{"report_id":"98e1b8de-438f-4d4a-b9c5-e2a56e9bda0e","version":0,"status":"done","tags":[],"date":"2026-07-14T14:58:13Z","url":{"schema":"https","addr":"safew.email/","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":0,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"safew.email/","fqdn":"safew.email","domain":"safew.email","tld":"email"},"title":"Safew聊天软件 – 安全加密聊天工具，保护您的隐私通信","dom":{"size":75943,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (9840)","md5":"bfa0ed98be29accb8deec8389eb1da2b","sha1":"b2b0053d9811c5641643ce343dd7d67ac37cbd47","sha256":"0b6f0d501a25b7022665766c7542253223ec84c7cdd6522e6ae87745aea974b3","sha512":"d234cee53c91d9ed835fd7d96a5bd1a6c8dc0d1db9bcfb4ed376d8dec54b297b1e2b03fb30dcf4eee394b8b413d0e4cf8df9622bc6c7b8a5ae2a1114b0dce999","ssdeep":"1536:hl0jypxoWZb77986V8HpnrTqhHjvX8XkJ59bh+O63GQu:hl0OzoWZb77986wiFX8XS59bT63k","tlshash":"e773c73256fb14bf121a93bca4902b199aa59507ce7a0ac0f0fc855c5bd9fee14c734e","dom_hash":"domhash6db4f613786c261eeeb3ef751ed31959","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"safew.email/","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":0,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-18T14:58:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"safew.email","ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-14T14:58:17.106069Z","last_seen":"2026-07-14T14:58:17.106069Z","alert_count":47,"request_count":47,"received_data":2266420,"sent_data":26022,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"WordPress:7.0.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-12T22:19:35.511658Z","alert_count":0,"request_count":4,"received_data":117364,"sent_data":2240,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-12T22:22:25.184057Z","alert_count":0,"request_count":1,"received_data":6744,"sent_data":566,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/jquery.cookie.min.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"23d834419c7ccced820e192be7081228","sha1":"ec662cb3d06ee33848a3fa19585f1f31d4475ec5","sha256":"239011ddd00345611806d77467c81dc5a4c90d15fec6f66357671b73920287dc","sha512":"e8f79309ed49af97ea34f684e1fc512a8717edc0a017f79e7c5bf2e24c9dd3f0aa889f6ca5349b367a95f10bee50869ea075b3b7c543e5d66558bf0e44ec16e1","ssdeep":"","tlshash":"b32120987089b815521b9a35677f109bb078ab55d09c40e9c3d1e4e03f708820d72ef9","size":1301,"data":"","first_seen":"2023-03-07T01:19:12Z","last_seen":"2026-07-14T15:30:20.495311Z","times_seen":1789,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/custom.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0468c7ab2184247a95c5343e2e6a2b4e","sha1":"172d3c10d342d31447695ba8cc8f313b155c863e","sha256":"2cb6296d0113ef14cbcd69f1afcf00585ca14b88b4b9980604bbe8963c8d4f78","sha512":"c340b76b8253f1de084ed562a457afb56f35f147ea4c9729dcfc3a06a8329b8b9a88737457dbe8d39b01d160d1d7abc578dad3dec0cbb11c3fdcfc7daded8619","ssdeep":"192:tQvZ3uFQhO/8lXExRLLq/xmuoaL9DVSuSnLOQH8Bs9dFgkrOu:oZ+cO/8lXE7Lq/xmuoaLNVSuSnLOQH8s","tlshash":"452232496d10157605fbd37aab2fa388fb33015b924291567cbd8a491f70fa102edecd","size":9967,"data":"","first_seen":"2026-01-21T21:51:15.084696Z","last_seen":"2026-07-14T14:58:46.209023Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-includes/js/wp-emoji-release.min.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","size":22752,"data":"","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-07-14T17:17:17.419071Z","times_seen":4592,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-07-14T17:17:17.428172Z","times_seen":967726,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/navigation.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ee5d178484a55e36788dcb5d14b52d01","sha1":"12dabdf70a87227c544d7aa52e8bbae78d90f90f","sha256":"a32e10b91b2fffdb8ca7dac1c2feb1569b5d43a929218e16b65d3a0b36cad43d","sha512":"e15263c212e2807cf884b3a50218560210e1d1261dbcf2ba6693b6c4269d3d16d307fa7ee8eb5cd8aacd7963f4258bf28a91468902c60f1b42e27a4a56f1b298","ssdeep":"","tlshash":"8d41fec73a8b323b96ca2354a17d64527a38c172d70a7d26b4b8d2852860c0506fdfcc","size":2360,"data":"","first_seen":"2023-03-07T01:38:19Z","last_seen":"2026-07-14T15:30:20.533464Z","times_seen":1427,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/swiper-bundle.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"27fbae62289b17ce94845884c7347e1f","sha1":"5b4faedfe7a99ab51b36c36882f668960dfc4c34","sha256":"491451b0d104a756b3c7ae4f324c3637ca3419e1feb61175efa388e9afbeec08","sha512":"2a3efd587dbed82d3e26046442cc4d7d2d670425e0123258fcb07f74353859e5de7a9fdb6836238adbce2bb8f3d222e3f859d08be18355c207a77b74a900daa3","ssdeep":"6144:BRm9b44OeRpEA5A2Mqqn6GvyIqcgMMQFj65G4IrV+vISpYggSCmyS:yOy","tlshash":"5c64204d9551229558b37b2edfae8108f7ba0223a147865179ac8d54efb483803bdffc","size":320846,"data":"","first_seen":"2023-03-13T22:18:49Z","last_seen":"2026-07-14T15:30:20.494453Z","times_seen":1237,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/hc-sticky.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5422ee3dc65dd7532c93eeca782b5183","sha1":"b34fc890fbadbed06086e03c48c6d48cce1c8061","sha256":"9190a72ad61bc899f3bbcdf8a6ea3e5010b623d9a958baa413105440054f71a2","sha512":"1c9f36fdd97ad862935fe8a1e5ccfaf539babe5a537e430c513436352f41cf1c7a42d99dec1ef304dfaa5fcf3346133d5922f2cf5918284b213dc6fb618c439b","ssdeep":"192:KcTW0GaBAxHytKPUxT1grUQ1cQB/1EHJCWFPjPm4QpbBbCk3yybo3+pvaGhm:KcfjSHgxT1nutWvtulbWyxpvaGhm","tlshash":"dc22b6887640b87247d380c559af810bb231885dbbdbe46095b9e8e45cb0de72073fbd","size":10763,"data":"","first_seen":"2023-09-30T22:07:04Z","last_seen":"2026-07-14T15:30:20.467265Z","times_seen":534,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/jquery.sticky.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5f7fb43a03d361850078409ffddd94e","sha1":"6ccc5c366c53beb5c7e5ff62dc0858140e63602c","sha256":"8381d12db2d3eccf96bbfa4f1aac3888cdd9cbf6fa1622a871e341bcb51b4d4d","sha512":"1a489bad895dcf053cc9855d01327ed4a585e1cf2a18f3f86a7f313744eb17cb732ee9fa9cd272041c9829bd0916ad463621307e41d936589a27dcb85b434eca","ssdeep":"192:tAPo0HYtNeO8CWkd++aMsuIqD6SlVV1voO78WSExY1mGlU:qAtCkdDsuRDHQ3WSWY1C","tlshash":"cdf1418a6323617649bbb3be8b56924cf3a341b3a39355157dadca440fb296101f0ff4","size":7818,"data":"","first_seen":"2023-03-07T01:38:19Z","last_seen":"2026-07-14T15:30:20.485562Z","times_seen":584,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/jquery.smartmenus.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"efcff8546ef4a6330321fdc755a75229","sha1":"2398c0f4f8d06009fb78e1801efb1bea6f3a71ce","sha256":"752345e29ce9c0ceb0c303f00a21c79991457e250fbd17d36150c41608f1bca8","sha512":"588b259158f14070fce9724b2dfd3814aae9725088cab8809bca04f345274ac27f21136f44cfe63a80f69142304ee05e28e64c63414ba7a6bc9ff8a4d3239070","ssdeep":"768:NE7foC3IGcqeO1fqnS0BaVftMib9oAaIQuIK7/0p9hxKMlL17tZAlnOsmKOKn3:NJJwK295afKMF17LDKOKn3","tlshash":"df2373ca735d712f82e633b4853f556aeb3dd072c20250bffcae6998656046813b0db9","size":46951,"data":"","first_seen":"2023-03-10T02:43:07Z","last_seen":"2026-07-14T15:30:20.477281Z","times_seen":1259,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"06f019a6ff09db6b297570940eec1d5d","sha1":"872efe186950ce534aad341e7030fe24f7c672dc","sha256":"53f829ae556bf7011727483015d83a98bcdb4b5796eecb728827c1282c971536","sha512":"0cc41e9797501e654a2b51a1adba4d3593347ada90e0dbdeea3ee89345415ab192007ae9886855447d472d814b8945fcb680ae7fb8942d17af1682a33236d633","ssdeep":"","tlshash":"5be07dfafd5b457101e7a1237bce739e293275a3e92a4c402889ce806c38dd31126dd1","size":325,"data":"","first_seen":"2023-03-07T01:19:13Z","last_seen":"2026-07-14T17:24:36.6269Z","times_seen":13974,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"b13840e052d81baa657daefdd4b75f44","sha1":"4e14b9bb77a80f740478322594589aa4a9398ea9","sha256":"027bba2de010f81960833c174583725e57bbf55e68588c5899a3765d87e6cfeb","sha512":"aee1d2745c4a8f335792e29a71c4d4c356eab5b6d23998e1d6f8ec57e4351f1c94113243110ec4aa4bb4aa042915e44c79db3c5d50550183a00c8aac18b4116e","ssdeep":"","tlshash":"0e418cdaf31d746b85ba605f352c99cd6abf04ff790148377c058a2c189dd9d835ac24","size":2318,"data":"","first_seen":"2026-06-14T09:37:09.525739Z","last_seen":"2026-07-14T15:30:20.559635Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/dark.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b4ba7b304cffc3c7262f5de4fea068a2","sha1":"b1057fa4395c41e0e4dc4a5239244a4fbb0ffc99","sha256":"7e38ec5995ee62896827cc5126f0abd4ed530183941b747f317d93e532cc6138","sha512":"2bd2064d610cf27187b2acd99fc811885745514651dd562dfda2b12a0dea276e3d1317413a6b860afc3b7ba70a6dd467cb72d8c2b24fa5a0a2f7b1c19cba2651","ssdeep":"","tlshash":"bf21bd8d742ba0d469b7623d4fbe4400eea418bbd1045e007c9d58505f784e0495cffa","size":1126,"data":"","first_seen":"2024-11-13T20:07:01.350853Z","last_seen":"2026-07-14T15:30:20.47006Z","times_seen":115,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-includes/js/wp-emoji-loader.min.js","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0f5f707684e9cf5998ae07d40f33ba09","sha1":"7e08b78d2494c589f116e86bc1ac148c1d5ccbf5","sha256":"a433588837b376dc9857bd986225ef0e95b66122851e4b8fdb39997dad58ab24","sha512":"cdfae7dbe0f33f78a0707be6de99374d48786ef961bed6196e1b4f7afcbbfd94c6293c4d09a33a3a22e92226644238867bf74a4137a82b6d2ce70a4f6a5234f0","ssdeep":"","tlshash":"e771969ae77638dfb2f900f2697a0d47eb614435d6c8d438c9bda3141cb5893c274b46","size":3666,"data":"","first_seen":"2026-07-14T14:58:23.763012Z","last_seen":"2026-07-14T14:58:46.234825Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13577,"data":"","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-07-14T17:17:17.422028Z","times_seen":888533,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"JQMIGRATE: Migrate is installed, version 3.4.1","filename":"https://safew.email/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","line_number":2,"column_number":981}]},"http":[{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E7%BE%A4%E7%BB%84%E8%81%8A%E5%A4%A9%E7%AE%A1%E7%90%86%EF%BC%9A%E5%9C%A8SafeW%E4%B8%AD%E5%A6%82%E4%BD%95%E9%AB%98%E6%95%88%E7%BB%84%E7%BB%87%E5%A4%9A%E4%BA%BA%E5%AF%B9%E8%AF%9D%EF%BC%9F1-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.914Z","timestamp":1784041028914,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E7%BE%A4%E7%BB%84%E8%81%8A%E5%A4%A9%E7%AE%A1%E7%90%86%EF%BC%9A%E5%9C%A8SafeW%E4%B8%AD%E5%A6%82%E4%BD%95%E9%AB%98%E6%95%88%E7%BB%84%E7%BB%87%E5%A4%9A%E4%BA%BA%E5%AF%B9%E8%AF%9D%EF%BC%9F1-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:24:15 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da67f-7f90\"\r\nexpires: Thu, 13 Aug 2026 14:57:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32656,"size_decoded":32322,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"e28d7d88d5feb5237d7a5e47ec0f459f","sha1":"2f4d340a6a6b1838e2a9685cca130055c08521a2","sha256":"3e252ef4a70a2f6987af581b66eae14c154f6a9dda69f1272e80c08cacbd12f1","sha512":"fea54af10409765def1e20dc7f021a3b9f2974564d54069ed76105d3b24107f55c44e7b889369c568bb9ab5a0452f996b1a31bb157ce33e58b50f7dc97302d63","ssdeep":"768:62hpuOxghhRRw8h7IEp16KjSQe0oPt/6w/RgVPZOr4j0Xg6BeuyA:68uOgbw8NjAyw/aVPVAtB9V","tlshash":"36e2e14aae06526ee8d0ccf740514cc8b6c8ed2828b07c9ad7fbfc4b0da66c5840d798","first_seen":"2026-07-14T14:58:23.678737Z","last_seen":"2026-07-14T14:58:46.217868Z","times_seen":2,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/josefinsans/v34/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.979Z","timestamp":1784041028979,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/josefinsans/v34/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://safew.email\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28528\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 02:37:08 GMT\r\nexpires: Fri, 09 Jul 2027 02:37:08 GMT\r\ncache-control: public, max-age=31536000\r\nage: 476401\r\nlast-modified: Thu, 04 Sep 2025 17:12:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":28528,"size_decoded":29341,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28528, version 1.0","md5":"4316a5aa6c074dfbfdcfb60023405316","sha1":"0ff5ba86b13131add1157861d2fbc830432f94a4","sha256":"21efe1559a026f9ad7f880772917faa3a621186688e8e79e0568e4308c0bafa9","sha512":"3b136256cb1ab4ecd3b36d52ca9508cc45019a37ae2497388a3f1f7af7b29feb5df1adef533cb5a47b172c6e95c54e84254163d604b5ace76986f1d0da5152ec","ssdeep":"384:CVyhp48UoZw2f7NoTIwNviYobclKfQ9rSuNsztMKBSn8/Ex20kAOc0fqvV3dLnXs:BAU5NMcbl4JShaaOIEGAQ+TXKve+Tgi","tlshash":"a4d2e13745891dbad2720db2abc0adc0b600883bf7197d7ed2cf80836d2eca45d5264b","first_seen":"2025-06-03T08:29:57.615496Z","last_seen":"2026-07-14T17:02:18.838195Z","times_seen":9761,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":23,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/josefinsans/v34/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.981Z","timestamp":1784041028981,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/josefinsans/v34/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://safew.email\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28528\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 02:37:08 GMT\r\nexpires: Fri, 09 Jul 2027 02:37:08 GMT\r\ncache-control: public, max-age=31536000\r\nage: 476401\r\nlast-modified: Thu, 04 Sep 2025 17:12:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":28528,"size_decoded":29341,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28528, version 1.0","md5":"4316a5aa6c074dfbfdcfb60023405316","sha1":"0ff5ba86b13131add1157861d2fbc830432f94a4","sha256":"21efe1559a026f9ad7f880772917faa3a621186688e8e79e0568e4308c0bafa9","sha512":"3b136256cb1ab4ecd3b36d52ca9508cc45019a37ae2497388a3f1f7af7b29feb5df1adef533cb5a47b172c6e95c54e84254163d604b5ace76986f1d0da5152ec","ssdeep":"384:CVyhp48UoZw2f7NoTIwNviYobclKfQ9rSuNsztMKBSn8/Ex20kAOc0fqvV3dLnXs:BAU5NMcbl4JShaaOIEGAQ+TXKve+Tgi","tlshash":"a4d2e13745891dbad2720db2abc0adc0b600883bf7197d7ed2cf80836d2eca45d5264b","first_seen":"2025-06-03T08:29:57.615496Z","last_seen":"2026-07-14T17:02:18.838195Z","times_seen":9761,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":31,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/webfonts/fa-brands-400.woff2","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.987Z","timestamp":1784041028987,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/webfonts/fa-brands-400.woff2 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/wp-content/themes/blogdata/css/all.css?ver=7.0.1\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 117372\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\netag: \"698089b0-1ca7c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":117372,"size_decoded":117814,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 117372, version 773.768","md5":"b6356c957274676e6571c1ff5e11c9a8","sha1":"4022f95e001d734ca8f082b8e7627abd205609ec","sha256":"3a8924cd5203a28628716aedb5cef0943da4c3b44e3ffcee90ab06387b41c490","sha512":"83de79c74480fafc62cdac4012ff2a129d8701772ee16216c3d9488826ac21a9c2f8a416fe3208a61bfea7e12c24ac1cc2d26f6d22bd2b0ba39a22d630238b59","ssdeep":"3072:U3JKgVzg5ybfXYe5W59JPQaPWKSsx/DBMnVnqedkAFqPQTzIBIOK2vDMF:IVM5A5GJPQaH/NMtBkAvcnYF","tlshash":"c4b312f88b7ac9a5e304e67b55e4613555a0aec8b180f35453be7c2c221e10dc67afe3","first_seen":"2023-12-02T04:06:15Z","last_seen":"2026-07-14T16:38:44.137567Z","times_seen":27155,"resource_available":false,"data":null}},"time_used":391,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":239,"receive":152,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-includes/js/wp-emoji-release.min.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:09.176Z","timestamp":1784041029176,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Jul 2026 21:04:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a500cd1-58e0\"\r\nexpires: Wed, 15 Jul 2026 02:57:09 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22752,"size_decoded":6011,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (19813)","md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-07-14T17:17:17.419071Z","times_seen":4592,"resource_available":true,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/fonts/eb4d8c5691c3f55639714cbac9cc01b8.css?ver=20201110","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.256Z","timestamp":1784041028256,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/fonts/eb4d8c5691c3f55639714cbac9cc01b8.css?ver=20201110 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 05 Feb 2026 15:09:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6984b2bd-3323e\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":209470,"size_decoded":7059,"mime_type":"text/css","magic":"ASCII text, with very long lines (857)","md5":"0f175733559a9956b3c0e36291336f38","sha1":"aed075906a2976f76554559cb0cdcd1d35771e50","sha256":"01c8c26ff99bb98efc98ae48308f33c1fae5e064dff2c126c467e06cb1fd5c31","sha512":"e4f4727ce79c99c9b13006bbb2c29fab46e83248ad951560d0b1359dee57c9766c5334f814169aeceb1d26aa85f92a906dbd9933b78bd14decb2d717ba460857","ssdeep":"768:5uWe/U450NI0fkCFasrVqAFUCm6mSW6LDVoYdr6+XZMnec3Uslh3DM9pq4bLk0BD:H2Cm6mSW6L5V59peY5KTEFGvy","tlshash":"bb241c91042b104497839cd233ce7f35ee1ea241a848d578affd099eadefd2523a135e","first_seen":"2026-07-14T14:58:23.685599Z","last_seen":"2026-07-14T14:58:46.232458Z","times_seen":2,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/sm-core-css.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.270Z","timestamp":1784041028270,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/sm-core-css.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\ncontent-length: 898\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\netag: \"698089b0-382\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":898,"size_decoded":1403,"mime_type":"text/css","magic":"troff or preprocessor input, ASCII text, with CRLF line terminators","md5":"de5b180649eb0644ca0e9c45afbdca48","sha1":"715240598cbb73a4adb3d62f6f1c7faa7622b1e4","sha256":"68153f035a00ad4f821610cee300fb4d0ce87144e9973f1b4cb614d50e970d0f","sha512":"ea1518b1ac2982617f5afcf6a42f275aaebc9421eb9b8673d9612348dcbdc3cb823f231d76004d91e160476ff8faee87d34299bc339df8ba47ccb92a37182a8d","ssdeep":"","tlshash":"3c11c2142ec11244851bc62874e38303cb1b73128157167eaafec3554bef29b069fd39","first_seen":"2024-11-13T20:07:01.314558Z","last_seen":"2026-07-14T15:30:20.525743Z","times_seen":113,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogtag/css/colors/dark.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.456Z","timestamp":1784041028456,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogtag/css/colors/dark.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\ncontent-length: 668\r\nlast-modified: Mon, 02 Feb 2026 11:25:35 GMT\r\netag: \"698089af-29c\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":668,"size_decoded":1173,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"1c19613bfd67ff1b55fc320129291502","sha1":"7eec6c9e65cf8e3b5662c09acb4eb47fcad7ace9","sha256":"fc824a5dc814dea59e151072a026e438552e196d9acfeac30a984096fb16030d","sha512":"eced83168695094df4adacc56289a2f525bf85ed54c0ca8f75c418d0a88a35a976fc705421d80003796b2173c28af2b004bcb1287e71c5a2994277532496e207","ssdeep":"","tlshash":"57018136f28b650b01278afe6679e4858f696cc0c0116b75bbe4410395ddad4bd7e482","first_seen":"2024-11-13T20:07:01.333572Z","last_seen":"2026-07-14T15:30:20.527275Z","times_seen":27,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/favicon.ico","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:09.387Z","timestamp":1784041029387,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"69802be6-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-07-14T17:03:58.427857Z","times_seen":312206,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.458Z","timestamp":1784041028458,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 09 Jun 2023 05:49:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6482bd64-3509\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13577,"size_decoded":5407,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-07-14T17:17:17.422028Z","times_seen":888533,"resource_available":true,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/jquery.sticky.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.463Z","timestamp":1784041028463,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/js/jquery.sticky.js?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-1e8a\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7818,"size_decoded":2702,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"d5f7fb43a03d361850078409ffddd94e","sha1":"6ccc5c366c53beb5c7e5ff62dc0858140e63602c","sha256":"8381d12db2d3eccf96bbfa4f1aac3888cdd9cbf6fa1622a871e341bcb51b4d4d","sha512":"1a489bad895dcf053cc9855d01327ed4a585e1cf2a18f3f86a7f313744eb17cb732ee9fa9cd272041c9829bd0916ad463621307e41d936589a27dcb85b434eca","ssdeep":"192:tAPo0HYtNeO8CWkd++aMsuIqD6SlVV1voO78WSExY1mGlU:qAtCkdDsuRDHQ3WSWY1C","tlshash":"cdf1418a6323617649bbb3be8b56924cf3a341b3a39355157dadca440fb296101f0ff4","first_seen":"2023-03-07T01:38:19Z","last_seen":"2026-07-14T15:30:20.485562Z","times_seen":584,"resource_available":true,"data":null}},"time_used":403,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":403,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E7%95%8C%E9%9D%A2%E8%AF%A6%E8%A7%A3%EF%BC%9A%E5%8A%9F%E8%83%BD%E5%8C%BA%E3%80%81%E5%BF%AB%E6%8D%B7%E9%94%AE%E4%B8%8E%E8%AE%BE%E7%BD%AE%E5%85%A5%E5%8F%A34-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.922Z","timestamp":1784041028922,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E7%95%8C%E9%9D%A2%E8%AF%A6%E8%A7%A3%EF%BC%9A%E5%8A%9F%E8%83%BD%E5%8C%BA%E3%80%81%E5%BF%AB%E6%8D%B7%E9%94%AE%E4%B8%8E%E8%AE%BE%E7%BD%AE%E5%85%A5%E5%8F%A34-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:40:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699daa37-6075\"\r\nexpires: Thu, 13 Aug 2026 14:57:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24693,"size_decoded":23995,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"8254c8c8814643b44d0a3ddffd5ca4cd","sha1":"0f394cb3b9966f0a6e688e0e7be0624324adf4dd","sha256":"f2d781036ce00fb231f24f9b2c9105b03ea32f27332b7b0186a35e9893d82ae6","sha512":"afe13749d64d48c7c347706f6fd83137184c215f1f6eeeff1fe694a7d22dd41c365a29212a1e1e6eba8a4b7539504c9030d798fc462e3430bb6da55c9f195a60","ssdeep":"768:6Ds7GRKFi8PKTYbL7Iscy17Gvi69CK0pe5IO:6QgmK8bLkO+nC3pcIO","tlshash":"2db2d15ef6039fcb646d17bea04929389022dae6b4b221f57b39cced72c008599d5c91","first_seen":"2026-07-14T14:58:23.696977Z","last_seen":"2026-07-14T14:58:46.22618Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E5%A6%82%E4%BD%95%E8%A7%A3%E5%86%B3SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%8D%A1%E9%A1%BF%E6%88%96%E9%97%AA%E9%80%80%E9%97%AE%E9%A2%98%EF%BC%9F1.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.929Z","timestamp":1784041028929,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E5%A6%82%E4%BD%95%E8%A7%A3%E5%86%B3SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%8D%A1%E9%A1%BF%E6%88%96%E9%97%AA%E9%80%80%E9%97%AE%E9%A2%98%EF%BC%9F1.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:34:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da8f4-15cf9\"\r\nexpires: Thu, 13 Aug 2026 14:57:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":89337,"size_decoded":74934,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [\n- TIFF image data, big-endian, direntries=3], baseline, precision 8, 1024x972, components 3","md5":"679263b6ab0f4ae5441c4425342ab1f5","sha1":"4303ad87b764fedb2a30d3002bbbeb5783692f7c","sha256":"a86a7beaca2858787c83f97c39d5feb540093351a5cf1eae5b94801c1bc3de88","sha512":"3992a13b34aa12575a85566a29a14864e87854382d6e12b8c973ce9eb4a387b19604c8507e4b40793f4bfefb66cfc542e112e29b5b3d326898dc42665a760bcd","ssdeep":"1536:OUL6VYWYvyl7N69Iobwzc3Fjh++okafHkVRHjXCoqi8:OUFmRzyVc+mHkvHjXZt8","tlshash":"b893e0179c059793e4a983b8fe165d1d6b16270c606875fa31af4d8ebb823603cdf0ad","first_seen":"2026-07-14T14:58:23.699094Z","last_seen":"2026-07-14T14:58:46.203921Z","times_seen":2,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/webfonts/fa-regular-400.woff2","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.984Z","timestamp":1784041028984,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/webfonts/fa-regular-400.woff2 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/wp-content/themes/blogdata/css/all.css?ver=7.0.1\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 25452\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\netag: \"698089b0-636c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25452,"size_decoded":25892,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 25452, version 773.768","md5":"023a4a925fa3fce0f66b769ef6bbb264","sha1":"2ed706340547d19c10a409ee02fb08f3d52ff670","sha256":"2bccecf0bc7e96cd5ce4003abeb3ae9ee4a3d19158c4e6edfd2df32d2f0d5721","sha512":"40f3ef2bfde073d33a2d3cbc280fb40ea50dc2b0c3619c8d9717d665351ae219caa5f17ae67cc87e777ff73c1275c1f3778b26e95f19459594d2f42ab95aecc1","ssdeep":"384:Uf5wuZ+wxJe5X/l55lwWB8jCYpdKMH4aL0a6nYEd4Mjxx6e6RERnoJ8ZwC3UmFs:0wFwxM5/1G3UIya6n9dft6RERnomFs","tlshash":"04b2e008d6d6bd12d57196f83bf74ca04bc0464b0a976b2545a2bde30ed00eec86bb79","first_seen":"2023-12-02T04:06:15Z","last_seen":"2026-07-14T17:16:10.029049Z","times_seen":8886,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":242,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/core.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.262Z","timestamp":1784041028262,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/core.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-1965b\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":104027,"size_decoded":17616,"mime_type":"text/css","magic":"assembler source, ASCII text, with CRLF line terminators","md5":"e95efe7e14b6949e887afee57e92300c","sha1":"cd50186c50558cd4f9178247d91aeaab9bf7b8bb","sha256":"4fe7afc43a02c611e5460ce514aff50dd5b34388153019d49004280a633c31f6","sha512":"40a83cdab9f3ba308e975e1732832d8e58d1047219fcff9d37e80280d00ab31ffd7b60bc7858f3b4ae54dd98ac68b1e8bd4de0b04b7192795bfb150c7c1f4b98","ssdeep":"768:y/M3Lu60O3jVlxd15sur/9l+sIkol15QS9RSSrZbDc+9elI/rkY1AueZiicEVkSr:lLu60O9+XdbDcmdrkY1AueZ2EOSddD","tlshash":"10a385989e4711449737dbf4bf911b49eb944062eb0600e4fae26049a2c97ed09bffdc","first_seen":"2026-01-01T15:02:18.072731Z","last_seen":"2026-07-14T14:58:46.202671Z","times_seen":10,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/sm-clean.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.447Z","timestamp":1784041028447,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/sm-clean.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-2a52\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10834,"size_decoded":2248,"mime_type":"text/css","magic":"ASCII text, with very long lines (1150), with CRLF line terminators","md5":"b659868adaf7e53e47a02f024fca0282","sha1":"c6b8e15f1204cc629189338829b8292f57b33234","sha256":"2089462d33e370188c4d70e1443f3cc635ae84baece3b185b79dacd54b5e6027","sha512":"3394fbef11909b4965af4c34f6ab7e23167fef16be74621c3302319f8e1f7ad76e3ab71f05f2eaa22e48f411253ad3d0285b755e1923e904b4f73d933a33084f","ssdeep":"192:Aru9hpGHaXZmYue2P2Ztc5Fd70xEHyq7zbL:dCSxiL","tlshash":"8c222590ede003453579ebb9a363a5b0ff891256f3c716f0ba8052a51a1d58c0d6bcfa","first_seen":"2024-12-15T00:41:51.208841Z","last_seen":"2026-07-14T14:58:46.2147Z","times_seen":110,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogtag/css/colors/default.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.455Z","timestamp":1784041028455,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogtag/css/colors/default.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089af-b394\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45972,"size_decoded":7483,"mime_type":"text/css","magic":"ASCII text, with very long lines (413), with CRLF line terminators","md5":"d232db0aad7ab18d7dc1aa243e9f8843","sha1":"d5d0d5dca967f3f1d7f433498d3dd415a1b8b835","sha256":"c972389376428de755871509172632cef554b03e1d7d840f586b6800eb479e04","sha512":"4ec88a1dfd78566d86e8e34185bd5f44b028be5f5cef0691a4040706e3e5c9ed1b7929fdfcc287b1e9e35c0c0993ddd613438164a0fefca44566bcced14166a5","ssdeep":"384:l/En/veHGxKVPeLZKD2l9OyeCOe+99a2V2qtBykdIj4M4Ct/stJR:9HGE9kOyenTa2V2qtByyIj5zt4P","tlshash":"8f2336afb19115ef27975afd6b70d490af4801e89d080bb8b51a419841ce3dd3f2b6c7","first_seen":"2024-11-13T20:07:01.330803Z","last_seen":"2026-07-14T15:30:20.481578Z","times_seen":27,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/swiper-bundle.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.460Z","timestamp":1784041028460,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/js/swiper-bundle.js?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-4e54e\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":320846,"size_decoded":58850,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"27fbae62289b17ce94845884c7347e1f","sha1":"5b4faedfe7a99ab51b36c36882f668960dfc4c34","sha256":"491451b0d104a756b3c7ae4f324c3637ca3419e1feb61175efa388e9afbeec08","sha512":"2a3efd587dbed82d3e26046442cc4d7d2d670425e0123258fcb07f74353859e5de7a9fdb6836238adbce2bb8f3d222e3f859d08be18355c207a77b74a900daa3","ssdeep":"6144:BRm9b44OeRpEA5A2Mqqn6GvyIqcgMMQFj65G4IrV+vISpYggSCmyS:yOy","tlshash":"5c64204d9551229558b37b2edfae8108f7ba0223a147865179ac8d54efb483803bdffc","first_seen":"2023-03-13T22:18:49Z","last_seen":"2026-07-14T15:30:20.494453Z","times_seen":1237,"resource_available":true,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E7%BE%A4%E7%BB%84%E8%81%8A%E5%A4%A9%E7%AE%A1%E7%90%86%EF%BC%9A%E5%9C%A8SafeW%E4%B8%AD%E5%A6%82%E4%BD%95%E9%AB%98%E6%95%88%E7%BB%84%E7%BB%87%E5%A4%9A%E4%BA%BA%E5%AF%B9%E8%AF%9D%EF%BC%9F1.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.927Z","timestamp":1784041028927,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E7%BE%A4%E7%BB%84%E8%81%8A%E5%A4%A9%E7%AE%A1%E7%90%86%EF%BC%9A%E5%9C%A8SafeW%E4%B8%AD%E5%A6%82%E4%BD%95%E9%AB%98%E6%95%88%E7%BB%84%E7%BB%87%E5%A4%9A%E4%BA%BA%E5%AF%B9%E8%AF%9D%EF%BC%9F1.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:24:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da67e-17e9f\"\r\nexpires: Thu, 13 Aug 2026 14:57:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97951,"size_decoded":84479,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [\n- TIFF image data, big-endian, direntries=3], baseline, precision 8, 1024x969, components 3","md5":"0b04f6b8c574deb5f25c031969767235","sha1":"01a1495b300237c8b9c889ec5d744aa9d47ec2eb","sha256":"36e04d12dce9299b90babb7e00c83ec129d9d3010807af4cf3265493fa913cd7","sha512":"028c2a0e5e0fb9d40f375299ffd29ad19ead78ed2a151ffec7044bab305a4fbf1569c574562098e58a50c3dcf7e6a61b9e8b5e31aeb7d2d65f4cb5a65ba5f70d","ssdeep":"1536:OpByzvjhuiTIqD+cbyv4kzjcdAe2rxKUf37+nxaXehuhKKAOJRvX3jMPUgGy15/t:OpcvILcszjcdAemxKY38FwK2X3jMgna1","tlshash":"46a3f20797488ac2e9ad9375ae170c1d7606233cb24c5af9722f8d97bb903923d9d03d","first_seen":"2026-07-14T14:58:23.706877Z","last_seen":"2026-07-14T14:58:46.201204Z","times_seen":2,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/josefinsans/v34/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.985Z","timestamp":1784041028985,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/josefinsans/v34/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://safew.email\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28528\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 02:37:08 GMT\r\nexpires: Fri, 09 Jul 2027 02:37:08 GMT\r\ncache-control: public, max-age=31536000\r\nage: 476401\r\nlast-modified: Thu, 04 Sep 2025 17:12:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":28528,"size_decoded":29341,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28528, version 1.0","md5":"4316a5aa6c074dfbfdcfb60023405316","sha1":"0ff5ba86b13131add1157861d2fbc830432f94a4","sha256":"21efe1559a026f9ad7f880772917faa3a621186688e8e79e0568e4308c0bafa9","sha512":"3b136256cb1ab4ecd3b36d52ca9508cc45019a37ae2497388a3f1f7af7b29feb5df1adef533cb5a47b172c6e95c54e84254163d604b5ace76986f1d0da5152ec","ssdeep":"384:CVyhp48UoZw2f7NoTIwNviYobclKfQ9rSuNsztMKBSn8/Ex20kAOc0fqvV3dLnXs:BAU5NMcbl4JShaaOIEGAQ+TXKve+Tgi","tlshash":"a4d2e13745891dbad2720db2abc0adc0b600883bf7197d7ed2cf80836d2eca45d5264b","first_seen":"2025-06-03T08:29:57.615496Z","last_seen":"2026-07-14T17:02:18.838195Z","times_seen":9761,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":24,"dns":0,"connect":0,"send":0,"wait":37,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/all.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.257Z","timestamp":1784041028257,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/all.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-190f9\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102649,"size_decoded":23347,"mime_type":"text/css","magic":"ASCII text, with very long lines (52269), with CRLF line terminators","md5":"d04b0cf35abb0e22eecca58c52984615","sha1":"9a0821025ba59e2602ae3a03467842a5d80f77cd","sha256":"ce6f72d6b4c728f562906a8e51e2456a9011acb20b4c90e0eb79b580cce8f229","sha512":"0bb42546a13d12035276562d4d2e01b8569649ab9dcf6e67caedae652af9df3f90fda288b4f646f057efbb399d6e02d4e33a5ffad3dbe920482ffd975010838a","ssdeep":"1536:yjMCMPMCMjMCM4MCMwMCM3sVM7709gbPMfjSFOTyPG9SpgSLCJ:N709gMGFiyPG9SiSLCJ","tlshash":"7ca3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2024-05-29T20:38:41Z","last_seen":"2026-07-14T15:30:20.465764Z","times_seen":1596,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/colors/dark.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.259Z","timestamp":1784041028259,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/colors/dark.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\ncontent-length: 662\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\netag: \"698089b0-296\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":662,"size_decoded":1167,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"211e5ce2e4f35b25f63c5aca66cce07f","sha1":"c1ed314d1051a6e2b36bc8887e10e16af0cae926","sha256":"365c8e001a64b3e4533b6c58f4c68b24b6c4e112834af949590524f7e9a573c5","sha512":"d1e22586af5e7d3a09a1c39e06684c63bc1ff1e884ec3c20f2f41174ad66bf352febb153c1425d5aaba9246d18968e23bc11830b6c413d2779f9da8079ef04d8","ssdeep":"","tlshash":"9901873af38b6207002b8afc6178e4858f9d6cc0c0126b76b7e4810390cc9e8bc7f486","first_seen":"2026-01-01T15:02:18.084278Z","last_seen":"2026-07-14T14:58:46.228095Z","times_seen":30,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/style.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.452Z","timestamp":1784041028452,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/style.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-c9b\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3227,"size_decoded":1775,"mime_type":"text/css","magic":"ASCII text, with very long lines (588), with CRLF line terminators","md5":"acb31b3a18dac6c6065be6daa54ffb9e","sha1":"19b2cf02587c06630d6e65b610acc7347e2442c1","sha256":"f467850442b3866d93f40a289a43da02f9cebd5779ff30adbbf2225bd10da6cf","sha512":"86d3f9dfe050bf6abda56a664c495c20af3ab8d7c18cbe3f321138a3734ba0ed248a0b2cd481fec4d5673e5d9650177fdb2e2a4a9cc0ad2608596100810111c5","ssdeep":"","tlshash":"8761987ee51e81b5a27751aa2b784144e313e247bb921870fbcdc6018f703ee3a65944","first_seen":"2026-02-05T05:44:56.125752Z","last_seen":"2026-07-14T14:58:46.20704Z","times_seen":3,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/hc-sticky.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.462Z","timestamp":1784041028462,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/js/hc-sticky.js?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-2a0b\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10763,"size_decoded":4622,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10460), with CRLF line terminators","md5":"5422ee3dc65dd7532c93eeca782b5183","sha1":"b34fc890fbadbed06086e03c48c6d48cce1c8061","sha256":"9190a72ad61bc899f3bbcdf8a6ea3e5010b623d9a958baa413105440054f71a2","sha512":"1c9f36fdd97ad862935fe8a1e5ccfaf539babe5a537e430c513436352f41cf1c7a42d99dec1ef304dfaa5fcf3346133d5922f2cf5918284b213dc6fb618c439b","ssdeep":"192:KcTW0GaBAxHytKPUxT1grUQ1cQB/1EHJCWFPjPm4QpbBbCk3yybo3+pvaGhm:KcfjSHgxT1nutWvtulbWyxpvaGhm","tlshash":"dc22b6887640b87247d380c559af810bb231885dbbdbe46095b9e8e45cb0de72073fbd","first_seen":"2023-09-30T22:07:04Z","last_seen":"2026-07-14T15:30:20.467265Z","times_seen":534,"resource_available":true,"data":null}},"time_used":404,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":404,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/dark.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.467Z","timestamp":1784041028467,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/js/dark.js?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-466\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1126,"size_decoded":936,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"b4ba7b304cffc3c7262f5de4fea068a2","sha1":"b1057fa4395c41e0e4dc4a5239244a4fbb0ffc99","sha256":"7e38ec5995ee62896827cc5126f0abd4ed530183941b747f317d93e532cc6138","sha512":"2bd2064d610cf27187b2acd99fc811885745514651dd562dfda2b12a0dea276e3d1317413a6b860afc3b7ba70a6dd467cb72d8c2b24fa5a0a2f7b1c19cba2651","ssdeep":"","tlshash":"bf21bd8d742ba0d469b7623d4fbe4400eea418bbd1045e007c9d58505f784e0495cffa","first_seen":"2024-11-13T20:07:01.350853Z","last_seen":"2026-07-14T15:30:20.47006Z","times_seen":115,"resource_available":true,"data":null}},"time_used":398,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":398,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E6%8F%90%E9%86%92%E4%BC%98%E5%85%88%E7%BA%A7%EF%BC%9A%E7%A1%AE%E4%BF%9D%E9%87%8D%E8%A6%81%E6%B6%88%E6%81%AF%E4%B8%8D%E8%A2%AB%E9%94%99%E8%BF%874-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.913Z","timestamp":1784041028913,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E6%8F%90%E9%86%92%E4%BC%98%E5%85%88%E7%BA%A7%EF%BC%9A%E7%A1%AE%E4%BF%9D%E9%87%8D%E8%A6%81%E6%B6%88%E6%81%AF%E4%B8%8D%E8%A2%AB%E9%94%99%E8%BF%874-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:32:30 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da86e-51cd\"\r\nexpires: Thu, 13 Aug 2026 14:57:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20941,"size_decoded":20200,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"44ab705862cd2739ace5d40627b637d1","sha1":"9444466483e85e8eb468d2f74d59147db55ad9c9","sha256":"1deaffa7de4f78eacd76940fe41d3b256f82ec00ae786a83377bf4f4d44c1ce3","sha512":"e966401f073426efbb7106d1e70dca131ab4e21fbe516aa5e7d4a1d7d612f32a005b778e35c5b13ff4a3ba135da2144132eb0582c4a2bcef82901bfdcf9fbe28","ssdeep":"384:6IbbiZvx60t3QOIW2nYAOU8i2z9NIzyQo1BA+6ZOKwYB18WID:6sb2pvudFO59NDQo1BA+6ZOAID","tlshash":"ab92e0615a8e8f86751e5ffaaa968c7c46982bd40c40ffc09235c8ffc9411ce09ca99d","first_seen":"2026-07-14T14:58:23.716612Z","last_seen":"2026-07-14T14:58:46.212917Z","times_seen":2,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E5%A6%82%E4%BD%95%E8%A7%A3%E5%86%B3SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%8D%A1%E9%A1%BF%E6%88%96%E9%97%AA%E9%80%80%E9%97%AE%E9%A2%98%EF%BC%9F1-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.919Z","timestamp":1784041028919,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E5%A6%82%E4%BD%95%E8%A7%A3%E5%86%B3SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%8D%A1%E9%A1%BF%E6%88%96%E9%97%AA%E9%80%80%E9%97%AE%E9%A2%98%EF%BC%9F1-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:34:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da8f5-4ade\"\r\nexpires: Thu, 13 Aug 2026 14:57:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19166,"size_decoded":18728,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"fbc000a8521b41296f1c21fae05d07bd","sha1":"49468fc4e82e912da6eb03c6b0e3fd8c67e79c24","sha256":"12d0922684bf4a93feb79ab582252356a5e5a429dd899ea58b1136ef3e44235a","sha512":"3868e43f590460c94b8a1f987fa501201a75168c51f9077bc465f93d5f9e5628aaee53e0815eafcf37962b4d79e8e7890591477b196de820ef90aae7db2df6e0","ssdeep":"384:6XVKWwPz1wLgDpxG2SydehfonmK7WKUeeu2hzRTax8r/yj46/vBiejzM:6FKW6mgDahyi6mKSKL2hzO8byj46/oH","tlshash":"5982d09f8ca82a70c515ce34f9135cbe6b0644d80942bb9fa933ccfb6b304902e1929d","first_seen":"2026-07-14T14:58:23.718303Z","last_seen":"2026-07-14T14:58:46.225102Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E4%BC%81%E4%B8%9A%E7%89%88%EF%BC%9A%E5%9B%A2%E9%98%9F%E6%B2%9F%E9%80%9A%E4%B8%8E%E5%8D%8F%E4%BD%9C%E6%8C%87%E5%8D%974-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.921Z","timestamp":1784041028921,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E4%BC%81%E4%B8%9A%E7%89%88%EF%BC%9A%E5%9B%A2%E9%98%9F%E6%B2%9F%E9%80%9A%E4%B8%8E%E5%8D%8F%E4%BD%9C%E6%8C%87%E5%8D%974-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:37:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da9b4-741e\"\r\nexpires: Thu, 13 Aug 2026 14:57:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29726,"size_decoded":29316,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"be80f0544e22ad48f782a1ef2748a604","sha1":"c4aab122646d2eb7ed0fb05a093d2f82e192d26f","sha256":"afbc81a27e5cdd930b3eb10f48b9e4c8e9886541e871dc0b2a196ec78512f502","sha512":"89eacfbecdd533c0eb3b18d09266cd477dfaf1869d7157c59445ff88f801cc6a052dcab84507bfe895ea82e7f552c72c39b552510f1e44ba06fa6468b4d31a11","ssdeep":"768:6246dwmDHGk4IsToxXzh9QWt9/avZ66qYMNtoB/v:62bH7VQgXt9QWQ66q2Bv","tlshash":"87d2e153c2521388e54efdb0a612bc7d8054ab8db751a8073676883c3bff7c6792486d","first_seen":"2026-07-14T14:58:23.719918Z","last_seen":"2026-07-14T14:58:46.221657Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogtag/style.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.263Z","timestamp":1784041028263,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogtag/style.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089af-184d\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6221,"size_decoded":2670,"mime_type":"text/css","magic":"ASCII text, with very long lines (598), with CRLF line terminators","md5":"1c8082eda5b327551e019f2b8a0d25d5","sha1":"b6825c02bcde800867034504558e6163728e800c","sha256":"75d3ceec0517b0dc213b73d64e07d4959d24aeae320f1bff8e82c4b207b76e40","sha512":"13308f9873cd5534d428bd1b2f06745c614e88784b8bab5713af4375b41782a61a0ee91f65ea715b3b96d0d99d0b7682815ed20da708e903b43b3996917d288c","ssdeep":"192:D8WDZWhU/jQUzOLSbe1zsjVrFJHVRhyBuLdQn5/:24Cio/","tlshash":"2dd1874e8d5832c4c771a7a96be63640de5a814b9f4704e0fd8e92450f7a4ac17f2fd8","first_seen":"2025-07-05T17:30:02.864538Z","last_seen":"2026-07-14T14:58:46.203356Z","times_seen":23,"resource_available":false,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/swiper-bundle.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.269Z","timestamp":1784041028269,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/swiper-bundle.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-40f1\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16625,"size_decoded":5040,"mime_type":"text/css","magic":"ASCII text, with very long lines (2255), with CRLF line terminators","md5":"9b51d6d2d6952aa25f82f8ca7b554248","sha1":"200213e32684c2763055cb3ea619e43f3f8224d4","sha256":"fea92ac7d0d96150b7009efdc9951dd72cf8251236a40bd865b2f5b394fce704","sha512":"908114ad7f4479d9d96b61ea0ffe176bad9136dc9e9f0775c684de79521ef5c0bd99fe6225660f5224572c6b922939b6fc580042621700269e57e6ecbb7dd5cd","ssdeep":"384:p9UbeSvZk3a+bsyNEmPwjcGIYhptsyqB1il:pCb/vZk3a+VNEmPwjcGIYhptsyqil","tlshash":"377235581720242363764f7d1ba19678af6888d24f4349adf2c0dd44e7fb8f8a21eda5","first_seen":"2023-04-09T10:25:11Z","last_seen":"2026-07-14T15:30:20.511038Z","times_seen":1221,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.457Z","timestamp":1784041028457,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 28 Aug 2023 17:14:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64ecd5ef-15601\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":87553,"size_decoded":31160,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-07-14T17:17:17.428172Z","times_seen":967726,"resource_available":true,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/jquery.smartmenus.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.464Z","timestamp":1784041028464,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/js/jquery.smartmenus.js?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-b767\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46951,"size_decoded":12413,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"efcff8546ef4a6330321fdc755a75229","sha1":"2398c0f4f8d06009fb78e1801efb1bea6f3a71ce","sha256":"752345e29ce9c0ceb0c303f00a21c79991457e250fbd17d36150c41608f1bca8","sha512":"588b259158f14070fce9724b2dfd3814aae9725088cab8809bca04f345274ac27f21136f44cfe63a80f69142304ee05e28e64c63414ba7a6bc9ff8a4d3239070","ssdeep":"768:NE7foC3IGcqeO1fqnS0BaVftMib9oAaIQuIK7/0p9hxKMlL17tZAlnOsmKOKn3:NJJwK295afKMF17LDKOKn3","tlshash":"df2373ca735d712f82e633b4853f556aeb3dd072c20250bffcae6998656046813b0db9","first_seen":"2023-03-10T02:43:07Z","last_seen":"2026-07-14T15:30:20.477281Z","times_seen":1259,"resource_available":true,"data":null}},"time_used":402,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":402,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E5%A6%82%E4%BD%95%E7%94%A8SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%BF%AB%E9%80%9F%E6%90%9C%E7%B4%A2%E5%8E%86%E5%8F%B2%E6%B6%88%E6%81%AF%EF%BC%9F1-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.924Z","timestamp":1784041028924,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E5%A6%82%E4%BD%95%E7%94%A8SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%BF%AB%E9%80%9F%E6%90%9C%E7%B4%A2%E5%8E%86%E5%8F%B2%E6%B6%88%E6%81%AF%EF%BC%9F1-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:45:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699dab90-622d\"\r\nexpires: Thu, 13 Aug 2026 14:57:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25133,"size_decoded":24899,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"570b41e9750b71988f764d1c0b92ae75","sha1":"a781353be9eaffd164e6c49e7a3fe33f0863a87d","sha256":"c5d861bcf83bd08d79c098d21793bbe4fcd383c3c1830948470f0722b35a4a5e","sha512":"11cc09bef35e16134a9211812ff62ea3a63d7c4ecc765529b8627e5dc57bea567ea874c8d097e183c6f3e07cb5b7c1d684ca2f6c86c2b880273b9b78693bcb36","ssdeep":"384:6Z/XDFYJG8ervJargbDXx2I/xCsPFPSBJIG+onsB4lVAgkOFsQq9gWxJtH3FdhT:61ZYijJhDXU3sP8n1silCpHxxvXFrT","tlshash":"0cb2d05300436fd36c1f8fd5be66502a0fcbfe58961b6faa0532ccc999483569add11c","first_seen":"2026-07-14T14:58:23.726977Z","last_seen":"2026-07-14T14:58:46.199811Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E4%B8%8E%E7%A4%BE%E4%BA%A4%E5%AA%92%E4%BD%93%E8%81%94%E5%8A%A8%EF%BC%9A%E5%88%86%E4%BA%AB%E5%88%B0%E6%9C%8B%E5%8F%8B%E5%9C%883-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.925Z","timestamp":1784041028925,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E4%B8%8E%E7%A4%BE%E4%BA%A4%E5%AA%92%E4%BD%93%E8%81%94%E5%8A%A8%EF%BC%9A%E5%88%86%E4%BA%AB%E5%88%B0%E6%9C%8B%E5%8F%8B%E5%9C%883-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:49:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699dac56-4b21\"\r\nexpires: Thu, 13 Aug 2026 14:57:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19233,"size_decoded":18424,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"fab284ed323caca126ddbfd61272b8d0","sha1":"fa1d44d579aac4a38819d24f4a91323a3e38e462","sha256":"afad434632114a60ed1bd209cdfd2b733e69c8211f39ddd1c5a777ed067af6ea","sha512":"62ee46912fd7c326d172adc69b17ca6ce593eed3d2044eab133f244ea438bcb1251ef1213e28012e76c502217c9feba2b096be874d58c5039ab3f6e56b9286c3","ssdeep":"384:6h7GjCT5LP/w+EP3Qiza0ygtOB4Lx6FGrlR:6h62T5LP/5EPAizegvwIb","tlshash":"f0829d53ed148683261887b4be034dbd9f0d071ced9a3dde54318e973e366aa9c8d40e","first_seen":"2026-07-14T14:58:23.729206Z","last_seen":"2026-07-14T14:58:46.211519Z","times_seen":2,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E6%8F%90%E9%86%92%E4%BC%98%E5%85%88%E7%BA%A7%EF%BC%9A%E7%A1%AE%E4%BF%9D%E9%87%8D%E8%A6%81%E6%B6%88%E6%81%AF%E4%B8%8D%E8%A2%AB%E9%94%99%E8%BF%874.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.926Z","timestamp":1784041028926,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E6%8F%90%E9%86%92%E4%BC%98%E5%85%88%E7%BA%A7%EF%BC%9A%E7%A1%AE%E4%BF%9D%E9%87%8D%E8%A6%81%E6%B6%88%E6%81%AF%E4%B8%8D%E8%A2%AB%E9%94%99%E8%BF%874.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:32:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da86d-f75f\"\r\nexpires: Thu, 13 Aug 2026 14:57:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":63327,"size_decoded":49212,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [\n- TIFF image data, big-endian, direntries=3], baseline, precision 8, 1024x969, components 3","md5":"479354e596e86c355a6b26b9574c6fe3","sha1":"16bfaad2e828c1fdd10d06c78e25f0f47b4d7bf5","sha256":"66036efb40882e65a6deb05797b39d7a3e1db774c7645a69e7800c79feff3bcc","sha512":"b2cbb208b398202d90701badf4d4a9b9d9d9c7a4b6200c1c269784acbc53754e80818e6851325b8ecd31649dd810db3ffc0b5505692c4ece92f55478c09cdeae","ssdeep":"1536:sRLgIAaDNIW/RPJvr3zlx9wwkL/5s1qK4UioF+lV:6gIA+Nv/19rjlLn+e1tdS","tlshash":"1c53ae4b5c1a4bd2e04d47f4bd430d69aeab272cf40a7abf315e4dcbbf512412d8612a","first_seen":"2026-07-14T14:58:23.731586Z","last_seen":"2026-07-14T14:58:46.20051Z","times_seen":2,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/fonts/inter/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.988Z","timestamp":1784041028988,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/fonts/inter/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/wp-content/fonts/eb4d8c5691c3f55639714cbac9cc01b8.css?ver=20201110\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48256\r\nlast-modified: Mon, 02 Feb 2026 11:26:45 GMT\r\netag: \"698089f5-bc80\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48256,"size_decoded":48696,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48256, version 1.0","md5":"260c81a4759baf163c025001c4f27872","sha1":"f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298","sha256":"3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62","sha512":"9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9","ssdeep":"768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw","tlshash":"be2302df9e4d72d29271267045338383798e2d8a50aae7a1061c0fe6de05b69d31fb9c","first_seen":"2025-05-30T10:47:22.433446Z","last_seen":"2026-07-14T17:01:48.410522Z","times_seen":22201,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/navigation.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.459Z","timestamp":1784041028459,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/js/navigation.js?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-938\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2360,"size_decoded":1407,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"ee5d178484a55e36788dcb5d14b52d01","sha1":"12dabdf70a87227c544d7aa52e8bbae78d90f90f","sha256":"a32e10b91b2fffdb8ca7dac1c2feb1569b5d43a929218e16b65d3a0b36cad43d","sha512":"e15263c212e2807cf884b3a50218560210e1d1261dbcf2ba6693b6c4269d3d16d307fa7ee8eb5cd8aacd7963f4258bf28a91468902c60f1b42e27a4a56f1b298","ssdeep":"","tlshash":"8d41fec73a8b323b96ca2354a17d64527a38c172d70a7d26b4b8d2852860c0506fdfcc","first_seen":"2023-03-07T01:38:19Z","last_seen":"2026-07-14T15:30:20.533464Z","times_seen":1427,"resource_available":true,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/jquery.cookie.min.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.465Z","timestamp":1784041028465,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/js/jquery.cookie.min.js?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-515\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1301,"size_decoded":1225,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1266), with CRLF line terminators","md5":"23d834419c7ccced820e192be7081228","sha1":"ec662cb3d06ee33848a3fa19585f1f31d4475ec5","sha256":"239011ddd00345611806d77467c81dc5a4c90d15fec6f66357671b73920287dc","sha512":"e8f79309ed49af97ea34f684e1fc512a8717edc0a017f79e7c5bf2e24c9dd3f0aa889f6ca5349b367a95f10bee50869ea075b3b7c543e5d66558bf0e44ec16e1","ssdeep":"","tlshash":"b32120987089b815521b9a35677f109bb078ab55d09c40e9c3d1e4e03f708820d72ef9","first_seen":"2023-03-07T01:19:12Z","last_seen":"2026-07-14T15:30:20.495311Z","times_seen":1789,"resource_available":true,"data":null}},"time_used":401,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":401,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E7%AB%AF%E5%88%B0%E7%AB%AF%E5%8A%A0%E5%AF%86%E5%A6%82%E4%BD%95%E5%B7%A5%E4%BD%9C%EF%BC%9FSafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8%E6%9C%BA%E5%88%B6%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%904-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.917Z","timestamp":1784041028917,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E7%AB%AF%E5%88%B0%E7%AB%AF%E5%8A%A0%E5%AF%86%E5%A6%82%E4%BD%95%E5%B7%A5%E4%BD%9C%EF%BC%9FSafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8%E6%9C%BA%E5%88%B6%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%904-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:20:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da5ba-be59\"\r\nexpires: Thu, 13 Aug 2026 14:57:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48729,"size_decoded":49127,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"3be61a11c230eabecbf8b8603d6baefc","sha1":"b89db5190bc294b99378681bd39ed48835298ebb","sha256":"ed976558b0256d9b0bd0c6b433e7b8fc0b64688a16222e28726f62447b9c5b28","sha512":"0c0bf874e6ad3f7c13311f68e0fb2687cb03480fdf0f3e8acffd55f42841cd2be41937ea31cf540e0b55b2a5a865b5857ac96dc5fe1e79663a1363b636f3f7f9","ssdeep":"768:6D0KeAMheKU4HykZYX+pnRLWVPLhVePJRQJgIvNo1YLYY:6QcMU11OLqhrMJwVcY","tlshash":"3a23f1e072685af094e2ecbc8a1397cdba91dd1d20ce8175de73dd8963949c3681cf98","first_seen":"2026-07-14T14:58:23.737455Z","last_seen":"2026-07-14T14:58:46.220462Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%B8%B8%E8%A7%81%E9%97%AE%E9%A2%98%EF%BC%9A%E7%99%BB%E5%BD%95%E5%A4%B1%E8%B4%A5%E3%80%81%E6%B6%88%E6%81%AF%E5%BB%B6%E8%BF%9F%E5%A6%82%E4%BD%95%E8%A7%A3%E5%86%B3%EF%BC%9F1-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.923Z","timestamp":1784041028923,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%B8%B8%E8%A7%81%E9%97%AE%E9%A2%98%EF%BC%9A%E7%99%BB%E5%BD%95%E5%A4%B1%E8%B4%A5%E3%80%81%E6%B6%88%E6%81%AF%E5%BB%B6%E8%BF%9F%E5%A6%82%E4%BD%95%E8%A7%A3%E5%86%B3%EF%BC%9F1-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:43:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699daaf7-5d39\"\r\nexpires: Thu, 13 Aug 2026 14:57:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23865,"size_decoded":23365,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"fab8d04d775191219ea26c9780467737","sha1":"b5ecffd09bd11c5353d0397041ca9006abd4b9cb","sha256":"70d42197e92883a002e5a208ab0b53c17e73b13df80912ac192632dd3f483fc8","sha512":"693a3722191536e4fc6a28eaf0831aceba403b8ad3bcff7e4873453f66767408b0c6d105beac882a2d119b31160c23cb7c146e4046c2140ffe5cbdf023788caf","ssdeep":"384:6JMGx169iCjokGemGt8vZD7IER8kxYUVlN60bWtzvXoPAOCypKttFZYRWhkfPbzP:6Jbe9iCjo9emGi1HmqV65tzv/NEcszDz","tlshash":"44b2d02be60a73d9e8363d7a9d4a5c0e16517b65fc49a38311389dcfbcc46c188cca6c","first_seen":"2026-07-14T14:58:23.740667Z","last_seen":"2026-07-14T14:58:46.210833Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/webfonts/fa-solid-900.woff2","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.982Z","timestamp":1784041028982,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/wp-content/themes/blogdata/css/all.css?ver=7.0.1\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 156496\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\netag: \"698089b0-26350\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":156496,"size_decoded":156938,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 156496, version 773.768","md5":"6c4eee562650e53cee32496bdfbe534b","sha1":"1aae708e3b94ee981b452a918d28ed037fbb5e18","sha256":"9fc85f3a4544ab0d570c7f8f9bbb88db8d92c359b2707580ea8b07c75673eae2","sha512":"ebcb5a2e2a908228f77ecd03b45491778cad73ddc39fa3a6334b129aaf9fa36c16c0307aeaad74d77f616b5b34aac52d91e9f4816945253dc9a826ddd71f4d12","ssdeep":"3072:OvM6gZMLmY8uGpjVnlooQ+GQs8jic0f/KkMdE:OU65LoP5QSsuic0f/cdE","tlshash":"8ce31200d620498d9978fd5b2a1fa1ffa7a939c95ed210bad3c30cb93257143bbc2556","first_seen":"2023-12-02T04:06:15Z","last_seen":"2026-07-14T17:16:10.016217Z","times_seen":46122,"resource_available":false,"data":null}},"time_used":395,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":243,"receive":152,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T14:57:06.576Z","timestamp":1784041026576,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:07 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlink: \u003chttps://safew.email/index.php/wp-json/\u003e; rel=\"https://api.w.org/\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"WordPress:7.0.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]}],"data":{"size":76531,"size_decoded":15310,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (9840), with CRLF, LF line terminators","md5":"261d839e6ba34fdb6db2f6b021681709","sha1":"d950d568bbfd6b66790f7e75b9c7c34ab0c3d711","sha256":"7b1aedd42bde035c3a8d98dcbf230c3e4ce01e8d70c801bea0febbd48a0d0e64","sha512":"1217653a6677814cdd032886962df28e50371f9453178cb0e84537592621dc37eb437c0a79b573ed663e228a1f7e7e03e84517517ed4a77a1562b0a1ae36bfed","ssdeep":"1536:DsujypDoWZb77dsu8orQkJFn8dDDXQXoUBHVBD63hzd:DsuOBoWZb77dsuQ4qXQXNBH363z","tlshash":"ba73a63256db14bf123a83ac94602b5ceaa59107ce7a0ac0b0fc855e5fe9f9d15c734e","first_seen":"2026-07-14T14:58:23.743956Z","last_seen":"2026-07-14T14:58:46.222653Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1476,"timings":{"blocked":-1,"dns":89,"connect":152,"send":0,"wait":1077,"receive":0,"ssl":158},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/woo.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.266Z","timestamp":1784041028266,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/woo.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-43ac\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17324,"size_decoded":3864,"mime_type":"text/css","magic":"ASCII text, with very long lines (385), with CRLF line terminators","md5":"506c9dbcfeb35fc5f8b495c8bc1de000","sha1":"c9ca02e57e8e1e78d681f5ca91385a54916f8127","sha256":"e617631c12047be81f193309ed1b53089b50feedd00dafb8a1ba558cb31ce37a","sha512":"922b89f501e627c5960762600845a66bcaa171634a1549f48ca2250c9958ef0820c3ce8d6e5e59323041690afb9d0ad85806848a31d53ff0be7630709a2eea07","ssdeep":"192:j3EXP7dHtQS0qIjLz1Hr3b3yaM53cQa+jzbyg6uHNAlIrihKX75Ax:j3EXP7dH+XdrQzjzNG45C","tlshash":"ea7212afe57008c437e9b5e87f743ac27d9440796b4a0175fda16b2c83c649e362278e","first_seen":"2026-01-01T15:02:18.09834Z","last_seen":"2026-07-14T14:58:46.229825Z","times_seen":24,"resource_available":false,"data":null}},"time_used":299,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":299,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/colors/default.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.267Z","timestamp":1784041028267,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/colors/default.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-c1da\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49626,"size_decoded":7566,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"0999ebc79b61f8b372f9c80eaab9b90c","sha1":"d78b47a80c7a2870441b88db45ac79ecf26dcf64","sha256":"354f64124a6afb0499d9be470c50542b8e336d9dde13c7d78c137f0e47d223e8","sha512":"698b44052f15b053f91a5de8a2da323efb17e8701aab7401c8fd934a14f7eb847c80281cad0b70bb74f3ee7cbb70ccfdd94f451a6412d3d01adb0b73f2195228","ssdeep":"192:bBekOXuCTdr+0/9LzE9zhKjydYVXexYgyw5MQHRIpuk42M8a0v0iITd3Ot31dTfB:adC0/9wXKVOTSpvVTqbSQKsdS2tvD0EE","tlshash":"282302afe1a359ff279baaec1774d4806f4400a89e085ba8b595455401cc3fd3f2b6ce","first_seen":"2026-02-05T05:44:56.120445Z","last_seen":"2026-07-14T14:58:46.214105Z","times_seen":5,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Josefin+Sans%3A300%2C400%2C500%2C600%2C700%2C800%2C900\u0026subset=latin%2Clatin-ext","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.449Z","timestamp":1784041028449,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:24 GMT","end":"Mon, 14 Sep 2026 08:37:23 GMT"},"fingerprint":{"sha1":"85:D0:EC:C2:01:33:25:23:96:FB:2B:54:90:54:84:07:0A:49:1F:03","sha256":"9D:7C:1C:9C:6A:25:1E:17:E0:DC:FD:42:95:CA:47:3D:C1:9C:20:FB:22:47:02:E3:27:EC:7C:62:03:30:83:BA"}}},"request":{"raw":"GET /css?family=Josefin+Sans%3A300%2C400%2C500%2C600%2C700%2C800%2C900\u0026subset=latin%2Clatin-ext HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 14 Jul 2026 14:57:08 GMT\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6060,"size_decoded":1223,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"eeee41ac5a7193b7745d68286213fd92","sha1":"14dda657c213aaa9fddcbaee7a9eeb5d3d6c4889","sha256":"4faa66459ba1881bbad95b91009fc3b032fb39e8e0e38cf8255b25170625c447","sha512":"59afbd4688337052ab939c2d607243d6bf4c1c719b2fe1eb44fbb7629e4dcc8b258b3c0599c71cfde7720ffb45bb6051e01bd220a736a206e9049c6b005c2a5f","ssdeep":"96:cEOWxeOWxNJc+uwOWx7NDEOLxeOLxNJc+uwOLx7NDEOgxeOgxNJc+uwOgx7NDEO5:cAIj1zpRj0z2ejfzPXjGzksj5U","tlshash":"4cc1dfe1042ae6a4a7831ec213ce3d329e8ee15974518875affe18ccec5ac2d636574c","first_seen":"2025-10-01T17:26:09.908648Z","last_seen":"2026-07-14T15:30:20.54132Z","times_seen":40,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":-1,"dns":3,"connect":17,"send":0,"wait":35,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogtag/style.css?ver=1.0","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.453Z","timestamp":1784041028453,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogtag/style.css?ver=1.0 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089af-184d\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6221,"size_decoded":2670,"mime_type":"text/css","magic":"ASCII text, with very long lines (598), with CRLF line terminators","md5":"1c8082eda5b327551e019f2b8a0d25d5","sha1":"b6825c02bcde800867034504558e6163728e800c","sha256":"75d3ceec0517b0dc213b73d64e07d4959d24aeae320f1bff8e82c4b207b76e40","sha512":"13308f9873cd5534d428bd1b2f06745c614e88784b8bab5713af4375b41782a61a0ee91f65ea715b3b96d0d99d0b7682815ed20da708e903b43b3996917d288c","ssdeep":"192:D8WDZWhU/jQUzOLSbe1zsjVrFJHVRhyBuLdQn5/:24Cio/","tlshash":"2dd1874e8d5832c4c771a7a96be63640de5a814b9f4704e0fd8e92450f7a4ac17f2fd8","first_seen":"2025-07-05T17:30:02.864538Z","last_seen":"2026-07-14T14:58:46.203356Z","times_seen":23,"resource_available":false,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E5%A4%9A%E8%AE%BE%E5%A4%87%E7%99%BB%E5%BD%95%EF%BC%9A%E5%A6%82%E4%BD%95%E5%90%8C%E6%97%B6%E5%9C%A8%E6%89%8B%E6%9C%BA%E5%92%8C%E7%94%B5%E8%84%91%E4%B8%8A%E4%BD%BF%E7%94%A8SafeW2-720x380.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.925Z","timestamp":1784041028925,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E5%A4%9A%E8%AE%BE%E5%A4%87%E7%99%BB%E5%BD%95%EF%BC%9A%E5%A6%82%E4%BD%95%E5%90%8C%E6%97%B6%E5%9C%A8%E6%89%8B%E6%9C%BA%E5%92%8C%E7%94%B5%E8%84%91%E4%B8%8A%E4%BD%BF%E7%94%A8SafeW2-720x380.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 14 Feb 2026 11:33:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69905d9a-5948\"\r\nexpires: Thu, 13 Aug 2026 14:57:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22856,"size_decoded":20635,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 720x380, components 3","md5":"8ba9c0554284591a9744e687b738128c","sha1":"6e7adf1c69beb21ae10ab3b10d1d8ec541080fe5","sha256":"e82fd52f79e5b155139ecc51a9afcb59e3f0c7b65a182bea0b7c935190d984de","sha512":"c4ee92a20ca23daab83cf6ab4588f7393081e0b4c85361500208ac64f3f1bb3574e9bf8cbb0b4fb7b00f502357c6fae40f21e7c3e29f74c0fd4683268a59dd2e","ssdeep":"384:6kfxESJSo299OOwE+1FMejG7sreymhWhTdiDAdwQZfJhe1FZrFikJNBeuOYPJOUD:6kf5JStDvwEbe9jhTLlZBhu/HeupE0/Z","tlshash":"dea28d072d28c3829858aad57e174d3e0b176b2c6da275ef2536dd8b3f000a46d9f14f","first_seen":"2026-07-14T14:58:23.750473Z","last_seen":"2026-07-14T14:58:46.213519Z","times_seen":2,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/uploads/2026/02/%E7%AB%AF%E5%88%B0%E7%AB%AF%E5%8A%A0%E5%AF%86%E5%A6%82%E4%BD%95%E5%B7%A5%E4%BD%9C%EF%BC%9FSafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8%E6%9C%BA%E5%88%B6%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%904.jpg","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.928Z","timestamp":1784041028928,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E7%AB%AF%E5%88%B0%E7%AB%AF%E5%8A%A0%E5%AF%86%E5%A6%82%E4%BD%95%E5%B7%A5%E4%BD%9C%EF%BC%9FSafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8%E6%9C%BA%E5%88%B6%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%904.jpg HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:09 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:20:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da5b9-2cc38\"\r\nexpires: Thu, 13 Aug 2026 14:57:09 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":183352,"size_decoded":173470,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [\n- TIFF image data, big-endian, direntries=3], baseline, precision 8, 1024x976, components 3","md5":"ab57c5346f64b323ddd93af633f05851","sha1":"72aafb7b18641400fb22195e330f07bddc57ce21","sha256":"cbc25a298fd9205b931aebb1605da4310179f4c123f4bebe48291482cf62054d","sha512":"854c570e2bea36b4f958721ce9f8ab434cebd19f13d0782e00419bd2c2ce0f5fa7c3a01e19d63b0399e96f04ea3a31515584e608592492ffb0e97fce6394a827","ssdeep":"3072:OMBHAc5voROmzESdqJBhGN2POpVGl1Wro04qRgggyjmctH65UqU3vPFuT10k5JG:HZrmzt6O/pV8Wk09mg5UxsvPF+p5JG","tlshash":"c304129e397513affa4eca7544811d1a7840cf251b9edc8d728d1e0be7a23c9b2242d3","first_seen":"2026-07-14T14:58:23.752056Z","last_seen":"2026-07-14T14:58:46.209606Z","times_seen":2,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/josefinsans/v34/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.978Z","timestamp":1784041028978,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/josefinsans/v34/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://safew.email\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28528\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 02:37:08 GMT\r\nexpires: Fri, 09 Jul 2027 02:37:08 GMT\r\ncache-control: public, max-age=31536000\r\nage: 476401\r\nlast-modified: Thu, 04 Sep 2025 17:12:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":28528,"size_decoded":29341,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28528, version 1.0","md5":"4316a5aa6c074dfbfdcfb60023405316","sha1":"0ff5ba86b13131add1157861d2fbc830432f94a4","sha256":"21efe1559a026f9ad7f880772917faa3a621186688e8e79e0568e4308c0bafa9","sha512":"3b136256cb1ab4ecd3b36d52ca9508cc45019a37ae2497388a3f1f7af7b29feb5df1adef533cb5a47b172c6e95c54e84254163d604b5ace76986f1d0da5152ec","ssdeep":"384:CVyhp48UoZw2f7NoTIwNviYobclKfQ9rSuNsztMKBSn8/Ex20kAOc0fqvV3dLnXs:BAU5NMcbl4JShaaOIEGAQ+TXKve+Tgi","tlshash":"a4d2e13745891dbad2720db2abc0adc0b600883bf7197d7ed2cf80836d2eca45d5264b","first_seen":"2025-06-03T08:29:57.615496Z","last_seen":"2026-07-14T17:02:18.838195Z","times_seen":9761,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":2,"connect":32,"send":0,"wait":19,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/wp-core.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.265Z","timestamp":1784041028265,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/wp-core.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-47fc\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18428,"size_decoded":4603,"mime_type":"text/css","magic":"ASCII text, with very long lines (491), with CRLF line terminators","md5":"ad8b9e457f4bbee091d0e82dec4c14a7","sha1":"d4c46d55e2c263837036e68e723ac24e70ba08aa","sha256":"f985412be71f8c4f0dddae18a60802e9a9f247eb9cacca0f554eef7061fd0d7e","sha512":"8f6e7349f69d559620bf5834f34b5a7cbd26d1716ff1d055fcbe3e4b5194742e01aa0bcbdf4b98389606da7b67cd8c2a13c808ecb8f16e864a68f35b1977a91f","ssdeep":"384:VB4ZnLgYfjnXHky044WU3+1mkPkvlCeOu9bzrbjLj+:spey0LWU3hkPkmj","tlshash":"54827768af4125885736db39dfe4c121eacc1293ce0250f8fe56d2448fb9d9845aef8d","first_seen":"2025-07-29T15:24:31.710124Z","last_seen":"2026-07-14T14:58:46.228973Z","times_seen":44,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":300,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/css/bootstrap.css?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.451Z","timestamp":1784041028451,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/css/bootstrap.css?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"69802be6-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-07-14T17:03:58.427857Z","times_seen":312206,"resource_available":true,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safew.email/wp-content/themes/blogdata/js/custom.js?ver=7.0.1","fqdn":"safew.email","domain":"safew.email","tld":"email"},"ip":{"addr":"38.63.176.141","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safew.email/","date":"2026-07-14T14:57:08.466Z","timestamp":1784041028466,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safew.email","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:42:07 GMT","end":"Thu, 03 Sep 2026 13:42:06 GMT"},"fingerprint":{"sha1":"3F:D8:B9:22:1C:DC:E8:F3:08:2F:41:95:1B:4C:C6:9D:02:76:14:B1","sha256":"BE:EF:0D:2B:22:F4:FE:94:8B:35:53:BB:8A:45:EC:C8:41:8F:23:CE:91:C0:65:77:DD:10:0C:09:4C:F2:4F:52"}}},"request":{"raw":"GET /wp-content/themes/blogdata/js/custom.js?ver=7.0.1 HTTP/1.1\r\nHost: safew.email\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safew.email/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:57:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Feb 2026 11:25:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698089b0-26ef\"\r\nexpires: Wed, 15 Jul 2026 02:57:08 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9967,"size_decoded":3005,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"0468c7ab2184247a95c5343e2e6a2b4e","sha1":"172d3c10d342d31447695ba8cc8f313b155c863e","sha256":"2cb6296d0113ef14cbcd69f1afcf00585ca14b88b4b9980604bbe8963c8d4f78","sha512":"c340b76b8253f1de084ed562a457afb56f35f147ea4c9729dcfc3a06a8329b8b9a88737457dbe8d39b01d160d1d7abc578dad3dec0cbb11c3fdcfc7daded8619","ssdeep":"192:tQvZ3uFQhO/8lXExRLLq/xmuoaL9DVSuSnLOQH8Bs9dFgkrOu:oZ+cO/8lXE7Lq/xmuoaLNVSuSnLOQH8s","tlshash":"452232496d10157605fbd37aab2fa388fb33015b924291567cbd8a491f70fa102edecd","first_seen":"2026-01-21T21:51:15.084696Z","last_seen":"2026-07-14T14:58:46.209023Z","times_seen":29,"resource_available":true,"data":null}},"time_used":400,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":400,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safew.email","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}