{"report_id":"95d3d298-d05b-48a7-82cc-15bd7338b098","version":0,"status":"done","tags":[],"date":"2026-10-07T00:41:37Z","url":{"schema":"https","addr":"fortem.click/","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":0,"asn":214351,"as":"Femo It Solutions Limited","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"fortem.click/","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"title":"FNAF Skin Roulette · Fortnitemares 2026","dom":{"size":3466,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"6db289038ef3c31a4799d4c2d22c769f","sha1":"102e6f9c0a2474764489af1b07a1b4943cf324ee","sha256":"df925daaad589b4eba5157f9d50ed1ed29417be4d539b6f7f113ea8972b280d8","sha512":"ec417cb7ac0ae061ce0e2290d3fcd00f225c40d2d53a703290002860ac5a89bc1d043a6616a17f42fa8c3953cbd4b42b67de35ac57c16bf8836dc7a7edbbe860","ssdeep":"","tlshash":"f161749f89e31056662750bc8fefb24c753290076989cd203eac91591f88b6ec4b37dc","dom_hash":"domhashd351413760bb1b04d6128670b9a8a6a2","first_seen":"2026-10-07T00:41:52.417082Z","last_seen":"2026-10-07T00:41:52.417082Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"fortem.click/","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":0,"asn":214351,"as":"Femo It Solutions Limited","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-11T00:41:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"fortem.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fortem.click","ip":{"addr":"62.60.226.148","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-10-07T00:41:38.842977Z","last_seen":"2026-10-07T00:41:38.842977Z","alert_count":5,"request_count":5,"received_data":144026,"sent_data":3562,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.25.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"imgdb.io","ip":{"addr":"138.124.32.82","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Switzerland","country_code":"CH"},"domain_registered":"2026-06-26","domain_rank":0,"first_seen":"2026-07-20T13:15:58.624199Z","last_seen":"2026-10-05T17:32:20.758334Z","alert_count":0,"request_count":5,"received_data":97644,"sent_data":2485,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"imglink.cc","ip":{"addr":"172.67.131.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-03-14","domain_rank":0,"first_seen":"2026-03-24T02:59:31.134075Z","last_seen":"2026-10-03T16:16:02.620489Z","alert_count":0,"request_count":6,"received_data":365807,"sent_data":2976,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"db.onlinewebfonts.com","ip":{"addr":"104.21.2.109","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2015-09-28","domain_rank":91976,"first_seen":"2015-10-20T18:27:41Z","last_seen":"2026-09-30T07:19:03.590296Z","alert_count":0,"request_count":4,"received_data":177496,"sent_data":2120,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"fortem.click/","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"9abb23788991806e8e6ed2d7986e54bf","sha1":"2e611adff7079c84f8bd223a094c1811b69b5b03","sha256":"8680d04c15b17ce2abb7f4d9ae3d75e62c890d76f966b377ea1b8ff2e76a9e09","sha512":"601f4809d2bcb5d61bea7d200bc6dc409c316fbec07616e1740488ff9844fdc51320fe1dabdf5ced88949dd66f5f18d607aa0e95beebe877c3bbdbd1d4a24692","ssdeep":"","tlshash":"ab4101df5cd311625a6720bdcf9fa24830326417688ace203d5c821a6f98b2ec5b67cc","size":2224,"data":"","first_seen":"2026-07-20T13:12:01.400346Z","last_seen":"2026-10-07T00:41:52.46622Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fortem.click/","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"d9ac53a368f232f7cb67bad8a503570a","sha1":"e2f5ad6c1b9f13e6c1d6478028ea797755ec33e7","sha256":"004eeb41c9b76f3a59e68eefe3d332ffa3d539395b78d43f8206f716de4b5c56","sha512":"7a8419f373c7c1150728536894da2783249f765bb0ebd6f633bf3727e1445b65ba26958f879c9e6580423f69733b1ab97412f9562d6761fb77f9b7f070d554ca","ssdeep":"192:iVSNd25V9RzlH2URtiOSErkCZp9J1P701JJEdP91C2DDB47u+miciAT3Dq8ceiPp:5I9hzwyR87SIxroMGiIi3FR5xZnIbIZ","tlshash":"ec92b7a9e9b31079446391ff976f61d4e7364017f902f9507a2c8a442fc883982fe6ed","size":19865,"data":"","first_seen":"2026-10-07T00:41:52.467543Z","last_seen":"2026-10-07T00:41:52.467543Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fortem.click/jhnjofcjihfdnggg.js","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"2178c6dfb19ede213be22fd83e3e701a","sha1":"ea551c68c3e4fc51462b3538646860134dbf1493","sha256":"5a63dbeed14b915e1414a1837294c7ed5ec9568cb1386b8fa3f9a28f71d5e424","sha512":"2283342585dffcfe389f90392629d5e2229398827fa1f54e9bd431b7d4251ec9e4a66067dfe596bb38a4b54f856c86d477d121e0b1483e8aa5c3021929f47f62","ssdeep":"768:eMmZ0oqieNdVbhjGgw1pBVUqvzQ6gcuL1xHpgIVRjvk6miverhXjsFGawXGzh3Rt:eIHjGgw1pBT732hCaO+2fpNGLX1Qkdx7","tlshash":"ba63878977c168d113076bbb3a3f71d5e82d0cdd7a40488fe128f898f9a5316e6e5a31","size":67856,"data":"","first_seen":"2026-10-07T00:41:52.460333Z","last_seen":"2026-10-07T00:41:52.460333Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fortem.click/log","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:58.191Z","timestamp":1791333658191,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortem.click","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 03 Oct 2026 18:50:31 GMT","end":"Fri, 01 Jan 2027 18:50:30 GMT"},"fingerprint":{"sha1":"A0:23:08:67:BD:5E:95:D5:38:15:36:C1:3C:A3:E0:6C:FA:2C:13:79","sha256":"55:52:03:4C:37:52:DB:9D:AA:F3:74:16:DF:68:27:B8:48:E2:A5:FC:7E:16:C5:86:3C:19:CC:D5:D8:38:72:44"}}},"request":{"raw":"POST /log HTTP/1.1\r\nHost: fortem.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nReferer: https://fortem.click/\r\nContent-Length: 513\r\nOrigin: https://fortem.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":[{"name":"session","value":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4"}],"method":"POST","post_data":{"size":513,"data":"{\"action\":\"visited\",\"salt\":{\"timestamp\":1791333658145,\"iv\":\"105e4ec96ea238e7c950549b62f918a1\",\"data\":\"dc0c32c8f3c2270c1ac4262ae4c4d094583f5d4077854ec02674e8eb41bd85de336f96a042a213b014d0400e7c4ca148dcbd9408dc8c29982a27437e1b4c049d29406411bb3be6fda73c234153bd446ac5aa59c463521d928157e5a2fbf1f75e87587547b13ea91becd586533a6bad42502e3a9e08818c325227f091938be0a0c9c0de11375348c30e25b8e497a6b5314835ba26c96a51f704c15970025d21a00f4fdfade7d337793589fe4c7c88dce3999e50d2158eaa23bc5193657425b1e51097a9f59c7f16a59b3cece8\"}}"}},"response":{"raw":"HTTP/2 204 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store\r\ndate: Wed, 07 Oct 2026 00:40:58 GMT\r\nserver: nginx/1.25.5\r\nvia: 1.1 Caddy\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.25.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":1442,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-15T05:37:40.491416Z","times_seen":19114689,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"fortem.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgdb.io/i/g8uCinU.png","fqdn":"imgdb.io","domain":"imgdb.io","tld":"io"},"ip":{"addr":"138.124.32.82","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.011Z","timestamp":1791333643011,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imgdb.io","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 11:08:16 GMT","end":"Mon, 23 Nov 2026 11:08:15 GMT"},"fingerprint":{"sha1":"2D:58:87:D2:47:0F:DD:36:97:6E:8B:C8:31:A3:FF:4B:69:ED:63:83","sha256":"8A:50:C6:BB:0C:A9:83:0F:DE:C3:10:27:68:04:5F:63:E4:30:36:BD:3C:00:6C:E8:A6:64:CA:06:F6:F6:1B:56"}}},"request":{"raw":"GET /i/g8uCinU.png HTTP/1.1\r\nHost: imgdb.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-security-policy: default-src 'none'; sandbox\r\ncontent-type: image/png\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\netag: \"df0-0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 3568\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3568,"size_decoded":4108,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"4ac2c6ebeb83cbf1aec82b7248952766","sha1":"0d2fd92e2aeed1f820ccb3946f767bfbe3fb0578","sha256":"a5135fbd7e345dcbe24cb041ca60fabc7058ec374cb8e165d65d7be792eae7d8","sha512":"f01ddf07cc5d0112e1003b8c10baa06ca55a078c7ee789ec0d9952d997184fbb89693ba98429886b4791c82b087f6f33c1207d4dd28787db7238d557578f9f6e","ssdeep":"","tlshash":"a4717d0852498fb70f6f4b90614b1e233c390ae2489bff360274c3a515b15d24665474","first_seen":"2026-10-07T00:41:52.422379Z","last_seen":"2026-10-07T00:41:52.422379Z","times_seen":1,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":-1,"dns":53,"connect":21,"send":0,"wait":68,"receive":1,"ssl":274},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imglink.cc/cdn/f0lYBQZoFi.jpg","fqdn":"imglink.cc","domain":"imglink.cc","tld":"cc"},"ip":{"addr":"172.67.131.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.013Z","timestamp":1791333643013,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imglink.cc","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 02:39:58 GMT","end":"Sun, 06 Dec 2026 02:39:57 GMT"},"fingerprint":{"sha1":"36:27:9B:E0:8E:EE:FC:51:9F:4D:6C:74:C0:51:22:B3:1A:02:7B:BF","sha256":"87:AA:F0:65:E7:60:61:6A:17:C3:D3:73:DF:A1:E1:83:08:C5:08:4E:0D:32:8B:79:EB:AD:58:03:2E:CA:08:3E"}}},"request":{"raw":"GET /cdn/f0lYBQZoFi.jpg HTTP/1.1\r\nHost: imglink.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8lUEX7L2TSBdkAuUpr%2F%2B6FoCPrFYtSOSupSqvhj2RnKsPHbX1vnk2pfV%2BW0WKiFhCA5vA4w4l9HZ6YHuWPhR64H0NyXCtvuWptInnDf9piMsadJELdnR3oWfRNG3\"}]}\r\ncf-ray: a468db24d91d56ca-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18920\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18920,"size_decoded":19801,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 210x260, components 3","md5":"4b2511aca0fe8c35b30ab0ae3f39efd1","sha1":"1e39fa5988847f91bc099fd026fd9709607b66a3","sha256":"b6779fb5ba11938025fd95c30d669a11698ef31f8cdcd0116a6b82b939334a09","sha512":"256a7412b51ef0882d746e423293202b43a5272877be028579fce3c9bd7efb3f280a5e37a58fbfef844ee167dae7bedcc21a652f124bca352a873d8559e72151","ssdeep":"384:NdzK4ncizvulsTWZzIWtyyUPr4soiZu3R0iygFE1yObMqdglTDGBsN/BIPrqKt3n:bm4n/zspd7y4sJ4x2dbTdwasN/uqK5DL","tlshash":"a282d006332b39bbc436e0f9675ed624dba68412fd59464d63c091a53709d342f508d7","first_seen":"2026-10-07T00:41:52.424507Z","last_seen":"2026-10-07T00:41:52.424507Z","times_seen":1,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgdb.io/i/Bkxp0kI.jpg","fqdn":"imgdb.io","domain":"imgdb.io","tld":"io"},"ip":{"addr":"138.124.32.82","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.014Z","timestamp":1791333643014,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imgdb.io","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 11:08:16 GMT","end":"Mon, 23 Nov 2026 11:08:15 GMT"},"fingerprint":{"sha1":"2D:58:87:D2:47:0F:DD:36:97:6E:8B:C8:31:A3:FF:4B:69:ED:63:83","sha256":"8A:50:C6:BB:0C:A9:83:0F:DE:C3:10:27:68:04:5F:63:E4:30:36:BD:3C:00:6C:E8:A6:64:CA:06:F6:F6:1B:56"}}},"request":{"raw":"GET /i/Bkxp0kI.jpg HTTP/1.1\r\nHost: imgdb.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-security-policy: default-src 'none'; sandbox\r\ncontent-type: image/jpeg\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\netag: \"7619-0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 30233\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30233,"size_decoded":30776,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 1024x1024, components 3","md5":"383ba21c4fae53bd7ba422799f07edfa","sha1":"518cce8ca0d3062a926e281a38d91ff03b13a595","sha256":"9df13fdd044c640ba88ff1b86fc497001f3a6fb8a8205d542765d62ae63572ba","sha512":"5c3d34f5233bbc85c5b542e0eb650bf55402b5eab09ce273320174fddd604a8349b0610d19246401d07c56103a3f0e19ff7bc153e67de4f00b0262d34d8b6c08","ssdeep":"768:JDX93+rnz+xhKVGpGJpd6gFIZuuUlUPnEsImNvfY1vYTnSiOOSVnK9:F9qnz+byxpFFIelUtIifYFYui7Spa","tlshash":"7dd2e184d9c3fd03c4270ffb61e6a5c5c9e928d0c294d3ea47985a854b7cc8e9d8c26a","first_seen":"2026-10-07T00:41:52.426511Z","last_seen":"2026-10-07T00:41:52.426511Z","times_seen":1,"resource_available":false,"data":null}},"time_used":419,"timings":{"blocked":-1,"dns":51,"connect":21,"send":0,"wait":59,"receive":10,"ssl":275},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fortem.click/","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-07T00:40:42.213Z","timestamp":1791333642213,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortem.click","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 03 Oct 2026 18:50:31 GMT","end":"Fri, 01 Jan 2027 18:50:30 GMT"},"fingerprint":{"sha1":"A0:23:08:67:BD:5E:95:D5:38:15:36:C1:3C:A3:E0:6C:FA:2C:13:79","sha256":"55:52:03:4C:37:52:DB:9D:AA:F3:74:16:DF:68:27:B8:48:E2:A5:FC:7E:16:C5:86:3C:19:CC:D5:D8:38:72:44"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: fortem.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store, no-store\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 07 Oct 2026 00:40:42 GMT\r\nserver: nginx/1.25.5\r\nset-cookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4; Path=/; Domain=fortem.click; Max-Age=604800; HttpOnly; Secure; SameSite=Lax\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"session","value":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4","quoted":false,"path":"/","domain":"fortem.click","max_age":604800,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4; Path=/; Domain=fortem.click; Max-Age=604800; HttpOnly; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.25.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3317,"size_decoded":1934,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"df69775e0fb115f2b344f28deb90d52f","sha1":"c5c22498123b00112ca9a1e6d7880939d0774a6a","sha256":"786b0fcae27199f849654588a16762ab1c5f65a8deda98e0e9b3b13488580050","sha512":"ee17aa87ec3134f712c075317857153189a17665ac61a4ffce07f85700059aa043eb590caab3ab33b7be974901beb69f24b7f3b5c0ae78efc9483e478840fedb","ssdeep":"","tlshash":"c06162df88e310566a2750bc4fefb20c35329007698add243e6c92595fc8b6e85b77d8","first_seen":"2026-10-07T00:41:52.430588Z","last_seen":"2026-10-07T00:41:52.430588Z","times_seen":1,"resource_available":true,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":20,"connect":29,"send":0,"wait":49,"receive":0,"ssl":71},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"fortem.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fortem.click/iframe","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:42.657Z","timestamp":1791333642657,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortem.click","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 03 Oct 2026 18:50:31 GMT","end":"Fri, 01 Jan 2027 18:50:30 GMT"},"fingerprint":{"sha1":"A0:23:08:67:BD:5E:95:D5:38:15:36:C1:3C:A3:E0:6C:FA:2C:13:79","sha256":"55:52:03:4C:37:52:DB:9D:AA:F3:74:16:DF:68:27:B8:48:E2:A5:FC:7E:16:C5:86:3C:19:CC:D5:D8:38:72:44"}}},"request":{"raw":"POST /iframe HTTP/1.1\r\nHost: fortem.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html, application/json\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://fortem.click/\r\nContent-Type: application/json\r\nContent-Length: 15\r\nOrigin: https://fortem.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"session","value":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4"}],"method":"POST","post_data":{"size":15,"data":"{\"referrer\":\"\"}"}},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store, no-store\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 07 Oct 2026 00:40:42 GMT\r\nserver: nginx/1.25.5\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.25.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71335,"size_decoded":20317,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (19806)","md5":"999988ac72f43e42cbf23ae25689fdec","sha1":"6c4104346213439f377df4ebbaf36436ea82e3a3","sha256":"04a393112f0960d1fe5d27ba2ac5a0122dc56512be1c543a9bd90cc3b9180388","sha512":"15e685555184fadba694e19229a25c117c08142cad99aa188c4ec881b6d1e5028d33cbde6c00dfd279272a4853d7e904201563f030956887cce835fc4de06065","ssdeep":"1536:J2teffTZZ4lWTwlo2Heexe6eGeRed9iIi3NnV3e:YteVClCCo2ViP9n5e","tlshash":"fb63b56217e201dc6c96b7c4b22b12e06ea4d917f485ece0b69e5804cfbbfe4535f648","first_seen":"2026-10-07T00:41:52.43456Z","last_seen":"2026-10-07T00:41:52.43456Z","times_seen":1,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"fortem.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imglink.cc/cdn/1N8BaMFcWT.jpg","fqdn":"imglink.cc","domain":"imglink.cc","tld":"cc"},"ip":{"addr":"172.67.131.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:42.994Z","timestamp":1791333642994,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imglink.cc","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 02:39:58 GMT","end":"Sun, 06 Dec 2026 02:39:57 GMT"},"fingerprint":{"sha1":"36:27:9B:E0:8E:EE:FC:51:9F:4D:6C:74:C0:51:22:B3:1A:02:7B:BF","sha256":"87:AA:F0:65:E7:60:61:6A:17:C3:D3:73:DF:A1:E1:83:08:C5:08:4E:0D:32:8B:79:EB:AD:58:03:2E:CA:08:3E"}}},"request":{"raw":"GET /cdn/1N8BaMFcWT.jpg HTTP/1.1\r\nHost: imglink.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nGl7LZrrPdwoKXpaHqk6lVS8ih5SshOW96ZEEePzhTf0BoNwsHyKKfcPJT9frKwZiutXrvzC0MS5ltIxoEyFVt8hYw2sAoFoAsKdqj2nV0YI%2FswPaBq6w1AHMbLl\"}]}\r\ncf-ray: a468db24d91b56ca-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 269091\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":269091,"size_decoded":269969,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 1920x1080, components 3","md5":"b4a90523f6c2ace5c94c22166b89ff2e","sha1":"294ddf4d6eaeb8cbcd2033dc3a133d518fb13224","sha256":"8cacbeb5396d6453ae6a9325dc4727ae91f822323f474c29616df78f34f5986a","sha512":"643eb1d41e7e809e193916f53b6bc1474dc1f656219b191ba9105e9fa8f4910861d060b71cdb07033fe280fd82a79dce8539ee5857867af0e5ca489bacf6b219","ssdeep":"6144:/xTi79aWpH0/OgWe7hgnuKJJasgOVZQlwsIsLGJ5IN9:k9aWVDVasgOVZQSOaJ5IN9","tlshash":"b9442254b50c64f5cf79da7e2e2b3e81e7a454466bca81e2ec561ccc0a48d013f16af2","first_seen":"2026-10-07T00:41:52.4385Z","last_seen":"2026-10-07T00:41:52.4385Z","times_seen":1,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":137,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"db.onlinewebfonts.com/t/8f2a9d487bbbc60974cd132fc3a63862.woff2","fqdn":"db.onlinewebfonts.com","domain":"onlinewebfonts.com","tld":"com"},"ip":{"addr":"104.21.2.109","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:42.995Z","timestamp":1791333642995,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlinewebfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 06:53:21 GMT","end":"Fri, 13 Nov 2026 07:53:16 GMT"},"fingerprint":{"sha1":"98:D5:8C:9A:BF:E8:8F:AD:4C:0B:41:95:75:45:16:7C:2F:72:A6:3B","sha256":"1E:68:17:75:38:EA:CF:DE:88:E3:90:43:D9:45:3C:12:1E:EF:3F:DA:EF:7A:60:8F:ED:4A:C3:B4:E4:EE:5D:2D"}}},"request":{"raw":"GET /t/8f2a9d487bbbc60974cd132fc3a63862.woff2 HTTP/1.1\r\nHost: db.onlinewebfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fortem.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: application/x-font-woff\r\nserver-timing: cfExtPri\r\ncache-control: public, max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ESCuQmiTciPbwf9wSPcIVBFN8UCb%2B4yU65NhpaQ1tc03zqA2v546EBRrdDGcsLttsZNG1hAsHJ9Bl5%2FpBvD98dzBNZcasGdHuKG4S6ZAMEKKB4aUjFt%2FH8LVhotScQuK5MrEbu5ekjI%3D\"}]}\r\ncf-ray: a468db24db478be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 30752\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30752,"size_decoded":31599,"mime_type":"application/x-font-woff","magic":"Web Open Font Format (Version 2), TrueType, length 30752, version 1.0","md5":"fbdc0e848711cc57fddfa79769bc0f21","sha1":"2c593cacdd707857359fc0c4fa6f0b23ac5a213e","sha256":"70369a350dabd4e4e04f5f51a01104cba1fafdd2e624c4b53874d9cb585fb801","sha512":"607ac605432af8e4e947c807279a611ec8a9ea1176f8e972f6b2cdf19c523a1ed950141b5fef1ff67da464debc9b7fd8982a3756ebb3c23ec950b28259a5b689","ssdeep":"768:0mj9htAVXN5WbPjbPQg4LH/pioaNmKwujzzRA+HfQdKhzn8w:KtOPjbPQl7pioI3wuzzRDH6Nw","tlshash":"20d2e1f86e3c2bbc42616b46585d670f761047b7da437087ee34996400979d68ca07ab","first_seen":"2024-08-19T21:12:12.635089Z","last_seen":"2026-10-08T10:23:32.712584Z","times_seen":50,"resource_available":false,"data":null}},"time_used":732,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":715,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"db.onlinewebfonts.com/t/cdc8c3de1e6bd5a9a67c6a001f9fedd0.woff2","fqdn":"db.onlinewebfonts.com","domain":"onlinewebfonts.com","tld":"com"},"ip":{"addr":"104.21.2.109","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:42.998Z","timestamp":1791333642998,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlinewebfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 06:53:21 GMT","end":"Fri, 13 Nov 2026 07:53:16 GMT"},"fingerprint":{"sha1":"98:D5:8C:9A:BF:E8:8F:AD:4C:0B:41:95:75:45:16:7C:2F:72:A6:3B","sha256":"1E:68:17:75:38:EA:CF:DE:88:E3:90:43:D9:45:3C:12:1E:EF:3F:DA:EF:7A:60:8F:ED:4A:C3:B4:E4:EE:5D:2D"}}},"request":{"raw":"GET /t/cdc8c3de1e6bd5a9a67c6a001f9fedd0.woff2 HTTP/1.1\r\nHost: db.onlinewebfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fortem.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: application/x-font-woff\r\nserver-timing: cfExtPri\r\ncache-control: public, max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BrLbOKcrrUmuIgJSZtJLCWi7x%2BZsxCnP3Di%2FVSnnSrFdP6Z4NUqGOCPzwRPVy8IVBS7V%2FNbKuvAA2YYawC1NZfKIC2qxfizhGj%2FftpgKAzRbEUgrZpWvictjGWqQ9k2pB11exoBtaMU%3D\"}]}\r\ncf-ray: a468db24db488be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 40884\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40884,"size_decoded":41735,"mime_type":"application/x-font-woff","magic":"Web Open Font Format (Version 2), CFF, length 40884, version 1.0","md5":"f8e0f4a89ff8eb8d3cf04d23283c2e9f","sha1":"6ec108910a0975c5daa0083eefd45b3b04e75872","sha256":"d79f488108271f1c9b5002d1aa3404a1593c6f25aa0e82ed725394671b403511","sha512":"c4b6326a09aa4b67633d12fad73911e452d86bc25492d5591b9f03a22818299f8c30ba2b87cdda73065b9807f4ab6a02264a5e8fbd12eb3ca2fdaeaf10b1972c","ssdeep":"768:/yJAbdSnUlpGhcbMRjdQrTgkBovNueEo4fjGA7mOXgFV7uH3ojG2e6tYm:/kg4Uscb24TfBev1MSr7uHB2eAYm","tlshash":"bf03f16b83426703c8b9f690bd78144bf3bc90a5ead613ed5909907c993e495718ca3b","first_seen":"2026-07-31T12:22:06.948327Z","last_seen":"2026-10-07T00:41:52.445634Z","times_seen":8,"resource_available":false,"data":null}},"time_used":868,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":695,"receive":168,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgdb.io/i/3_aLtUQ.jpg","fqdn":"imgdb.io","domain":"imgdb.io","tld":"io"},"ip":{"addr":"138.124.32.82","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:42.987Z","timestamp":1791333642987,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imgdb.io","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 11:08:16 GMT","end":"Mon, 23 Nov 2026 11:08:15 GMT"},"fingerprint":{"sha1":"2D:58:87:D2:47:0F:DD:36:97:6E:8B:C8:31:A3:FF:4B:69:ED:63:83","sha256":"8A:50:C6:BB:0C:A9:83:0F:DE:C3:10:27:68:04:5F:63:E4:30:36:BD:3C:00:6C:E8:A6:64:CA:06:F6:F6:1B:56"}}},"request":{"raw":"GET /i/3_aLtUQ.jpg HTTP/1.1\r\nHost: imgdb.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-security-policy: default-src 'none'; sandbox\r\ncontent-type: image/jpeg\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\netag: \"86c-0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 2156\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2156,"size_decoded":2697,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 400x400, components 3","md5":"0a0e2edf1b474e1cf3dfdcf6661146fc","sha1":"447c29bd521e9df99153fb4aae204f63c3be5568","sha256":"7491a37e5483b12e68a963163402d2fabb51131dd35e3900621bbecd518d024c","sha512":"5f5bc7bcaddb681672cb0da6d949d492cf18fe642729e99db512956393e7ee718420cd8a775cef5dce437d093decc298700524cc1e7024c62324d65923be6690","ssdeep":"","tlshash":"8c413e2153779e71fb17d1b1c47d95712d5139ac7a1a117f307dac89b67b8c44440b28","first_seen":"2026-10-07T00:41:52.44714Z","last_seen":"2026-10-07T00:41:52.44714Z","times_seen":1,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":-1,"dns":78,"connect":20,"send":0,"wait":23,"receive":0,"ssl":52},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"db.onlinewebfonts.com/t/757ff6da05e4f945c71c9751b485a9ad.woff2","fqdn":"db.onlinewebfonts.com","domain":"onlinewebfonts.com","tld":"com"},"ip":{"addr":"104.21.2.109","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.002Z","timestamp":1791333643002,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlinewebfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 06:53:21 GMT","end":"Fri, 13 Nov 2026 07:53:16 GMT"},"fingerprint":{"sha1":"98:D5:8C:9A:BF:E8:8F:AD:4C:0B:41:95:75:45:16:7C:2F:72:A6:3B","sha256":"1E:68:17:75:38:EA:CF:DE:88:E3:90:43:D9:45:3C:12:1E:EF:3F:DA:EF:7A:60:8F:ED:4A:C3:B4:E4:EE:5D:2D"}}},"request":{"raw":"GET /t/757ff6da05e4f945c71c9751b485a9ad.woff2 HTTP/1.1\r\nHost: db.onlinewebfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fortem.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: application/x-font-woff\r\nserver-timing: cfExtPri\r\ncache-control: public, max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P2SB7xtegzMK%2BVljg7pwvmBQS0lSaQd%2Fm2bgbOrDe3KkMtqEes7IupCY6szTKP%2B1%2BWQgr84vUWKGPZt8q2gYadBH1%2FDZROS9%2B5zlQypMW7OXGWlQ9D9VSBPoR7PLNPPS1wPa8g16zRI%3D\"}]}\r\ncf-ray: a468db24db498be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31972\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31972,"size_decoded":32825,"mime_type":"application/x-font-woff","magic":"Web Open Font Format (Version 2), TrueType, length 31972, version 1.0","md5":"95220de056c698775600ebda990c8e81","sha1":"b438971e787645953de0005648920bf82be5c295","sha256":"40cd7c62b920b14067e8d190301b9473c6ea6eb2cf5290bc2d8d9529e83420c6","sha512":"13307697840b504d7ab39fff8f44aa1885eac968c4c0225f0c7766a83d7a3d26368f350f60db14f07a0c52062fd378587cec3c044c4130b0dd8fe6801b0e3f70","ssdeep":"768:lv8tkNzwNrAmcmHlbEHZURU0LFS/kmnsFiHeWUwal:lKGzwNrAmHW5AENsoHeWUwal","tlshash":"74e2f28219514e90e5c106ba15edfe001ac9c1b2c45fa8e7dc764df87de28f8f487d26","first_seen":"2025-10-14T15:25:50.047075Z","last_seen":"2026-10-08T10:23:32.670086Z","times_seen":49,"resource_available":false,"data":null}},"time_used":719,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":714,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imglink.cc/cdn/4L4vQEH_UC.jpg","fqdn":"imglink.cc","domain":"imglink.cc","tld":"cc"},"ip":{"addr":"172.67.131.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.016Z","timestamp":1791333643016,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imglink.cc","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 02:39:58 GMT","end":"Sun, 06 Dec 2026 02:39:57 GMT"},"fingerprint":{"sha1":"36:27:9B:E0:8E:EE:FC:51:9F:4D:6C:74:C0:51:22:B3:1A:02:7B:BF","sha256":"87:AA:F0:65:E7:60:61:6A:17:C3:D3:73:DF:A1:E1:83:08:C5:08:4E:0D:32:8B:79:EB:AD:58:03:2E:CA:08:3E"}}},"request":{"raw":"GET /cdn/4L4vQEH_UC.jpg HTTP/1.1\r\nHost: imglink.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=feLwVpSxe%2FQsJNqM0dFgE2jBWoaus9Xf2ybqg5MyyKG%2FR%2Bz8qRA1meBtfHO2%2B%2FBXQ0lUDrdWH37JsF81HvZtmdITRJRW3%2BfvfKU3iTVpHgZR7Hzf5j%2BSf4R778kS\"}]}\r\ncf-ray: a468db24d91e56ca-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 16817\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16817,"size_decoded":17706,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 210x260, components 3","md5":"5cdbbb44e4cb2ca5abfdca0dbd2cc5f8","sha1":"b7b5da2b5907abf0604e9f119811f93e7aec2973","sha256":"34ee1ea0e54aedf0c9398c5cc0e40751edd55012234c887e9f3373fd53d16830","sha512":"2b2e39638ef1c19e5e3ecdc4fcdb9e82768247ed14e02a621a4ace0387cb9bf608ac773bf9b3b4ff7eb8a583bb9b90c8250a51d2ab47b4d07a84895ad29a2618","ssdeep":"384:NdzL9z1PKo3T4l7FD44WlijHG8WbHR26d82ChCtkwFGCUr8O:bP9BPK+4l7F6lCm8WbHRDi2rG8O","tlshash":"1c72e1a22903724ad52de33d09226730ef3c1de755bb5bcf9266c205091ee1887f546d","first_seen":"2026-10-07T00:41:52.450008Z","last_seen":"2026-10-07T00:41:52.450008Z","times_seen":1,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imglink.cc/cdn/sO5BwZQpyE.jpg","fqdn":"imglink.cc","domain":"imglink.cc","tld":"cc"},"ip":{"addr":"172.67.131.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.018Z","timestamp":1791333643018,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imglink.cc","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 02:39:58 GMT","end":"Sun, 06 Dec 2026 02:39:57 GMT"},"fingerprint":{"sha1":"36:27:9B:E0:8E:EE:FC:51:9F:4D:6C:74:C0:51:22:B3:1A:02:7B:BF","sha256":"87:AA:F0:65:E7:60:61:6A:17:C3:D3:73:DF:A1:E1:83:08:C5:08:4E:0D:32:8B:79:EB:AD:58:03:2E:CA:08:3E"}}},"request":{"raw":"GET /cdn/sO5BwZQpyE.jpg HTTP/1.1\r\nHost: imglink.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t8w54pyRIn5wjkoalrveIYJoq%2FzsOW5COqNKjNC%2BwLRtSZnwWDkdPwNSiKvTYrPr4B1zcXkAPHzDm0lCZkhJD%2FpZKatefsZggB43u5fWrqLzR1r5nlhOZtOgbxlR\"}]}\r\ncf-ray: a468db24d92056ca-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 16075\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16075,"size_decoded":16956,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 210x260, components 3","md5":"443cd6548b6c9dee716287cc7ef5b659","sha1":"b2b142cfc80376a3ba11c6fa88bd5217107c127d","sha256":"2f27b5758675889be3ea505ceea6cc19b723ac938e7890a48ba931cd3893a733","sha512":"e3e0f8ead5e948c66f13e62aa98591a05126987cf69cf476c0a1a3d7b2aebe4c3b019063fbe9e08ef2950bc1d6ebc9a6a334c14d6d287815506abd5f59c09a03","ssdeep":"384:NdzGuukGbRsGkQTsGcDIThv8RbpCMSSdkOX:bquukGbyGkysGcUThkiFSN","tlshash":"8b72c0d3333bdf69c3b1dc398855e3c04e451906579cd5bd950a69362a529c13ecb42e","first_seen":"2026-10-07T00:41:52.455957Z","last_seen":"2026-10-07T00:41:52.455957Z","times_seen":1,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":136,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imglink.cc/cdn/2gxvxJ4VRt.jpg","fqdn":"imglink.cc","domain":"imglink.cc","tld":"cc"},"ip":{"addr":"172.67.131.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.008Z","timestamp":1791333643008,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imglink.cc","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 02:39:58 GMT","end":"Sun, 06 Dec 2026 02:39:57 GMT"},"fingerprint":{"sha1":"36:27:9B:E0:8E:EE:FC:51:9F:4D:6C:74:C0:51:22:B3:1A:02:7B:BF","sha256":"87:AA:F0:65:E7:60:61:6A:17:C3:D3:73:DF:A1:E1:83:08:C5:08:4E:0D:32:8B:79:EB:AD:58:03:2E:CA:08:3E"}}},"request":{"raw":"GET /cdn/2gxvxJ4VRt.jpg HTTP/1.1\r\nHost: imglink.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BJVqC%2FD%2FQA0ynjJM8umrWTsXaoUjPR5jGO2%2BxJmUK4%2BAyyNLKewmzFi6woawgCuy%2FJRwmHYf4XWmhDLjHEfWG4OzT7HoybQLIa0Deo4cBk67RjDbLr7DmV431YDZ\"}]}\r\ncf-ray: a468db24d91c56ca-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24301\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24301,"size_decoded":25186,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 512x512, components 3","md5":"a19c432208d9c23cfc61015ef0470477","sha1":"ac78aba63e74bee00e4fa07d9aadcf648fb351a6","sha256":"67506a32fc035a0af78ed0fc5431f568d1de479260b51dad65f3c6a2196fd22e","sha512":"7311d5a023d2a5deb7b916157a10820e082bc7d650e442571fb025f2e72347433becf49456c7d50d3f2abfc324b432505ad1c4fd6bda2fc9ee2ae883fcdc9fb1","ssdeep":"384:NozUCdUpW7fsrwGZeZsJYpvCpaiogcJU8z9tAP/0V/CuD1VzAXgfnbpw:ygu7fscx1RCILg5x0V/Cu8XgfnVw","tlshash":"b0b2d059324b62e4c4d7d73c73610fbaae9a9982d381740e23fd1790b24a9f1990f68c","first_seen":"2026-10-07T00:41:52.457301Z","last_seen":"2026-10-07T00:41:52.457301Z","times_seen":1,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":130,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"db.onlinewebfonts.com/t/0d5d3d182dbfde945fbcfaf964c9fa96.woff2","fqdn":"db.onlinewebfonts.com","domain":"onlinewebfonts.com","tld":"com"},"ip":{"addr":"104.21.2.109","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.000Z","timestamp":1791333643000,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlinewebfonts.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Aug 2026 06:53:21 GMT","end":"Fri, 13 Nov 2026 07:53:16 GMT"},"fingerprint":{"sha1":"98:D5:8C:9A:BF:E8:8F:AD:4C:0B:41:95:75:45:16:7C:2F:72:A6:3B","sha256":"1E:68:17:75:38:EA:CF:DE:88:E3:90:43:D9:45:3C:12:1E:EF:3F:DA:EF:7A:60:8F:ED:4A:C3:B4:E4:EE:5D:2D"}}},"request":{"raw":"GET /t/0d5d3d182dbfde945fbcfaf964c9fa96.woff2 HTTP/1.1\r\nHost: db.onlinewebfonts.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://fortem.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: application/x-font-woff\r\nserver-timing: cfExtPri\r\ncache-control: public, max-age=31536000, must-revalidate\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: X-Requested-With\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DOnSfNByIzwVfo2H%2FY7fRIcuXFpl15inI6YcafMoLb1fdRxW%2FU8RzoT7dbwUXzpoqNmRUO6Pq1rRptn4mqkUweMCPCz6jKN%2Bqgxh9%2FsKvfFmVlaOD58MU%2FOUIF9hlcVhPMz7Jn%2FT4pc%3D\"}]}\r\ncf-ray: a468db24db468be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 70484\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":70484,"size_decoded":71337,"mime_type":"application/x-font-woff","magic":"Web Open Font Format (Version 2), CFF, length 70484, version 1.0","md5":"b82eaa551d29228bc44bfeb3a8603f76","sha1":"ab4954a02223e06b467c01da7f24e3f52dec79d7","sha256":"d46c7608202b395d513e3413859a06522f6dd4fbe2acfffb5a2c35410d692ea6","sha512":"cf9d8d5e7fc170fd3b83ce9ba838c46a52d5ab49a7f985d9d05299e4d6f1d5e9a1037974fd0ac6a7e991965d9a11cdc6ec788d51f6bb10ce371a4574fadd80ec","ssdeep":"1536:m+uCPwvNxq9UharOKc5X/ucfkonQJxU2/MOTyNjdP/6VprSjB1mbCV:P2Nxq9FLcduxIQJKOWNZP/6VpG0S","tlshash":"b4630221dc1196a0adc14a236db5dbf2ab4e90579ed95848c268c2bf373f43d68c23d2","first_seen":"2026-10-07T00:41:52.459168Z","last_seen":"2026-10-07T00:41:52.459168Z","times_seen":1,"resource_available":false,"data":null}},"time_used":883,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":704,"receive":174,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fortem.click/jhnjofcjihfdnggg.js","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.003Z","timestamp":1791333643003,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortem.click","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 03 Oct 2026 18:50:31 GMT","end":"Fri, 01 Jan 2027 18:50:30 GMT"},"fingerprint":{"sha1":"A0:23:08:67:BD:5E:95:D5:38:15:36:C1:3C:A3:E0:6C:FA:2C:13:79","sha256":"55:52:03:4C:37:52:DB:9D:AA:F3:74:16:DF:68:27:B8:48:E2:A5:FC:7E:16:C5:86:3C:19:CC:D5:D8:38:72:44"}}},"request":{"raw":"GET /jhnjofcjihfdnggg.js HTTP/1.1\r\nHost: fortem.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nCookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"session","value":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4"}],"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store, no-store\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\nserver: nginx/1.25.5\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.25.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":67856,"size_decoded":24289,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"2178c6dfb19ede213be22fd83e3e701a","sha1":"ea551c68c3e4fc51462b3538646860134dbf1493","sha256":"5a63dbeed14b915e1414a1837294c7ed5ec9568cb1386b8fa3f9a28f71d5e424","sha512":"2283342585dffcfe389f90392629d5e2229398827fa1f54e9bd431b7d4251ec9e4a66067dfe596bb38a4b54f856c86d477d121e0b1483e8aa5c3021929f47f62","ssdeep":"768:eMmZ0oqieNdVbhjGgw1pBVUqvzQ6gcuL1xHpgIVRjvk6miverhXjsFGawXGzh3Rt:eIHjGgw1pBT732hCaO+2fpNGLX1Qkdx7","tlshash":"ba63878977c168d113076bbb3a3f71d5e82d0cdd7a40488fe128f898f9a5316e6e5a31","first_seen":"2026-10-07T00:41:52.460333Z","last_seen":"2026-10-07T00:41:52.460333Z","times_seen":1,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"fortem.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imgdb.io/i/jFD1k68.jpg","fqdn":"imgdb.io","domain":"imgdb.io","tld":"io"},"ip":{"addr":"138.124.32.82","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.019Z","timestamp":1791333643019,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imgdb.io","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 11:08:16 GMT","end":"Mon, 23 Nov 2026 11:08:15 GMT"},"fingerprint":{"sha1":"2D:58:87:D2:47:0F:DD:36:97:6E:8B:C8:31:A3:FF:4B:69:ED:63:83","sha256":"8A:50:C6:BB:0C:A9:83:0F:DE:C3:10:27:68:04:5F:63:E4:30:36:BD:3C:00:6C:E8:A6:64:CA:06:F6:F6:1B:56"}}},"request":{"raw":"GET /i/jFD1k68.jpg HTTP/1.1\r\nHost: imgdb.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-security-policy: default-src 'none'; sandbox\r\ncontent-type: image/jpeg\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\netag: \"df6e-0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 57198\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":57198,"size_decoded":57741,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 1920x1080, components 3","md5":"c82a4cce653c3ef48e22139f9ce0b007","sha1":"d7661a12796911b4e644550debc6c1ec97d8bca6","sha256":"d1281cf8192cce8c25c8fad0ee8c5f3547e84835578380bc0214814109ffd8bf","sha512":"139898cf68526d670abd79b371cc0ffdebcf0fa62a5c7d7d3338bfe8c3e00ac201db610da2f5ac39a94ac6b3953a0d1b4698a77623f4b996a28e256b2c90be7e","ssdeep":"1536:hqIOMwKy3TWighjsRW3li2HgKXWEdTj3YU5lJmG8:h0MTTh443bgKX7TjoG4G8","tlshash":"314301f9ffcdc287c90152306c85c60eb41249a275bd0ba6b03465ddb939e6cbc9b585","first_seen":"2026-10-07T00:41:52.461435Z","last_seen":"2026-10-07T00:41:52.461435Z","times_seen":1,"resource_available":false,"data":null}},"time_used":402,"timings":{"blocked":-1,"dns":46,"connect":21,"send":0,"wait":25,"receive":33,"ssl":276},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imgdb.io/i/1TYRyoM.jpg","fqdn":"imgdb.io","domain":"imgdb.io","tld":"io"},"ip":{"addr":"138.124.32.82","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Switzerland","country_code":"CH"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.010Z","timestamp":1791333643010,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imgdb.io","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 11:08:16 GMT","end":"Mon, 23 Nov 2026 11:08:15 GMT"},"fingerprint":{"sha1":"2D:58:87:D2:47:0F:DD:36:97:6E:8B:C8:31:A3:FF:4B:69:ED:63:83","sha256":"8A:50:C6:BB:0C:A9:83:0F:DE:C3:10:27:68:04:5F:63:E4:30:36:BD:3C:00:6C:E8:A6:64:CA:06:F6:F6:1B:56"}}},"request":{"raw":"GET /i/1TYRyoM.jpg HTTP/1.1\r\nHost: imgdb.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-security-policy: default-src 'none'; sandbox\r\ncontent-type: image/jpeg\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\netag: \"6f5-0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nvary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 1781\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1781,"size_decoded":2322,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 80x80, components 3","md5":"ad8ba7469ae6d9847f2af8a2f4395a03","sha1":"8f51682b53426f07918405e0b944577869bba374","sha256":"c36732a128f872f29b905deb057c67a49f2d4cbdd47a0f3641c0f18e42486941","sha512":"1fb21a0fec1b4c423bc4f98ec9472baa36ed7c5597df0cd8d7f8b47a773539be1391b708d03ffb57069ea3a680bdd21ff91c72df719c760dfec94aa4996d84bb","ssdeep":"","tlshash":"8931e6bdd304aa67fb119bfa656b106a12828e50fac8b14ec5201c942ce991899d926b","first_seen":"2026-10-07T00:41:52.462941Z","last_seen":"2026-10-07T00:41:52.462941Z","times_seen":1,"resource_available":false,"data":null}},"time_used":413,"timings":{"blocked":-1,"dns":55,"connect":20,"send":0,"wait":57,"receive":1,"ssl":277},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imglink.cc/cdn/_cQW_LxESM.jpg","fqdn":"imglink.cc","domain":"imglink.cc","tld":"cc"},"ip":{"addr":"172.67.131.59","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:43.017Z","timestamp":1791333643017,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imglink.cc","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 02:39:58 GMT","end":"Sun, 06 Dec 2026 02:39:57 GMT"},"fingerprint":{"sha1":"36:27:9B:E0:8E:EE:FC:51:9F:4D:6C:74:C0:51:22:B3:1A:02:7B:BF","sha256":"87:AA:F0:65:E7:60:61:6A:17:C3:D3:73:DF:A1:E1:83:08:C5:08:4E:0D:32:8B:79:EB:AD:58:03:2E:CA:08:3E"}}},"request":{"raw":"GET /cdn/_cQW_LxESM.jpg HTTP/1.1\r\nHost: imglink.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fortem.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 07 Oct 2026 00:40:43 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\ncache-control: public, max-age=31536000, immutable\r\naccess-control-allow-origin: *\r\ncontent-security-policy: upgrade-insecure-requests\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccept-ranges: bytes\r\nlast-modified: Wed, 07 Oct 2026 00:40:43 GMT\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=awopdR7gPDx9N1zgUWLj8mokmkt7SKZGuvfi728PCXuPXTKOWZlEHTUSmE%2BF5naRlkcjPaei52gsixtZF517ypd5p%2BVOW943nYmUh52lqeqlmpxcPycYNxpX9Wk7\"}]}\r\ncf-ray: a468db24d91f56ca-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15310\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15310,"size_decoded":16189,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 210x260, components 3","md5":"9957267e3499c9485dae3ec96e302df8","sha1":"2cece7c8500fc6440a0868d58436be277dd3bd3b","sha256":"e783774221ccd2ef8884e33851be32cf4b34e4cb9ef34a2e5a86b6e89d063868","sha512":"45a88af8202b303847bd51e3dad125ed899ce5769893ca4b1bec568a21371f11dfdf0d82af3e2dedb99d0fc281f1512926019643bc9bc88776a5366e177a43de","ssdeep":"384:NdzO/KGWGAu9vNKIRcR0xsMcfmsYhfmDie8Box:bxRI+R0xsMcfIut","tlshash":"6662d055777095eac703dd7470c45b13bfbd2529a61d328efa03426b1bc2ac6336a98c","first_seen":"2026-10-07T00:41:52.464625Z","last_seen":"2026-10-07T00:41:52.464625Z","times_seen":1,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fortem.click/log","fqdn":"fortem.click","domain":"fortem.click","tld":"click"},"ip":{"addr":"62.60.226.148","port":443,"asn":215939,"as":"Valery Smoliar","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://fortem.click/","date":"2026-10-07T00:40:48.223Z","timestamp":1791333648223,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortem.click","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 03 Oct 2026 18:50:31 GMT","end":"Fri, 01 Jan 2027 18:50:30 GMT"},"fingerprint":{"sha1":"A0:23:08:67:BD:5E:95:D5:38:15:36:C1:3C:A3:E0:6C:FA:2C:13:79","sha256":"55:52:03:4C:37:52:DB:9D:AA:F3:74:16:DF:68:27:B8:48:E2:A5:FC:7E:16:C5:86:3C:19:CC:D5:D8:38:72:44"}}},"request":{"raw":"POST /log HTTP/1.1\r\nHost: fortem.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nReferer: https://fortem.click/\r\nContent-Length: 513\r\nOrigin: https://fortem.click\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":[{"name":"session","value":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiJmb3J0ZW0uY2xpY2siLCJwYXRoIjoiLyIsInBhdGhfaWQiOjMyNDIsImNsaWVudF9pZCI6IjdhYTA5OTE1YWI1ZmMzOTBlZjE1MjhiYjRiMTg4MmQ0Iiwic2VydmljZSI6ImVwaWMiLCJleHAiOjE3OTEzNzY4NDIsImlhdCI6MTc5MTMzMzY0Mn0.ZqKQf0Cv69aWhJ0uz5EBxNvvFZPJmbfeqvhHJOxOSx4"}],"method":"POST","post_data":{"size":513,"data":"{\"action\":\"visited\",\"salt\":{\"timestamp\":1791333648145,\"iv\":\"e44a026de2ea6eac6612c1806d9c2b98\",\"data\":\"d343df06e319a58f9ced3b6171fff4b918f4bf3137e3f0f36a1ce868c2a8a7d76788dc5fabb10018a3bd67fb7da9bda9c2a573dff2d183656c9534c9c14fd399b6d7af2da24277b24996b700754c73db6f6da5b064948c41be0bef1e77c1d61f06e48725bc03d1489fb672c0b20dc82d3186f54557b55a88ada54081daba2a673c03909363bcb138030fa1a5eff35c8d3cabddfc178d85eb960ab1f92c073cb3604db0c343a95b71570494df1f5943f2d5c68c3480793061b4737c9d693bf71295bf3486fccd31545507b642\"}}"}},"response":{"raw":"HTTP/2 204 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: no-store\r\ndate: Wed, 07 Oct 2026 00:40:48 GMT\r\nserver: nginx/1.25.5\r\nvia: 1.1 Caddy\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.25.5","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":1442,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-15T05:37:40.491416Z","times_seen":19114689,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"fortem.click","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}