930015816b66ad0a1b4367894c88a9da","sha256":"661df990b4174d442ab319411b1521a5be47d5162eb9cd2428f91ff21f85ffd5","sha512":"152bb2c9b4177fe072b5e74da7dcde564badcf4d36c7215fa7dbd4f186e2bc36eb647ccb0590ea931b5566ef7d40a4759111c2dee826baad91d2f244c779aac8","ssdeep":"","tlshash":"42118ba30cecd1e24f33dc39333fb5b9869b5cbb3a56384868b5f86010b1fa40408188","first_seen":"2023-05-03T02:29:01Z","last_seen":"2026-09-08T18:35:53.980162Z","times_seen":2657,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":5,"connect":1,"send":0,"wait":59,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/css/8499c0a2c73b45139304b4794ceedbf1.css?ver=edbf1","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:15.801Z","timestamp":1788892515801,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/css/8499c0a2c73b45139304b4794ceedbf1.css?ver=edbf1 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-turbo-charged-by: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 08 Sep 2026 18:35:15 GMT\r\ncontent-type: text/css\r\npriority: u=2,i=?0\r\ncf-ray: a3800d4fcf0b32d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"15b39-6aa04c5a-af3be54faf100f37;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:45 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6KzF7HPugrOeN8ztXVyhC9QJ1Kt8HFJRSNB3BN17I5zQiKXIhnacHw%2F1dQChkWn1DNmLOe3qt2n7ZBc9wG4MDZFKgVpb9B1Us2RLUe8HWd%2Fz72nQc8KStAaIijLpy3r8uPeNJ1pZ\"}]}\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":88889,"size_decoded":7859,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"a369db0f895f35bb030fc8ffa5bc88d0","sha1":"3603551b89c939f4624f79ba34ea0ec3699ece33","sha256":"db9c525e98d94034cdf7ace43cf683ed8261ae690f2a20babc0a7af3ebbdcc04","sha512":"ec88e69fb4b027b38c5de7e345e867ec8a8e072ddade6d43db5d7ab8962102dd0aec5b36b54075c224b1097d07c2bd6e7a6c757ba679ff51bce7b6b30879d498","ssdeep":"1536:E7AkFi+4sd67Xl+zNDxy384sd6qKmDwptzwFzNTQlOeq/crsAZ2UbZKPInVuD5ku:ekZUq9w1mBkEh+1RzkDA6tAkPY3H7srY","tlshash":"ae934caa4491119581670b66c7cc9fa84f2ccba724715cef3396394f8b027de23da727","first_seen":"2025-10-05T02:43:29.580578Z","last_seen":"2026-09-08T18:35:53.980741Z","times_seen":19,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/f57148564b177b090686fcffae44ddc3.js?ver=4ddc3","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.048Z","timestamp":1788892516048,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/f57148564b177b090686fcffae44ddc3.js?ver=4ddc3 HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d515f7132d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"2dd-6aa04c5a-5ab8fa5fcfa94861;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wwtWPNrrsdpRp7TXEYAJlg8EHIR3VxiRLaCea8UB8ALvnTRW8Mv3Sj4odQFYMuA05MuIhrdcSJxrNxA1PdfruUGZMK3dNzNEfIb14KCIRqI8tVjbhLvCDclwTnwv1mQj%2BYWrw5BJ\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 410\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":733,"size_decoded":1260,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (479)","md5":"6f73586a858d460d08feddd855aa5e33","sha1":"c558e49d50b3864b4688a085646b43024954d93d","sha256":"249d06f7811fe0b5d9e017458d1422a9179929bbe091cd11ebd292676354272e","sha512":"285825674f7f054eef89b8ba1a7d0dd8420c8e0cbca9603307957d92b24ff83ecf58e9a43c9b75c328c7a4a196e5243db771259e4a13f972e957100cb4565982","ssdeep":"","tlshash":"b401c599229a142253e19d335b7b578b9726e14435f954c9d4a4d4c0bd20c9fb306d7c","first_seen":"2023-03-11T08:29:29Z","last_seen":"2026-09-08T18:35:53.981354Z","times_seen":159,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/litespeed/js/f94d91facbf01e686ff9cfb4651b5e8d.js?ver=b5e8d","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.056Z","timestamp":1788892516056,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/litespeed/js/f94d91facbf01e686ff9cfb4651b5e8d.js?ver=b5e8d HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: text/javascript\r\npriority: u=3,i=?0\r\ncf-ray: a3800d516f8432d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\ncontent-encoding: br\r\netag: \"caf-6aa04c5a-71a5e2d3920015c;br\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 08 Sep 2026 17:56:42 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5vbGZpZ2ZD%2B4oaToa558%2FQV5xi27h4bR7DUKavBFnyXvB6VN2YpaWpWIZWi8t8qSREyzYLdyDtmlVJnBB4z3uDMMdqeQMuUCWCnk0M9T4VvggqIXqpBeIWsdSUrhBxKye7JErM5o\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 873\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":3247,"size_decoded":1724,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (800)","md5":"f4136585ce0023c32d3ce11d02e6374e","sha1":"ea8d3a5ff2d5f7a469424360689a4f816e162c64","sha256":"09b3fc8f464862318879544a6972380cc46d44349eabf89794ab889490f4ca1e","sha512":"2e2391071fd6a666eea8325f8b9d932328ca95dc7d2c0a05a366189e590de2f23acc461483856eefbfead3ffe2d04fe96060e9600534a0c1cea48d909b98fe7c","ssdeep":"","tlshash":"ea61218936ef197853fa06fd26b9a329f6236c02701ac5f4546981242cf8f07367638b","first_seen":"2026-09-08T18:03:26.979663Z","last_seen":"2026-09-08T18:35:53.981949Z","times_seen":2,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/07/logo.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.077Z","timestamp":1788892516077,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/logo.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d518f9632d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"2e8a-6a69c7dd-3d37f9f4ab17c8b5;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Wed, 29 Jul 2026 09:29:01 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NbQpMMcYHkD0lL6BrVcAgnqVDvBwfqpJjEgNjDfyLwxrbUwDjttHh157vnD9ca6EabkX5j8suG2KaxqFqyOjnho6233i0Y2T0Gi5iqJ0bYqhvGw1EaySsUqIkWc5ccTC36AiYf%2B6\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11914\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":11914,"size_decoded":12714,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e57e2eb3802d51d1f437d5f0e6efa85d","sha1":"09ddbdad4134d3c86a76ff5a6c99f28fbf5f2a94","sha256":"0be95fa6695e732709cc74b6ec5ab08bb3d7390677df6345c3e1a161a4556529","sha512":"8af6481b9a6c902e4940f793cf4d333439374cea7f120e174d237880e33ddd57e670e526e78e8f0e458de54fb84f67931c79c55e2d4a18f8f80d06fdc73bdf4a","ssdeep":"192:f2YNMtKwgaQEqeSpdPRCuKeVoPuWM82bLRS28b+69F1y7vxBdZqX8goVp0lkJ:uYNg7gTxCumP+FbtQb+q1ORZp","tlshash":"a332af751e6311bbcd36eb3951e0efe562973c39b707e69d10228f1d4281dc079ad099","first_seen":"2026-09-08T18:03:26.996832Z","last_seen":"2026-09-08T18:35:53.982828Z","times_seen":2,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/uploads/2026/08/slider-6.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.091Z","timestamp":1788892516091,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/uploads/2026/08/slider-6.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=5,i\r\ncf-ray: a3800d519fa732d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"17758-6a70da97-54525c4235bb596d;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Mon, 03 Aug 2026 18:14:47 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZPANNUglyCHz0xZHwpvcGu1YRbnr35vxooKdDWrEh%2BYR0tPrAVPwlfbCJ0mV3rYrv24X0qDFqFNlmExjzj1pUHGX0twOhcCWwezHuH5y8VcaBxp7UgVInV8FWv%2FI9ziCWKai7U8%2B\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 96088\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":96088,"size_decoded":96893,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"09895965128817745bc0df242649a120","sha1":"f3a2c09c3a4512facd9990afcbfd11eb47d19e56","sha256":"dbf227908e3e26034c8a48b53d51011f9bff7809d700286e9df810ae9ad4a982","sha512":"ef922403d52bb27f9fef8d64a257c4066d87121053c154317006137f656ff3d51cdf967b7ec42ba367ea5598b051c3138e4fdc920079765622075eafca2ac693","ssdeep":"1536:zHDOWDaj75jO18NAa/2pLyEaSPGqG0XbPEj5SLR3HFSxdF41mcmztotYIyXbn:rDSxjO18N0WSPGT0rP0CSxwuEY1Xbn","tlshash":"619302482dcd78923baff3f4bc004b6ae4e4d20a8e7f4529a75b65a1470dab0e0d7950","first_seen":"2026-09-08T18:03:27.074013Z","last_seen":"2026-09-08T18:35:53.983773Z","times_seen":2,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.282Z","timestamp":1788892516282,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:04 GMT","end":"Mon, 02 Nov 2026 08:39:03 GMT"},"fingerprint":{"sha1":"2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4","sha256":"C2:29:73:A9:74:8A:FE:F9:5C:F6:79:B3:25:35:02:3F:A2:95:BC:3D:25:96:56:65:A0:CE:CF:89:C9:8F:64:FA"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://esda.mom\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 35156\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 18:27:47 GMT\r\nexpires: Thu, 02 Sep 2027 18:27:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 518849\r\nlast-modified: Mon, 15 Sep 2025 16:30:01 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":35156,"size_decoded":35969,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 35156, version 1.0","md5":"062c1f2aaf2d4de07ad2a2f21c17ffc0","sha1":"3fd1f07343bd33a53cd374f7f107dbdf9effae03","sha256":"d5bab8e28732fe3d10dcef4f77b9c248605bbb2a87d289a2539251ceafab536a","sha512":"7ab522d8bc41128be5a15f2cb91f851f6dc5e437afbb90e6191bbe63d9b94a35911f04701fb2b291362b2ae0f0cc639dec2d15e53928afc5769590a2937e81cf","ssdeep":"768:is48okTArkNSgZJAf5jkRcaUNt8wrNPCbJktQV+n+NUB/wo8IEH:5hNTtNSgZJMjkRBUMwrNPC9NV+n+o81H","tlshash":"22f2e172c3787192ae0985760d60cec8986bb2098f7658b0143fdd38ee45345a3f6e6c","first_seen":"2025-05-29T19:30:52.507782Z","last_seen":"2026-09-08T20:06:38.24593Z","times_seen":25694,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":35,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/wp-content/themes/esda/img/menu/menu-angle.webp","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.295Z","timestamp":1788892516295,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /wp-content/themes/esda/img/menu/menu-angle.webp HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/wp-content/litespeed/css/7b79541c953d1f75f907f6e31ae9bcb6.css?ver=9bcb6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nx-turbo-charged-by: LiteSpeed\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\ncontent-type: image/webp\r\npriority: u=4,i\r\ncf-ray: a3800d52efe732d7-CPH\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 1949\r\ncache-control: public, max-age=31557600\r\netag: \"274-6a5fa108-119276f8aaf3b05a;;;\"\r\nexpires: Thu, 09 Sep 2027 00:02:46 GMT\r\nlast-modified: Tue, 21 Jul 2026 16:40:40 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4iTTt6eS6jT6Woe4JXEcdTBqwpjOUDTuryMIJ7CJeUmi2T4FLqvKk0aiuupTDL5E%2B4XGSGiHHGehqTyOhwuKOUo5V7Rfgrn%2BYoO0vWeUKQ4GbBn7B8oLwC5IpGvaoQq99fDp5P93\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 628\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":628,"size_decoded":1427,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ad6ca754b695ff904778c15f683c21f6","sha1":"8f75d57e69bd60d83db433d968d53af4f60d4326","sha256":"e89c39f36c295b04e4e50c3e72e86495ea2f20d8ba67ce3785cf6a53cd0d4b31","sha512":"ea4bdf97365f4a288c2dcd28c64d507ee9aea459aba802baa75b27f0e4fbaeafbd873a112891dcebc59893e3d1f1d7ef9d4a15a631a42eb846a149e6ed115785","ssdeep":"","tlshash":"fbf00247576b8447c0d8d07aadf75a101600fa9e276c0a81d0475987627ae32957ad81","first_seen":"2026-09-08T18:03:26.969445Z","last_seen":"2026-09-08T18:35:53.984864Z","times_seen":2,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"esda.mom/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"esda.mom","domain":"esda.mom","tld":"mom"},"ip":{"addr":"172.67.151.196","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://esda.mom/","date":"2026-09-08T18:35:16.490Z","timestamp":1788892516490,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esda.mom","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 20:11:18 GMT","end":"Mon, 12 Oct 2026 21:09:48 GMT"},"fingerprint":{"sha1":"7E:98:29:39:B5:F8:5D:60:9D:97:AE:97:D7:4B:05:5C:BC:84:69:96","sha256":"01:94:3E:D7:92:EA:C9:F9:31:16:1F:55:6B:71:1C:E2:3B:E6:C5:EC:F8:74:C4:7D:F5:F6:5B:F7:2F:98:C7:53"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: esda.mom\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://esda.mom/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Thu, 10 Sep 2026 18:35:16 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f%2FZHYALPuuU30y9gas3IIGGisi151RxRJXY8VjrgqCXQfPnMPa%2BtiWrvByNRdqdyWhChj7T20%2Bhfw%2BofSZNpGzrmNqf5uev8ZfhC6kBvF9vuBQmlkRoq1khwQQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ndate: Tue, 08 Sep 2026 18:35:16 GMT\r\nserver: cloudflare\r\ncf-ray: a3800d54183f32d7-CPH\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1286,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-08T20:16:20.746634Z","times_seen":432067,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-08","alert":"Phishing Block","trigger":"esda.mom","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-08","alert":"Sinkholed","trigger":"esda.mom","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}