{"report_id":"9a8c3eab-642d-4cf0-a7f7-e5c7666ee22c","version":6,"status":"done","tags":[],"date":"2026-04-08T22:42:16Z","url":{"schema":"http","addr":"myfreeemailsignature.com/","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"ip":{"addr":"173.28.194.34","port":0,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"myfreeemailsignature.com/","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"title":"My Free Email Signature Generator. No Login, No Paywall.","dom":{"size":9627,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (4536)","md5":"25363be4815305f654110e1e70332cc6","sha1":"c3bf862eaabf9a0f672628611331d2e0a456a26d","sha256":"d233e88974ab5b592d2fca6c6373af1ae4257ea1284221dda5d7721a65e415f4","sha512":"14d49e1c45f7f9449d81c72f5fe200b67577712113b7b76410fd02d429e94997d8b247024f8b3c46e80964556d3630cf3f1584183b6b5d457843abe68ada1d7e","ssdeep":"192:RTAZrRCbg11NkkCbg1CZTAKzlRCbg11NkkCbg1CvMCkCaO:R0Z1Mg1ckMg140KzfMg1ckMg1h2","tlshash":"e1120df36dca237d1a83325b632b3d487e42d20b691a4654787cd6924f2e9b81d98c98","dom_hash":"domhashdc54fbe1ae197f2d0347c91caad45e38","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"myfreeemailsignature.com/","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"ip":{"addr":"173.28.194.34","port":0,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-13T22:42:16Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":17}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"www.highperformanceformat.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"www.highperformanceformat.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"www.highperformanceformat.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"pl29077335.profitablecpmratenetwork.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"pl29077336.profitablecpmratenetwork.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"sleepoverlimitprofound.com","ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2026-02-26","domain_rank":0,"first_seen":"2026-03-13T13:00:58.430087Z","last_seen":"2026-04-04T12:17:19.92878Z","alert_count":10,"request_count":5,"received_data":19295,"sent_data":7190,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-04-05T22:20:18.514512Z","alert_count":0,"request_count":1,"received_data":13321,"sent_data":487,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-04-05T22:16:34.770209Z","alert_count":0,"request_count":4,"received_data":197468,"sent_data":2256,"comment":"","tags":null,"fingerprints":null},{"fqdn":"sourshaped.com","ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-09-03","domain_rank":0,"first_seen":"2025-10-06T14:35:38.581947Z","last_seen":"2026-04-05T06:17:23.599344Z","alert_count":2,"request_count":1,"received_data":796,"sent_data":503,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"pl29077336.profitablecpmratenetwork.com","ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":1,"request_count":1,"received_data":48726,"sent_data":479,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"protrafficinspector.com","ip":{"addr":"63.183.72.212","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2025-06-18","domain_rank":614186,"first_seen":"2025-07-25T22:45:21.95813Z","last_seen":"2026-04-08T20:17:12.531035Z","alert_count":0,"request_count":3,"received_data":2112,"sent_data":1392,"comment":"","tags":null,"fingerprints":null},{"fqdn":"kettledroopingcontinuation.com","ip":{"addr":"172.240.127.234","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-09-01","domain_rank":196057,"first_seen":"2025-07-30T15:18:19.355595Z","last_seen":"2026-04-02T03:46:40.470382Z","alert_count":12,"request_count":3,"received_data":15512,"sent_data":5693,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"myfreeemailsignature.com","ip":{"addr":"173.28.194.34","port":443,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":4,"received_data":312112,"sent_data":1938,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.highperformanceformat.com","ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-10-15","domain_rank":366864,"first_seen":"2024-10-23T18:32:34.138968Z","last_seen":"2026-04-04T03:40:57.474179Z","alert_count":6,"request_count":2,"received_data":104380,"sent_data":938,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"pl29077335.profitablecpmratenetwork.com","ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2026-03-17","domain_rank":0,"first_seen":"2026-04-08T22:42:17.574579Z","last_seen":"2026-04-08T22:42:17.574579Z","alert_count":1,"request_count":1,"received_data":94574,"sent_data":481,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"preferencenail.com","ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-07-01","domain_rank":20606,"first_seen":"2025-07-08T12:55:47.271261Z","last_seen":"2026-04-02T07:26:46.379779Z","alert_count":2,"request_count":1,"received_data":85956,"sent_data":422,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"flushpersist.com","ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2025-07-01","domain_rank":23810,"first_seen":"2025-07-08T10:43:12.76905Z","last_seen":"2026-04-02T07:26:45.488504Z","alert_count":2,"request_count":1,"received_data":530,"sent_data":776,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.storageimagedisplay.com","ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"domain_registered":"2024-09-13","domain_rank":170153,"first_seen":"2024-09-13T12:56:32Z","last_seen":"2026-04-02T23:23:31.915234Z","alert_count":0,"request_count":5,"received_data":268736,"sent_data":2525,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"myfreeemailsignature.com/assets/index-BXntelsB.js","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"ip":{"addr":"173.28.194.34","port":443,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b2f48c39a5820e47abce45930e1aa51","sha1":"1b5a4dd6902eebd7eda22c6c920d1310ed6bd5fe","sha256":"be50e88a915d9163de19ce7f1b051daf6787dd49f3d8e4d816956509be20e040","sha512":"9f3527874c926e248b96a2281891981ae4cf057fdde43dbe6e44b7beaf6f924e7aea5223fdcfabdfd043b217c1d4e078eae6b2b84aef4c640950fcc33784003e","ssdeep":"3072:vU6RG1SEbutKZHwcxx9Xu7oJqZodCiewZE2htaxIiVawSYcjAw2kACdTqaP6:B6fcKZHwoDXu7oJq1nKUm2x","tlshash":"b5545de871a5b6a9aba306b5507f501a733d1d179c0d8470f124f86a36b8409b27bffc","size":283094,"data":"","first_seen":"2026-04-08T22:42:22.518407Z","last_seen":"2026-04-08T22:42:22.518407Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"myfreeemailsignature.com/","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"ip":{"addr":"173.28.194.34","port":443,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c56b3304e1765a9b020a8f8338c0d5f","sha1":"3d79c8b3fc82eeaaec68664c816398ab49b17bd0","sha256":"c64609feada0f82b22341be87528f72ae79ad8b8b6ad89b2bb7e3d1baa6b85de","sha512":"1bb00afdaa847c9b1d8f758ba1c0574797c9b15386b5ed29d98208e5531fdaf9eef941eb1e81cf633a90db51c54e879773d978fbfdd12948d6e1165d9fdc1fb4","ssdeep":"","tlshash":"c8b0929da04574ca8092193b22680889a614da1b2252483164bee888102e8a5dcabe50","size":109,"data":"","first_seen":"2026-04-08T22:42:22.551924Z","last_seen":"2026-04-08T22:42:22.551924Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.highperformanceformat.com/5b06e8eaa68d6786efe42f5486d1340d/invoke.js","fqdn":"www.highperformanceformat.com","domain":"highperformanceformat.com","tld":"com"},"ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6fa7edd8345e4806e0d8a41bf44ec451","sha1":"2caec1905119d512526807d8e4c865fff4034e5a","sha256":"e1db929d826970a93e721080f5e6127ddbd419749b7ad57c577fd4e1660bba8a","sha512":"bfd2149de8d5f0da13c341d49caab321a301c2aa8d93af2c8978e43f33fc61d070156f7a148c34366aa4359353ed360655e67d4eb16da46622addb3c5e744c19","ssdeep":"768:xILsjP3R5MaFvQ003E9ZnANn7aw++nxKDpOI6sxt4U2CNFQb+DNI7bR:x/MaFvQfOsKpN6+2hbYUF","tlshash":"fb33c78c7fe1f0e416567c73323f60abf11a1c12958cd48cd906e4ae6ae8795e937b18","size":51335,"data":"","first_seen":"2026-04-08T22:42:22.536455Z","last_seen":"2026-04-08T22:42:22.536455Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","size":85379,"data":"","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-07-27T03:59:48.330787Z","times_seen":24988,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"eval","is_inline":false,"md5":"ccb38cc42dd91698f691a6caf67835f9","sha1":"93bd8ac363559185a96fa1248e35429df8a1c30a","sha256":"8adffcad7445ad72be3b6501d27292c7d08a678105de60ce39cab7c3c47fed0c","sha512":"3be7e8e3384a6d82b29be6e0bc48985b357a34b1d72088a32a781cd270e777b155a36ed7e07527419cddf0e53a7e41b96b94cba40603c41841588632cc3f6987","ssdeep":"","tlshash":"fb31d8b3b59a236e4ac77353621f3a447d85d6475c0e53a44538a6d246298f8196cc88","size":1712,"data":"","first_seen":"2026-04-08T22:42:22.554025Z","last_seen":"2026-04-08T22:42:22.554025Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"eval","is_inline":false,"md5":"d3a373386b4b3d0ee46c27947121574b","sha1":"a47b1d163955df6669bea360a71bb1c9babcce18","sha256":"509aeed18339e395cbe1ae4a9f413bca52be86c343072f5d8394392eff310de1","sha512":"6163660ab28fc438c6bd5e2b768c78c0364bb62af4c316ad2140b7df07fb1d971198182bcd60645a8408a60bbb6a33492ccdba3c6db4d78afb021045845087e0","ssdeep":"","tlshash":"4621c6b3a29b03de1bc36247a62b28156ed65d89b81f5264067c60b2871f4742a1c4f8","size":1442,"data":"","first_seen":"2026-04-08T22:42:22.555356Z","last_seen":"2026-04-08T22:42:22.555356Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"myfreeemailsignature.com/","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"ip":{"addr":"173.28.194.34","port":443,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c56b3304e1765a9b020a8f8338c0d5f","sha1":"3d79c8b3fc82eeaaec68664c816398ab49b17bd0","sha256":"c64609feada0f82b22341be87528f72ae79ad8b8b6ad89b2bb7e3d1baa6b85de","sha512":"1bb00afdaa847c9b1d8f758ba1c0574797c9b15386b5ed29d98208e5531fdaf9eef941eb1e81cf633a90db51c54e879773d978fbfdd12948d6e1165d9fdc1fb4","ssdeep":"","tlshash":"c8b0929da04574ca8092193b22680889a614da1b2252483164bee888102e8a5dcabe50","size":109,"data":"","first_seen":"2026-04-08T22:42:22.551924Z","last_seen":"2026-04-08T22:42:22.551924Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.highperformanceformat.com/5b06e8eaa68d6786efe42f5486d1340d/invoke.js","fqdn":"www.highperformanceformat.com","domain":"highperformanceformat.com","tld":"com"},"ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6fa7edd8345e4806e0d8a41bf44ec451","sha1":"2caec1905119d512526807d8e4c865fff4034e5a","sha256":"e1db929d826970a93e721080f5e6127ddbd419749b7ad57c577fd4e1660bba8a","sha512":"bfd2149de8d5f0da13c341d49caab321a301c2aa8d93af2c8978e43f33fc61d070156f7a148c34366aa4359353ed360655e67d4eb16da46622addb3c5e744c19","ssdeep":"768:xILsjP3R5MaFvQ003E9ZnANn7aw++nxKDpOI6sxt4U2CNFQb+DNI7bR:x/MaFvQfOsKpN6+2hbYUF","tlshash":"fb33c78c7fe1f0e416567c73323f60abf11a1c12958cd48cd906e4ae6ae8795e937b18","size":51335,"data":"","first_seen":"2026-04-08T22:42:22.536455Z","last_seen":"2026-04-08T22:42:22.536455Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pl29077335.profitablecpmratenetwork.com/f6/f3/4b/f6f34bba5142bf660fca81640b5656ad.js","fqdn":"pl29077335.profitablecpmratenetwork.com","domain":"profitablecpmratenetwork.com","tld":"com"},"ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1d146b02aef4bf82d909441c3ff9f283","sha1":"829b7ad69c647712aa71139d787e1357b376325c","sha256":"c4301526d5106616ebf648211e27845be58dfaac698c50582e525a6921abc54d","sha512":"aae801c87addce7955b23389d0cdb6ccd1da2cdb879d4d91349f7483cd6f6e6a736ae194823279fd0d41bc5f855ed88ae859dc6438fcdaa280ed1f9d3272bce2","ssdeep":"1536:7x1PMZPem5Kvg/+UriOXwaHe4J+LgFW8Xmj8sV:YGv4WUR+1sF69V","tlshash":"5593e68c3fc1f0a513a5203b222f714ef0994d95546ce468f783f56a2f7ca4ae536b98","size":93709,"data":"","first_seen":"2026-04-08T22:42:22.538318Z","last_seen":"2026-04-08T22:42:22.538318Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pl29077336.profitablecpmratenetwork.com/8c1b7af45264715c06aed705ff8c1fb1/invoke.js","fqdn":"pl29077336.profitablecpmratenetwork.com","domain":"profitablecpmratenetwork.com","tld":"com"},"ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"bb74948f75b5f8bcc03083d30c4d5fb6","sha1":"ce39a389c5884612fb5c5d6fb87e2dcb24cccabb","sha256":"2f3cf8cd9a014569f0f986e306f0fa35ee3c8c475c3cab50c29108c80fc07d8f","sha512":"86b10e40bcd21b70acab25f037f5169a2622b698a79ed057e788c392e9a3c40653bbc084ec57c8ef6d38a8eeb0dd118ce81a60a708f2da638432edd764630efb","ssdeep":"768:3JEOlhPyuK4VtK9OoQjPKpDHuiN1JyKxYNo0E6bO8xckTbkcA:+tg+pDBWucE7AFkD","tlshash":"cf23c6c87e40f23c16676076623fc50fe22e5f11978cfa98e167d5a82b6cf09993a705","size":47861,"data":"","first_seen":"2026-04-08T22:42:22.550091Z","last_seen":"2026-04-08T22:42:22.550091Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"05a6d44809df52bd332a88704ba46186","sha1":"05b80a5bbd89a33f2bc477cd4dc3e0fe6bf9d501","sha256":"e1b19c8ae40aa07bc8d8be2829abf44835cb59305d67f4d386fa8f8b2fc23964","sha512":"420cb78e329fa3761f663e1b3703f96b8fc9b35f9ec5e1642097d8277078caee88fb8119416e5cb80355c7a5c59915f5df60044fab92cfcf7790da2b7da08018","ssdeep":"","tlshash":"70c08c882e083828e6403a0f970a1385f8c1a30b62740520543cc18070990bb8c23800","size":145,"data":"","first_seen":"2026-04-08T22:42:22.556628Z","last_seen":"2026-04-08T22:42:22.556628Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"658ea691876d9a132a6555bb1a9715f0","sha1":"2dbd067e4dd7290160a0383f36684234f8ee030e","sha256":"bb2bb3db830d932acf5c1dcd21ac8baaaa3f7e8c63a7badc598adc682c03c733","sha512":"ccbfc815fa6d48dfa16acff4c4bad1f5fedd334dfb2d65752b794c1386bb2d417f30d46bee3a13ad0c52eaa3cf5a1383949ec6cfa59bd6b02c7e17309acfd225","ssdeep":"96:AqMfaBdozaBCRCoM1drRdUNeWV1Nk/8CoM1drRdUNeWVe1jDMCfMEDaH:ATAKzlRCbg11NkkCbg1CvMCkCaH","tlshash":"1fa10cf36dca13bd1983225f633b3d487e41d10b580a9615b86cd6924f2a9b81da8cdc","size":5081,"data":"","first_seen":"2026-04-08T22:42:22.557912Z","last_seen":"2026-04-08T22:42:22.557912Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sleepoverlimitprofound.com/ren.gif?sid=H4sIAAAAAAAC_1RSv4_jRBQeh4gCCgSHqChcIAToNms7jh2zBdKJgwZ2gTu0Eohifjk3xPb4PHaSTbXHIQqqLSjocL7s3lIgBBIVQieU5SokJFwgUtw2iD8AkK5GyUVasOTvvTffaPR9771PZtU56aCiy7fe1FOVJHS713HsF_ZVJvTY2LvXbdfpODv2vsoCf8eerKAYvex2_Y7zov265EO97Tmu47iOa7-mChnryfaahcq_itxO5HR8r-P2fEyK_9emsmCoBTE6J09BieaJP-L3ofgCWfrNq9IMS51fvppWCS11gZE4fTcbZnqcIb1I48JCnJ1ubkObhpDPW9DZ6cYB9Oh45QBMNaT1zH2w7HQjE2x08lApSyAzMPE4xqMFZLKAogtwfRtK_EoALrC7hyy9s6uLMT14yNIV25D2g3-gxg1p338aWfr1lURN7Gs6qUqlM4NJXENNFlCDBfLqDOW0BTU-Ay8_ghK_kO0HbyBLj_dMoqFEvXav4gWosVCtfmWhii1UuYVULG3f6fvcpd0gjgQPHZ_6vpDMifqe49CIh6j4LShxBF4cIi8OMVRHMDdqGGHBlA2x3j7ESNQnIjGeqe-IxFTM3URvE7v1XJeDGT3R5UBmBLQ4QiHqY5XfNLfBy0fm09iIuV4BZWU9p0zUcyVKguLm8jnHjUQQ-95WEEpvK5SeuxXxoLsV8tDzgrBPpS9n-Tl5ctU_6_vn72Eol3afuyyksd_zAj90e9wJqBSh04vjPndj5sKoGsq01q2ZqobsX7qKXDXk8t8zMHoGk5yBq2dBKxd0XIPeqDHNfkgP4kJKowYZLatCDmQmi9VCdbhOIXSNvGyjPLBmyTm5NH_n-pUf12P94Pd7kPxnsvnAixp5UeND9RPBILn17V5eqlRN6WrO10paykdBVUMe--tTcNWQS3e_WK9c76U_wfNDmPziLaMJWN5CoggSeXFOWQ3zn5pd5DPzMQZFGyxpz1lStI9ZUiSfNeS9L19Za13B3YawHQtGLe2ex7pBvx_IOBBxV3S9roh6jox8GgV-5PdQmkb9tvzu3wAAAP__4qYxqv8DAAA=","fqdn":"sleepoverlimitprofound.com","domain":"sleepoverlimitprofound.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.351Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sleepoverlimitprofound.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 07:46:44 GMT","end":"Wed, 27 May 2026 07:46:43 GMT"},"fingerprint":{"sha1":"15:D7:39:A0:7C:1A:88:D2:D0:5B:FB:FE:9B:83:77:FF:65:A9:D6:86","sha256":"B8:A7:1B:87:3D:C6:BE:32:67:55:36:2E:23:EB:C8:0E:C9:BA:FD:04:BD:2A:D3:3D:46:3E:0E:07:24:9F:01:A2"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1RSv4_jRBQeh4gCCgSHqChcIAToNms7jh2zBdKJgwZ2gTu0Eohifjk3xPb4PHaSTbXHIQqqLSjocL7s3lIgBBIVQieU5SokJFwgUtw2iD8AkK5GyUVasOTvvTffaPR9771PZtU56aCiy7fe1FOVJHS713HsF_ZVJvTY2LvXbdfpODv2vsoCf8eerKAYvex2_Y7zov265EO97Tmu47iOa7-mChnryfaahcq_itxO5HR8r-P2fEyK_9emsmCoBTE6J09BieaJP-L3ofgCWfrNq9IMS51fvppWCS11gZE4fTcbZnqcIb1I48JCnJ1ubkObhpDPW9DZ6cYB9Oh45QBMNaT1zH2w7HQjE2x08lApSyAzMPE4xqMFZLKAogtwfRtK_EoALrC7hyy9s6uLMT14yNIV25D2g3-gxg1p338aWfr1lURN7Gs6qUqlM4NJXENNFlCDBfLqDOW0BTU-Ay8_ghK_kO0HbyBLj_dMoqFEvXav4gWosVCtfmWhii1UuYVULG3f6fvcpd0gjgQPHZ_6vpDMifqe49CIh6j4LShxBF4cIi8OMVRHMDdqGGHBlA2x3j7ESNQnIjGeqe-IxFTM3URvE7v1XJeDGT3R5UBmBLQ4QiHqY5XfNLfBy0fm09iIuV4BZWU9p0zUcyVKguLm8jnHjUQQ-95WEEpvK5SeuxXxoLsV8tDzgrBPpS9n-Tl5ctU_6_vn72Eol3afuyyksd_zAj90e9wJqBSh04vjPndj5sKoGsq01q2ZqobsX7qKXDXk8t8zMHoGk5yBq2dBKxd0XIPeqDHNfkgP4kJKowYZLatCDmQmi9VCdbhOIXSNvGyjPLBmyTm5NH_n-pUf12P94Pd7kPxnsvnAixp5UeND9RPBILn17V5eqlRN6WrO10paykdBVUMe--tTcNWQS3e_WK9c76U_wfNDmPziLaMJWN5CoggSeXFOWQ3zn5pd5DPzMQZFGyxpz1lStI9ZUiSfNeS9L19Za13B3YawHQtGLe2ex7pBvx_IOBBxV3S9roh6jox8GgV-5PdQmkb9tvzu3wAAAP__4qYxqv8DAAA= HTTP/1.1\r\nHost: sleepoverlimitprofound.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; u_pl28976837=1; nlec8c1b7af45264715c06aed705ff8c1fb1=[5941311,6437633]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 0\r\nHost: sleepoverlimitprofound.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 377c1521c2ca9c47596d70976930d8cb\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T04:20:17.182226Z","times_seen":17555689,"resource_available":true,"data":null}},"time_used":660,"timings":{"blocked":278,"dns":1,"connect":93,"send":0,"wait":95,"receive":0,"ssl":190},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sleepoverlimitprofound.com/ren.gif?sid=H4sIAAAAAAAC_1RSv4_jRBQe70UUUCA4REXhAiFAt1nbceyYLZBOHDSwC9yhlUAU88u5IbbH57GTbKo9DlFQbUFBh_Nl95YCIZCoEDqhLFchIeECkeLS8BcA0tUouUgLI837Md_o6fvee59OqyVpo6KLt9_SE5UkdKfbduwXD1Qm9MjYezds12k7u_aBygJ_1x6vTDF8xe34becl-w3JB3rHc1zHcR3Xfl0VMtbjnTUKlX8due3Iafte2-36GBf_z01lwVALYrgkT0OJ5sk_4w-g-BxZ-u1r0gxKnV-5llYJLXWBoTh7LxtkepQhvQjjwkKcnW1-Q5uGkC-2oLOzjQLo4clKAZhqyNazD8Cysw1NsOHpI6YsgczAxBMYDeeQyRyKzsH1HSjxGwG4wN4-svTuni5G9PARSldoQ1oP_4EaNaT14Blk6TdXEzW2r-ukKpXODMZxDTWeQ_XnyKtzlJMtqNE5ePkxlPiV7Dx8E1l6sm8SDSXqtXoVz0GNhWp1lYUqtlDlFlKxsH2n53OXdoI4Ejx0fOr7QjIn6nmOQyMeouK3ocQxeHGEvDjCQB3D3KxhhAVTNsR65whDUZ-KxHimvisSUzF3472N79QzXfan9FSXfZkR0OIYhahPVH7L3AEvL80msREzvTKUlfWMMlHPlCgJiluL5x03EkHse9tBKL3tUHrudsSDznbIQ88Lwh6VvpzmS_LUqn_WDy_cx0Au7B53WUhjv-sFfuh2uRNQKUKnG8c97sbMhVE1lNlat2aiGnJw-Rpy1ZArf0_B6DlMcg6ungOtXNBRDXqzxiT7MT2MCymN6me0rArZl5ksVgvV5jqF0DXysoXy0JomS3J59u6Nqz-tx_rhH_cg-S9kc8CLGnlR4yP1M0E_uf3dfl6qVE3oas7XS1rKx0BVQx7_6zNw1ZDL975cr1z35SV4fgSTX9QymoDll5AogkRevFNWw_wnZxfx1HyCftECS1ozlhStE5YUyecNef-rV1dc768JN4TtWjBqYXc91gl6vUDGgYg7ouN1RNR1ZOTTKPAjv4vSNOr3xff_BgAA__8HNwmT_wMAAA==","fqdn":"sleepoverlimitprofound.com","domain":"sleepoverlimitprofound.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.354Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sleepoverlimitprofound.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 07:46:44 GMT","end":"Wed, 27 May 2026 07:46:43 GMT"},"fingerprint":{"sha1":"15:D7:39:A0:7C:1A:88:D2:D0:5B:FB:FE:9B:83:77:FF:65:A9:D6:86","sha256":"B8:A7:1B:87:3D:C6:BE:32:67:55:36:2E:23:EB:C8:0E:C9:BA:FD:04:BD:2A:D3:3D:46:3E:0E:07:24:9F:01:A2"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1RSv4_jRBQe70UUUCA4REXhAiFAt1nbceyYLZBOHDSwC9yhlUAU88u5IbbH57GTbKo9DlFQbUFBh_Nl95YCIZCoEDqhLFchIeECkeLS8BcA0tUouUgLI837Md_o6fvee59OqyVpo6KLt9_SE5UkdKfbduwXD1Qm9MjYezds12k7u_aBygJ_1x6vTDF8xe34becl-w3JB3rHc1zHcR3Xfl0VMtbjnTUKlX8due3Iafte2-36GBf_z01lwVALYrgkT0OJ5sk_4w-g-BxZ-u1r0gxKnV-5llYJLXWBoTh7LxtkepQhvQjjwkKcnW1-Q5uGkC-2oLOzjQLo4clKAZhqyNazD8Cysw1NsOHpI6YsgczAxBMYDeeQyRyKzsH1HSjxGwG4wN4-svTuni5G9PARSldoQ1oP_4EaNaT14Blk6TdXEzW2r-ukKpXODMZxDTWeQ_XnyKtzlJMtqNE5ePkxlPiV7Dx8E1l6sm8SDSXqtXoVz0GNhWp1lYUqtlDlFlKxsH2n53OXdoI4Ejx0fOr7QjIn6nmOQyMeouK3ocQxeHGEvDjCQB3D3KxhhAVTNsR65whDUZ-KxHimvisSUzF3472N79QzXfan9FSXfZkR0OIYhahPVH7L3AEvL80msREzvTKUlfWMMlHPlCgJiluL5x03EkHse9tBKL3tUHrudsSDznbIQ88Lwh6VvpzmS_LUqn_WDy_cx0Au7B53WUhjv-sFfuh2uRNQKUKnG8c97sbMhVE1lNlat2aiGnJw-Rpy1ZArf0_B6DlMcg6ungOtXNBRDXqzxiT7MT2MCymN6me0rArZl5ksVgvV5jqF0DXysoXy0JomS3J59u6Nqz-tx_rhH_cg-S9kc8CLGnlR4yP1M0E_uf3dfl6qVE3oas7XS1rKx0BVQx7_6zNw1ZDL975cr1z35SV4fgSTX9QymoDll5AogkRevFNWw_wnZxfx1HyCftECS1ozlhStE5YUyecNef-rV1dc768JN4TtWjBqYXc91gl6vUDGgYg7ouN1RNR1ZOTTKPAjv4vSNOr3xff_BgAA__8HNwmT_wMAAA== HTTP/1.1\r\nHost: sleepoverlimitprofound.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; u_pl28976837=1; nlec8c1b7af45264715c06aed705ff8c1fb1=[5941311,6437633]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 1\r\nHost: sleepoverlimitprofound.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 5b5d895d9d48e0585704d578bf859b7f\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T04:20:17.182226Z","times_seen":17555689,"resource_available":true,"data":null}},"time_used":177,"timings":{"blocked":81,"dns":0,"connect":0,"send":0,"wait":96,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sleepoverlimitprofound.com/ntv.json?key=8c1b7af45264715c06aed705ff8c1fb1\u0026vstc=4\u0026rb=","fqdn":"sleepoverlimitprofound.com","domain":"sleepoverlimitprofound.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.798Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sleepoverlimitprofound.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 07:46:44 GMT","end":"Wed, 27 May 2026 07:46:43 GMT"},"fingerprint":{"sha1":"15:D7:39:A0:7C:1A:88:D2:D0:5B:FB:FE:9B:83:77:FF:65:A9:D6:86","sha256":"B8:A7:1B:87:3D:C6:BE:32:67:55:36:2E:23:EB:C8:0E:C9:BA:FD:04:BD:2A:D3:3D:46:3E:0E:07:24:9F:01:A2"}}},"request":{"raw":"GET /ntv.json?key=8c1b7af45264715c06aed705ff8c1fb1\u0026vstc=4\u0026rb= HTTP/1.1\r\nHost: sleepoverlimitprofound.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nOrigin: https://myfreeemailsignature.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Type: application/json\r\nContent-Length: 10002\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://myfreeemailsignature.com\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\nset-cookie: pdhtkv=true; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\nuncs=1; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\npdhtkv49=true; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\nuncs49=1; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\nu_pl28976837=1; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\nnlec8c1b7af45264715c06aed705ff8c1fb1=[5941311,6437633]; expires=Wed, 08 Apr 2026 22:42:01 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 35\r\nHost: sleepoverlimitprofound.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 99cd1c1ec33a61bc92a533dc35a952a5\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":14349,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ff4160da1f7d12bdbf5f53c719f07a4c","sha1":"8cd3d46ce7b944c06c5a151b406aa969d07d119a","sha256":"68724c33207ddd756153e12565cfff1d593b77a9a71a6f40f324c64b21990de3","sha512":"b38f41aabf18d1279f1a54dc69ae4b0d3df6933a01a47d4695cf2ead2581d21509def929fecb135356e26d3641bac720e9a4cf3b59f480b2702990a942874550","ssdeep":"384:tN4LwCM3mS5ew8Y61cE6M+/SIgxml6L07bzfrICU1I4yP/2:tNaM3moeIeLr4SIgxmG0+T9","tlshash":"4952bff6d90838bf4ff1a9ce282b31998fd219a7d02dab5114bde9ce2970ed1071e151","first_seen":"2026-04-08T22:42:22.511573Z","last_seen":"2026-04-08T22:42:22.511573Z","times_seen":1,"resource_available":false,"data":null}},"time_used":815,"timings":{"blocked":342,"dns":57,"connect":92,"send":0,"wait":128,"receive":1,"ssl":192},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"protrafficinspector.com/stats","fqdn":"protrafficinspector.com","domain":"protrafficinspector.com","tld":"com"},"ip":{"addr":"63.183.72.212","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"statistics.it.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 30 Mar 2026 00:00:00 GMT","end":"Tue, 13 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D9:BA:08:A9:13:92:91:6D:E6:8A:40:1F:41:40:EF:3B:C9:D6:8D:1C","sha256":"E7:E2:E4:A5:62:0D:1F:DE:F7:00:2C:C3:99:91:FE:06:F0:63:82:CF:61:C8:DE:94:F3:2A:75:79:79:E4:67:CD"}}},"request":{"raw":"GET /stats HTTP/1.1\r\nHost: protrafficinspector.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nOrigin: https://myfreeemailsignature.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:41:55 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 40\r\nserver: fasthttp\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://myfreeemailsignature.com\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\nset-cookie: uid_id2=f59ab984-ce3c-45b6-b79e-b4495b738bda:3:1; expires=Sat, 05 Apr 2036 22:41:55 GMT; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"376bdfe340ae3781fe34936d025cdddc","sha1":"04db0893b0221d55ff84c12d977813cd8fce2853","sha256":"43891568b206bb8da20530cfe05ae16d71d8e15368b701f1c3b8746cfcd48614","sha512":"bcdf22bae2004100406859f9462af0a2ad4e83ba7344f6db029064670efaf2daf5e07fda0e3f3df489b0cfde3b0287b10db833e3d5d92a90d83f076430bc524d","ssdeep":"","tlshash":"bd90040d014407c40110d1403d1c071174754d03c37d0fc10d15c45c4304741dd7540d","first_seen":"2026-04-08T22:42:22.513953Z","last_seen":"2026-04-08T22:42:22.513953Z","times_seen":1,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":75,"dns":1,"connect":21,"send":0,"wait":21,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kettledroopingcontinuation.com/impr.gif?sid=H4sIAAAAAAAC_1RTTYgcRRSu3uxNSIgRQRScQxCFzGxVd3V3tbkFoxfdlSSygqf6nZTb093p6p6ZndPGiOc9ePDY82Y3e1BEQTyIoMyKl4iwfRAGzF68ehCFgDeZzcBiHd5PfUXxvsf3fTKtT1EPar549518YtOUb4Q93Hl122YqH7nO5p0OwT18vbNts4he74yXoRy-TgLaw6913tJyJ9_wMcGYYNJ505ba5OONMxRs8UVCegnuUb9HQgrj8v-9qz1w3AM1PEXPglXtpT_MB2DlHLLBV29ot1PlxbWbgzrlVV7CUB29l-1k-SiDwXlpSg9MdrR6DblrEfpsDfLsaMUA8uHBkgEI26K15x-DyI5WY4IYHj6dVKSgMxDqGRgN56DTY7B8DjJ_AFadIACpYHMLssHDzbwc8d2nKF-iLVp_8g_YUYvWHz8H2eDLG6kdd27naV3ZPHMwNg3Y8Rxsfw5FfQzVZA3s6Bhk9RFY9SvaePI2ZIODLZfmYNXiqsI-ibQvuywOcZf6nHVFyExXc2MCyRKpYna2ImvmwN0a1M6D2npQGw_qwoOBWnQoZlQSHkQmUTLGlFOqtMAJ8zHmiYyhlvfBqn2Q5R4U5R7s2E9b5F34_eSFz1vkXf6zRejfW-DuLr6NhW-wTyhJNBE8CLXWBGuifM4SxXAYRySJEoZjSjQWiTZU8yTQNCRMJolh1E8Ej0kQEKUF1zyUkdZURL4mOGCh9gMsaEASTlhsCAtjEytBGPZJEgpsGE6wwhEVsc9MYCiJJA0INlgxnRCfBESEMZWYC-mrSHGmsWYJA6c8cBWCoWoOVep81zxUqasFWWV_lYNmllf9KT_Mq77OEPByH0rVHNjinnsAsrowmxinZvkycFE1My5UM7OqQlDeW1zFJFGRoX43Sojpxn5MukL6smsw4TwkTJlQTYtTdHmpFO-7V36GHb3ohAJHmmnOI6aimEXaaOqbkLJIkYBiBc42YN0acOfBxLZo-8pNKGyLrv09BcGPwaXHIO1LwOsXgY9mNGLA70KEYZJ9P9g1pdbO9jNe1aXu60yXS__0ZD4AlTdQVOtQ7XrT9BRdmd26c-PHMxW_nL8PWj5CqwOybKAoG_jQ_oSgn97_equo7MBO-FLWtyteaQ-4Pbl4EaRt0frmL2f-urR5CWSxB644_8nlCESBILUIUn1-z0UDTj_64a9VL87rqfsY-qUHIvVmIi3RgUjLdB-cXXRMoH2JMYsjEjCjSUCVNCGjiYo4DgINlWvtb4tv_gsAAP__iofNTtgEAAA=","fqdn":"kettledroopingcontinuation.com","domain":"kettledroopingcontinuation.com","tld":"com"},"ip":{"addr":"172.240.127.234","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.708Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kettledroopingcontinuation.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 21:44:44 GMT","end":"Sun, 24 May 2026 21:44:43 GMT"},"fingerprint":{"sha1":"4C:9B:DC:71:4E:6F:7E:04:5A:F2:21:54:DA:06:E8:A0:34:82:CB:86","sha256":"23:FF:1C:4C:C9:81:C7:C0:A0:EB:2B:81:77:68:85:F3:47:33:36:DE:71:C4:DB:B4:66:77:5F:24:24:B9:A7:89"}}},"request":{"raw":"GET /impr.gif?sid=H4sIAAAAAAAC_1RTTYgcRRSu3uxNSIgRQRScQxCFzGxVd3V3tbkFoxfdlSSygqf6nZTb093p6p6ZndPGiOc9ePDY82Y3e1BEQTyIoMyKl4iwfRAGzF68ehCFgDeZzcBiHd5PfUXxvsf3fTKtT1EPar549518YtOUb4Q93Hl122YqH7nO5p0OwT18vbNts4he74yXoRy-TgLaw6913tJyJ9_wMcGYYNJ505ba5OONMxRs8UVCegnuUb9HQgrj8v-9qz1w3AM1PEXPglXtpT_MB2DlHLLBV29ot1PlxbWbgzrlVV7CUB29l-1k-SiDwXlpSg9MdrR6DblrEfpsDfLsaMUA8uHBkgEI26K15x-DyI5WY4IYHj6dVKSgMxDqGRgN56DTY7B8DjJ_AFadIACpYHMLssHDzbwc8d2nKF-iLVp_8g_YUYvWHz8H2eDLG6kdd27naV3ZPHMwNg3Y8Rxsfw5FfQzVZA3s6Bhk9RFY9SvaePI2ZIODLZfmYNXiqsI-ibQvuywOcZf6nHVFyExXc2MCyRKpYna2ImvmwN0a1M6D2npQGw_qwoOBWnQoZlQSHkQmUTLGlFOqtMAJ8zHmiYyhlvfBqn2Q5R4U5R7s2E9b5F34_eSFz1vkXf6zRejfW-DuLr6NhW-wTyhJNBE8CLXWBGuifM4SxXAYRySJEoZjSjQWiTZU8yTQNCRMJolh1E8Ej0kQEKUF1zyUkdZURL4mOGCh9gMsaEASTlhsCAtjEytBGPZJEgpsGE6wwhEVsc9MYCiJJA0INlgxnRCfBESEMZWYC-mrSHGmsWYJA6c8cBWCoWoOVep81zxUqasFWWV_lYNmllf9KT_Mq77OEPByH0rVHNjinnsAsrowmxinZvkycFE1My5UM7OqQlDeW1zFJFGRoX43Sojpxn5MukL6smsw4TwkTJlQTYtTdHmpFO-7V36GHb3ohAJHmmnOI6aimEXaaOqbkLJIkYBiBc42YN0acOfBxLZo-8pNKGyLrv09BcGPwaXHIO1LwOsXgY9mNGLA70KEYZJ9P9g1pdbO9jNe1aXu60yXS__0ZD4AlTdQVOtQ7XrT9BRdmd26c-PHMxW_nL8PWj5CqwOybKAoG_jQ_oSgn97_equo7MBO-FLWtyteaQ-4Pbl4EaRt0frmL2f-urR5CWSxB644_8nlCESBILUIUn1-z0UDTj_64a9VL87rqfsY-qUHIvVmIi3RgUjLdB-cXXRMoH2JMYsjEjCjSUCVNCGjiYo4DgINlWvtb4tv_gsAAP__iofNTtgEAAA= HTTP/1.1\r\nHost: kettledroopingcontinuation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=d0216e2c-8750-42a8-b58f-eaff3c89cd78:2:1; ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyODk3NjgzOCwiayI6IjViMDZlOGVhYTY4ZDY3ODZlZmU0MmY1NDg2ZDEzNDBkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo1NzA2NTY1LCJwaWQiOjI5NDU2OTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MjgsImFpZCI6MjcsInB0Ijo0LCJwayI6ImkwM2FtYmQ5c3YiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6MjY2NTYxMTE1LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTM2OTI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEzNC4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiY3QiOnsiaWQiOjMxNDMyNDQsIm4iOiJPc2xvIn0sInJnIjp7ImlkIjoxODQ0LCJuIjoiT3NsbyBDb3VudHkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJpd2YiOnRydWUsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9teWZyZWVlbWFpbHNpZ25hdHVyZS5jb20vIiwidHoiOjIsImlkdWMiOjAsImFyIjpbXX19.br-wo88PVSga9-zG_zO01_T9uQHR4l7E8mfEikjxUb8; pdhtkv=true; uncs=1; pdhtkv27=true; uncs27=1; u_pl28976838=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nset-cookie: iprc_l+3d0eb991e651f48902540e2e08ebc35a=2060120; expires=Wed, 22 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\niprc_l:2060120=1; expires=Wed, 22 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 3\r\nHost: kettledroopingcontinuation.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 262d52e300bf0cacac8533091cdb56a9\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T04:20:17.182226Z","times_seen":17555689,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"myfreeemailsignature.com/assets/index-BXntelsB.js","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"ip":{"addr":"173.28.194.34","port":443,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:54.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"myfreeemailsignature.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 19:07:38 GMT","end":"Sun, 05 Jul 2026 19:07:37 GMT"},"fingerprint":{"sha1":"96:E7:43:B2:64:81:A6:D1:D8:B3:96:76:EC:B7:7D:A2:50:9E:C2:0D","sha256":"5A:45:7E:5F:CA:C0:D7:9F:D8:3F:6C:B9:CF:E5:02:6F:47:0D:0C:FB:DD:09:BF:21:13:69:8D:92:D4:05:25:3B"}}},"request":{"raw":"GET /assets/index-BXntelsB.js HTTP/1.1\r\nHost: myfreeemailsignature.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 08 Apr 2026 22:41:54 GMT\r\ncontent-type: text/javascript\r\nvary: Origin\r\nlast-modified: Tue, 07 Apr 2026 03:03:27 GMT\r\netag: W/\"283094-1775531007449\"\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":283094,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (37509)","md5":"7b2f48c39a5820e47abce45930e1aa51","sha1":"1b5a4dd6902eebd7eda22c6c920d1310ed6bd5fe","sha256":"be50e88a915d9163de19ce7f1b051daf6787dd49f3d8e4d816956509be20e040","sha512":"9f3527874c926e248b96a2281891981ae4cf057fdde43dbe6e44b7beaf6f924e7aea5223fdcfabdfd043b217c1d4e078eae6b2b84aef4c640950fcc33784003e","ssdeep":"3072:vU6RG1SEbutKZHwcxx9Xu7oJqZodCiewZE2htaxIiVawSYcjAw2kACdTqaP6:B6fcKZHwoDXu7oJq1nKUm2x","tlshash":"b5545de871a5b6a9aba306b5507f501a733d1d179c0d8470f124f86a36b8409b27bffc","first_seen":"2026-04-08T22:42:22.518407Z","last_seen":"2026-04-08T22:42:22.518407Z","times_seen":1,"resource_available":true,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"protrafficinspector.com/stats","fqdn":"protrafficinspector.com","domain":"protrafficinspector.com","tld":"com"},"ip":{"addr":"63.183.72.212","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.793Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"statistics.it.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 30 Mar 2026 00:00:00 GMT","end":"Tue, 13 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D9:BA:08:A9:13:92:91:6D:E6:8A:40:1F:41:40:EF:3B:C9:D6:8D:1C","sha256":"E7:E2:E4:A5:62:0D:1F:DE:F7:00:2C:C3:99:91:FE:06:F0:63:82:CF:61:C8:DE:94:F3:2A:75:79:79:E4:67:CD"}}},"request":{"raw":"GET /stats HTTP/1.1\r\nHost: protrafficinspector.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nOrigin: https://myfreeemailsignature.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:41:55 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 40\r\nserver: fasthttp\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://myfreeemailsignature.com\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\nset-cookie: uid_id2=a9c6fd19-2ea2-4d16-b706-48789dc725db:2:1; expires=Sat, 05 Apr 2036 22:41:55 GMT; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"a1c76a5888d65410385acd4135a27bf1","sha1":"41ef453c3e078cabd68c54ec7e9bf8caac6f7d86","sha256":"c2dec78fa565b17fbf3dd495e928d062ab8424380188af5076b650aeccc7965a","sha512":"033a7d254451c0293e928d045d1cab8e09b0f14ca00aea12bbe1e53f249cd4ed3fa2de1e76a241d8ed67de0ca2cc199f208808395ece327da44f84948ef2ef81","ssdeep":"","tlshash":"3c9004c33f53f00f34030305057431700cfd5f1051c555171c505411d341c747c41540","first_seen":"2026-04-08T22:42:22.525548Z","last_seen":"2026-04-08T22:42:22.525548Z","times_seen":1,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":88,"dns":1,"connect":22,"send":0,"wait":21,"receive":0,"ssl":64},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sleepoverlimitprofound.com/ren.gif?sid=H4sIAAAAAAAC_1RSz4scRRSu3sxJD2ISPHnog4hCdra7p6d72hwCwbgX3VUTWVA81K-elNvd1enqnpkdLxtXPO_Bg8eeb3azIhIUPIlImDWngGAf1DlkQfwPFIJHmcnAakF977366vB9773PJtUZaaOi87ff0mOVJHSj23bsV3ZUJvTQ2Fu3bNdpO1ftHZUF_lV7tIBi8Jrb8dvOq_am5Lt6w3Ncx3Ed135DFTLWo40lC5V_HbntyGn7Xtvt-hgV_69NZcFQC2JwRi5Ciea5P-MPoPgMWfrN69Lsljq_ciOtElrqAgNx8l62m-lhhvQ8jQsLcXay-g1tGkK-WIPOTlYOoAdHCwdgqiFrLzwGy05WMsEGx0-VsgQyAxPPYjiYQSYzKDoD1wdQ4hcCcIGtbWTpvS1dDOneU5Yu2Ia0nvwNNWxI6_FlZOn964ka2Td1UpVKZwajuIYazaD6M-TVKcrxGtTwFLz8BEr8TDaevIksPdo2iYYS9dK9imegxkK1uMpCFVuocgupmNu-0_O5SztBHAkeOj71fSGZE_U8x6ERD1Hxu1DiELzYR17sY1cdwtyuYYQFUzbEemcfA1Efi8R4pr4nElMxdxW9VezUU132J_RYl32ZEdDiEIWoj1R-xxyAlxem49iIqV4AZWU9pUzUUyVKguLO_CXHjUQQ-956EEpvPZSeux7xoLMe8tDzgrBHpS8n-Rl5ftE_6_uXH2JXzu0ed1lIY7_rBX7odrkTUClCpxvHPe7GzIVRNZRZW7ZmrBqyc-kGctWQK39NwOgpTHIKrl4ErVzQYQ16u8Y4-yHdiwspjepntKwK2ZeZLBYL1eY6hdA18rKFcs-aJGfk0vTdW9cfLMf6_pfXIPmja-X4j837lz8GL2rkRY2P1E8E_eTut9t5qVI1pos53yxpKS-AqoY88-ArcNWQi78dLFeus_kPeL4Pkz8iqwOjCVhuIVEEiTx_p6yG-U_NzvOJ-RT9ogWWtKYsKVpHLCmSz5cyG_Lh7w8X8GND2FULRs3trsc6Qa8XyDgQcUd0vI6Iuo6MfBoFfuR3UZpG_Tr_7t8AAAD__6u_oZ7_AwAA","fqdn":"sleepoverlimitprofound.com","domain":"sleepoverlimitprofound.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.348Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sleepoverlimitprofound.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 07:46:44 GMT","end":"Wed, 27 May 2026 07:46:43 GMT"},"fingerprint":{"sha1":"15:D7:39:A0:7C:1A:88:D2:D0:5B:FB:FE:9B:83:77:FF:65:A9:D6:86","sha256":"B8:A7:1B:87:3D:C6:BE:32:67:55:36:2E:23:EB:C8:0E:C9:BA:FD:04:BD:2A:D3:3D:46:3E:0E:07:24:9F:01:A2"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1RSz4scRRSu3sxJD2ISPHnog4hCdra7p6d72hwCwbgX3VUTWVA81K-elNvd1enqnpkdLxtXPO_Bg8eeb3azIhIUPIlImDWngGAf1DlkQfwPFIJHmcnAakF977366vB9773PJtUZaaOi87ff0mOVJHSj23bsV3ZUJvTQ2Fu3bNdpO1ftHZUF_lV7tIBi8Jrb8dvOq_am5Lt6w3Ncx3Ed135DFTLWo40lC5V_HbntyGn7Xtvt-hgV_69NZcFQC2JwRi5Ciea5P-MPoPgMWfrN69Lsljq_ciOtElrqAgNx8l62m-lhhvQ8jQsLcXay-g1tGkK-WIPOTlYOoAdHCwdgqiFrLzwGy05WMsEGx0-VsgQyAxPPYjiYQSYzKDoD1wdQ4hcCcIGtbWTpvS1dDOneU5Yu2Ia0nvwNNWxI6_FlZOn964ka2Td1UpVKZwajuIYazaD6M-TVKcrxGtTwFLz8BEr8TDaevIksPdo2iYYS9dK9imegxkK1uMpCFVuocgupmNu-0_O5SztBHAkeOj71fSGZE_U8x6ERD1Hxu1DiELzYR17sY1cdwtyuYYQFUzbEemcfA1Efi8R4pr4nElMxdxW9VezUU132J_RYl32ZEdDiEIWoj1R-xxyAlxem49iIqV4AZWU9pUzUUyVKguLO_CXHjUQQ-956EEpvPZSeux7xoLMe8tDzgrBHpS8n-Rl5ftE_6_uXH2JXzu0ed1lIY7_rBX7odrkTUClCpxvHPe7GzIVRNZRZW7ZmrBqyc-kGctWQK39NwOgpTHIKrl4ErVzQYQ16u8Y4-yHdiwspjepntKwK2ZeZLBYL1eY6hdA18rKFcs-aJGfk0vTdW9cfLMf6_pfXIPmja-X4j837lz8GL2rkRY2P1E8E_eTut9t5qVI1pos53yxpKS-AqoY88-ArcNWQi78dLFeus_kPeL4Pkz8iqwOjCVhuIVEEiTx_p6yG-U_NzvOJ-RT9ogWWtKYsKVpHLCmSz5cyG_Lh7w8X8GND2FULRs3trsc6Qa8XyDgQcUd0vI6Iuo6MfBoFfuR3UZpG_Tr_7t8AAAD__6u_oZ7_AwAA HTTP/1.1\r\nHost: sleepoverlimitprofound.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; u_pl28976837=1; nlec8c1b7af45264715c06aed705ff8c1fb1=[5941311,6437633]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 0\r\nHost: sleepoverlimitprofound.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: dac0330be489658af7494d563bcec393\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T04:20:17.182226Z","times_seen":17555689,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kettledroopingcontinuation.com/watch.596847458610.js?key=5b06e8eaa68d6786efe42f5486d1340d\u0026kw=%5B%22my%22%2C%22free%22%2C%22email%22%2C%22signature%22%2C%22generator%22%2C%22no%22%2C%22login%22%2C%22paywall%22%5D\u0026refer=https%3A%2F%2Fmyfreeemailsignature.com%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=d0216e2c-8750-42a8-b58f-eaff3c89cd78%3A2%3A1\u0026shu=7b2f021419e1ba35eee10e1d2a89d80576196980741e0b9ef4ea93e4518c99f8429ba71331debaea5c6ee4b62e10385e230b4319a187f1857f7db1802195b0f8090d064b728f3f416c4310f0d8e912131b574c0abc2d6da8e0e898\u0026pst=1775688176\u0026rmtc=t\u0026st1=3b0223d6cca7fd50ce44702c82342457\u0026ps1=1775688116","fqdn":"kettledroopingcontinuation.com","domain":"kettledroopingcontinuation.com","tld":"com"},"ip":{"addr":"172.240.127.234","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kettledroopingcontinuation.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 21:44:44 GMT","end":"Sun, 24 May 2026 21:44:43 GMT"},"fingerprint":{"sha1":"4C:9B:DC:71:4E:6F:7E:04:5A:F2:21:54:DA:06:E8:A0:34:82:CB:86","sha256":"23:FF:1C:4C:C9:81:C7:C0:A0:EB:2B:81:77:68:85:F3:47:33:36:DE:71:C4:DB:B4:66:77:5F:24:24:B9:A7:89"}}},"request":{"raw":"GET /watch.596847458610.js?key=5b06e8eaa68d6786efe42f5486d1340d\u0026kw=%5B%22my%22%2C%22free%22%2C%22email%22%2C%22signature%22%2C%22generator%22%2C%22no%22%2C%22login%22%2C%22paywall%22%5D\u0026refer=https%3A%2F%2Fmyfreeemailsignature.com%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=d0216e2c-8750-42a8-b58f-eaff3c89cd78%3A2%3A1\u0026shu=7b2f021419e1ba35eee10e1d2a89d80576196980741e0b9ef4ea93e4518c99f8429ba71331debaea5c6ee4b62e10385e230b4319a187f1857f7db1802195b0f8090d064b728f3f416c4310f0d8e912131b574c0abc2d6da8e0e898\u0026pst=1775688176\u0026rmtc=t\u0026st1=3b0223d6cca7fd50ce44702c82342457\u0026ps1=1775688116 HTTP/1.1\r\nHost: kettledroopingcontinuation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://myfreeemailsignature.com\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=d0216e2c-8750-42a8-b58f-eaff3c89cd78:2:1; ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyODk3NjgzOCwiayI6IjViMDZlOGVhYTY4ZDY3ODZlZmU0MmY1NDg2ZDEzNDBkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo1NzA2NTY1LCJwaWQiOjI5NDU2OTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MjgsImFpZCI6MjcsInB0Ijo0LCJwayI6ImkwM2FtYmQ5c3YiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6MjY2NTYxMTE1LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTM2OTI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEzNC4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiY3QiOnsiaWQiOjMxNDMyNDQsIm4iOiJPc2xvIn0sInJnIjp7ImlkIjoxODQ0LCJuIjoiT3NsbyBDb3VudHkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJpd2YiOnRydWUsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9teWZyZWVlbWFpbHNpZ25hdHVyZS5jb20vIiwidHoiOjIsImlkdWMiOjAsImFyIjpbXX19.br-wo88PVSga9-zG_zO01_T9uQHR4l7E8mfEikjxUb8\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Type: text/html\r\nContent-Length: 2673\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://myfreeemailsignature.com\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\nset-cookie: uid_id2=d0216e2c-8750-42a8-b58f-eaff3c89cd78:2:1; expires=Wed, 15 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\npdhtkv=true; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\nuncs=1; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\npdhtkv27=true; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\nuncs27=1; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\nu_pl28976838=1; expires=Thu, 09 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 26\r\nHost: kettledroopingcontinuation.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 199aa34766964c7fa7aee6fb1e1b32b5\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5113,"size_decoded":0,"mime_type":"text/html","magic":"JavaScript source, ASCII text, with very long lines (4237)","md5":"6ae9059d3b612d651c02c71caf1864c9","sha1":"f40d6beb6011420288992e1c4aac948b1b49d08e","sha256":"f1e8e390978fff9dd081f8483b90c0c7ab3d76c898cadd538f9211780c21f27f","sha512":"ea38532783f3d5e58dc5f25e4d350d07f7e307a24d1047e84e51118f113425ac83c542afe55c0d2ea4eb6a6da21f72caf36afafce5272e7a0aaac4e9afe8151d","ssdeep":"96:sMqMfaBdozaBCRCoM1drRdUNeWV1Nk/8CoM1drRdUNeWVe1ZDMCfMEDaH:lTAKzlRCbg11NkkCbg1CVMCkCaH","tlshash":"f6b11cf36dca13bd1983215f633b3d487e41d10b590a9615b86cd5924f299b81da8cdc","first_seen":"2026-04-08T22:42:22.528072Z","last_seen":"2026-04-08T22:42:22.528072Z","times_seen":1,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:54.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:41 GMT","end":"Mon, 08 Jun 2026 08:38:40 GMT"},"fingerprint":{"sha1":"03:81:A0:0E:E1:9B:80:A3:BC:CD:F9:25:A5:7B:8A:43:07:22:C6:00","sha256":"73:8D:9A:B1:F0:C3:6E:8F:EE:C0:2F:99:C8:89:24:16:9A:DB:D1:9C:27:5D:8A:7A:A8:2B:0E:10:42:28:53:7F"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700;800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 08 Apr 2026 22:41:54 GMT\r\ndate: Wed, 08 Apr 2026 22:41:54 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12635,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"4b1d52c19ccef2398d1de007b3c9a55c","sha1":"c57fa2bcac927a7d60c526cb7ec2b6249019dfe7","sha256":"05f842619ec9f615de0b749034eadaea60e3554d798683fb01ee1eb27abd1e68","sha512":"9dfc4ab3832325eb1438bd85674e15ceb62771b94f06ea8e48a2e286453d571218df3f6727b8df4c1bdfa47218eb5fed0298601da289391a736a76a230d68c3b","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGfNx0NO3kCxHx:vXuM0p2+g7r","tlshash":"1e427892002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T22:54:08.549336Z","last_seen":"2026-07-27T04:11:50.483394Z","times_seen":14781,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":85,"dns":1,"connect":7,"send":0,"wait":22,"receive":0,"ssl":78},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"myfreeemailsignature.com/assets/index-7Yv5kDKE.css","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"ip":{"addr":"173.28.194.34","port":443,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:54.624Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"myfreeemailsignature.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 19:07:38 GMT","end":"Sun, 05 Jul 2026 19:07:37 GMT"},"fingerprint":{"sha1":"96:E7:43:B2:64:81:A6:D1:D8:B3:96:76:EC:B7:7D:A2:50:9E:C2:0D","sha256":"5A:45:7E:5F:CA:C0:D7:9F:D8:3F:6C:B9:CF:E5:02:6F:47:0D:0C:FB:DD:09:BF:21:13:69:8D:92:D4:05:25:3B"}}},"request":{"raw":"GET /assets/index-7Yv5kDKE.css HTTP/1.1\r\nHost: myfreeemailsignature.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 08 Apr 2026 22:41:54 GMT\r\ncontent-type: text/css\r\nvary: Origin\r\nlast-modified: Tue, 07 Apr 2026 03:03:27 GMT\r\netag: W/\"23082-1775531007449\"\r\ncache-control: no-cache\r\ncontent-encoding: gzip\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23082,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (23081)","md5":"b3e3d1980c5a3f8b26a03c935b09478a","sha1":"4b95a0720a7fa1b4969b20028062c985a25b9513","sha256":"d6280a26f08dd39bd713ee95a3f850feff400ba1300a27152bc511ad06e074f7","sha512":"9967898be5569dc6cbb0194bad2ee88f19f5d8f67f138033741ed0c5f5ac14e41e68f378d175a7d6f64f10de6bf28d9965b9cc54700db3836f174a80ef4461f8","ssdeep":"192:O9JyW9Jyyx6ElkK7DsfVsfTsfzsfgV43StPHxKLKGAiGCIunTX/m/hrolzcKH:kTkK7wVBPN8TX/m/hr4H","tlshash":"61a2622eab50003b7c5790f5d2d5ba9df61ab0c1df2e5aeabd8311109bd63f60c97604","first_seen":"2026-04-08T22:42:22.531942Z","last_seen":"2026-04-08T22:42:22.531942Z","times_seen":1,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"protrafficinspector.com/stats","fqdn":"protrafficinspector.com","domain":"protrafficinspector.com","tld":"com"},"ip":{"addr":"63.183.72.212","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"statistics.it.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 30 Mar 2026 00:00:00 GMT","end":"Tue, 13 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D9:BA:08:A9:13:92:91:6D:E6:8A:40:1F:41:40:EF:3B:C9:D6:8D:1C","sha256":"E7:E2:E4:A5:62:0D:1F:DE:F7:00:2C:C3:99:91:FE:06:F0:63:82:CF:61:C8:DE:94:F3:2A:75:79:79:E4:67:CD"}}},"request":{"raw":"GET /stats HTTP/1.1\r\nHost: protrafficinspector.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nOrigin: https://myfreeemailsignature.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:41:55 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 40\r\nserver: fasthttp\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://myfreeemailsignature.com\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\nset-cookie: uid_id2=d0216e2c-8750-42a8-b58f-eaff3c89cd78:2:1; expires=Sat, 05 Apr 2036 22:41:55 GMT; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"1486c3fae88dee8f826e5d5b328aacdc","sha1":"951fb976a52039411cbe0363ef526bf1d1dac526","sha256":"1f84d33a71455efe0d0870a055390889dc8683a562d6f9bfb8ba68abcbc29cc2","sha512":"ca1d24d19b6673766f4266cd56f62c99d1486f439080b99a5d62cd8ad451d7fea2f744ee42b4cbd983299f4b6d493bce6ac1c493911d52443702e486bdb8c864","ssdeep":"","tlshash":"0a900403df744cd401cdf354510414c37445140c10440c154717d31d43441110401d10","first_seen":"2026-04-08T22:42:22.534444Z","last_seen":"2026-04-08T22:42:22.534444Z","times_seen":1,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":95,"dns":1,"connect":21,"send":0,"wait":22,"receive":0,"ssl":70},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.highperformanceformat.com/5b06e8eaa68d6786efe42f5486d1340d/invoke.js","fqdn":"www.highperformanceformat.com","domain":"highperformanceformat.com","tld":"com"},"ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"highperformanceformat.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Feb 2026 21:57:20 GMT","end":"Fri, 08 May 2026 21:57:19 GMT"},"fingerprint":{"sha1":"43:22:88:5B:AB:7D:58:1A:CD:69:B9:94:07:4B:02:03:3C:4C:54:C3","sha256":"F8:CB:C6:45:63:11:EE:A3:17:9B:78:73:01:DD:85:7E:1D:23:CB:86:BB:3A:41:31:C4:9B:59:42:52:8B:40:B3"}}},"request":{"raw":"GET /5b06e8eaa68d6786efe42f5486d1340d/invoke.js HTTP/1.1\r\nHost: www.highperformanceformat.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:55 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 20438\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 6\r\nHost: www.highperformanceformat.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: be624a585a196181f3f2d9d15c02b921\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":51335,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (51335), with no line terminators","md5":"6fa7edd8345e4806e0d8a41bf44ec451","sha1":"2caec1905119d512526807d8e4c865fff4034e5a","sha256":"e1db929d826970a93e721080f5e6127ddbd419749b7ad57c577fd4e1660bba8a","sha512":"bfd2149de8d5f0da13c341d49caab321a301c2aa8d93af2c8978e43f33fc61d070156f7a148c34366aa4359353ed360655e67d4eb16da46622addb3c5e744c19","ssdeep":"768:xILsjP3R5MaFvQ003E9ZnANn7aw++nxKDpOI6sxt4U2CNFQb+DNI7bR:x/MaFvQfOsKpN6+2hbYUF","tlshash":"fb33c78c7fe1f0e416567c73323f60abf11a1c12958cd48cd906e4ae6ae8795e937b18","first_seen":"2026-04-08T22:42:22.536455Z","last_seen":"2026-04-08T22:42:22.536455Z","times_seen":1,"resource_available":true,"data":null}},"time_used":776,"timings":{"blocked":291,"dns":2,"connect":95,"send":0,"wait":98,"receive":94,"ssl":190},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"www.highperformanceformat.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"www.highperformanceformat.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"www.highperformanceformat.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pl29077335.profitablecpmratenetwork.com/f6/f3/4b/f6f34bba5142bf660fca81640b5656ad.js","fqdn":"pl29077335.profitablecpmratenetwork.com","domain":"profitablecpmratenetwork.com","tld":"com"},"ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"profitablecpmratenetwork.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Mar 2026 14:13:16 GMT","end":"Mon, 15 Jun 2026 14:13:15 GMT"},"fingerprint":{"sha1":"BC:8E:D7:91:CA:9C:82:79:1D:3B:0D:C4:5A:1C:38:F3:8E:BD:C6:B8","sha256":"33:27:4F:63:F0:BE:24:EB:26:AB:C6:CF:E1:2F:CD:8C:26:B0:D2:61:57:CF:32:A7:D3:E6:BE:24:A8:9F:34:82"}}},"request":{"raw":"GET /f6/f3/4b/f6f34bba5142bf660fca81640b5656ad.js HTTP/1.1\r\nHost: pl29077335.profitablecpmratenetwork.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:55 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 34150\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 6\r\nHost: pl29077335.profitablecpmratenetwork.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: db82195912fd35856e17b030287f7c9f\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":93709,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"1d146b02aef4bf82d909441c3ff9f283","sha1":"829b7ad69c647712aa71139d787e1357b376325c","sha256":"c4301526d5106616ebf648211e27845be58dfaac698c50582e525a6921abc54d","sha512":"aae801c87addce7955b23389d0cdb6ccd1da2cdb879d4d91349f7483cd6f6e6a736ae194823279fd0d41bc5f855ed88ae859dc6438fcdaa280ed1f9d3272bce2","ssdeep":"1536:7x1PMZPem5Kvg/+UriOXwaHe4J+LgFW8Xmj8sV:YGv4WUR+1sF69V","tlshash":"5593e68c3fc1f0a513a5203b222f714ef0994d95546ce468f783f56a2f7ca4ae536b98","first_seen":"2026-04-08T22:42:22.538318Z","last_seen":"2026-04-08T22:42:22.538318Z","times_seen":1,"resource_available":true,"data":null}},"time_used":869,"timings":{"blocked":336,"dns":59,"connect":91,"send":0,"wait":100,"receive":94,"ssl":186},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"pl29077335.profitablecpmratenetwork.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"preferencenail.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 01:24:35 GMT","end":"Thu, 28 May 2026 01:24:34 GMT"},"fingerprint":{"sha1":"66:45:2B:BB:A2:6D:D3:A2:B6:16:36:65:94:BA:4A:C6:5E:05:66:09","sha256":"A4:2E:A7:56:DB:44:FF:55:9A:FA:4D:EC:2A:78:CB:C5:02:CD:CF:B2:FB:A7:A7:75:77:EC:01:DB:19:71:C0:77"}}},"request":{"raw":"GET /sfp.js HTTP/1.1\r\nHost: preferencenail.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:55 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 32181\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nP3P: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\nAccess-Control-Allow-Origin: *\r\nVary: Accept-Encoding\r\nHost: preferencenail.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 89352194ca8c353b23775b6d8eb35653\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85379,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators","md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-07-27T03:59:48.330787Z","times_seen":24988,"resource_available":true,"data":null}},"time_used":164,"timings":{"blocked":60,"dns":0,"connect":23,"send":0,"wait":23,"receive":18,"ssl":38},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:57 GMT","end":"Mon, 08 Jun 2026 08:38:56 GMT"},"fingerprint":{"sha1":"92:E2:B6:93:F5:F7:5B:B5:A5:90:4A:FB:29:B8:D9:13:92:F0:4E:4C","sha256":"CE:CA:3C:A3:12:47:2D:AD:A2:EA:EF:0B:F3:9B:63:E0:B4:06:B9:4C:68:4B:B2:4C:AC:61:C1:39:E3:A0:50:B1"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://myfreeemailsignature.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 02 Apr 2026 01:38:11 GMT\r\nexpires: Fri, 02 Apr 2027 01:38:11 GMT\r\ncache-control: public, max-age=31536000\r\nage: 594224\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-27T04:19:22.964673Z","times_seen":247249,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":144,"dns":0,"connect":0,"send":0,"wait":16,"receive":7,"ssl":111},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.212Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:57 GMT","end":"Mon, 08 Jun 2026 08:38:56 GMT"},"fingerprint":{"sha1":"92:E2:B6:93:F5:F7:5B:B5:A5:90:4A:FB:29:B8:D9:13:92:F0:4E:4C","sha256":"CE:CA:3C:A3:12:47:2D:AD:A2:EA:EF:0B:F3:9B:63:E0:B4:06:B9:4C:68:4B:B2:4C:AC:61:C1:39:E3:A0:50:B1"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://myfreeemailsignature.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 02 Apr 2026 01:38:11 GMT\r\nexpires: Fri, 02 Apr 2027 01:38:11 GMT\r\ncache-control: public, max-age=31536000\r\nage: 594224\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-27T04:19:22.964673Z","times_seen":247249,"resource_available":false,"data":null}},"time_used":242,"timings":{"blocked":95,"dns":3,"connect":19,"send":0,"wait":38,"receive":14,"ssl":70},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sleepoverlimitprofound.com/ren.gif?sid=H4sIAAAAAAAC_1RSP2wcxReeda5L8dOPBERBsQVCIMXn3b293VtcWIoIacAGYmQJRDH_9jJ4d2ezs3t3vjQOQdQuUlDufWfHFCgCiQohhM6ksoSULRBXxBKipQIpNTr7pMBI87339I1G3_fe-2JSnZE2Kjp_7109VklC17ptx359R2VCD429uW27TttZt3dUFvjr9mgBxeBNt-O3nTfsm5Lv6jXPcR3HdVz7bVXIWI_Wzlmo_OvIbUdO2_fabtfHqPhvbSoLhloQgzPyApRo_vdH_DEUnyFLv3lLmt1S59dupFVCS11gII4_zHYzPcyQPk_jwkKcHS9fQ5uGkC9XoLPjpQPoweHCAZhqyMpLT8Gy46VMsMHRhVKWQGZg4jKGgxlkMoOiM3B9H0o8IQAX2NxClj7c1MWQ7l2wdME2pPXsb6hhQ1pPryJLH11P1Mi-pZOqVDozGMU11GgG1Z8hr05Qjleghifg5WdQ4hey9uwdZOnhlkk0lKjP3at4BmosVIurLFSxhSq3kIq57Ts9n7u0E8SR4KHjU98XkjlRz3McGvEQFb8HJQ7Ai33kxT521QHM7RpGWDBlQ6z39zEQ9ZFIjGfqhyIxFXOX0VvGTj3VZX9Cj3TZlxkBLQ5QiPpQ5XfMffDy0nQcGzHVC6CsrKeUiXqqRElQ3Jm_6riRCGLfWw1C6a2G0nNXIx50VkMeel4Q9qj05SQ_I_9f9M_6_rXH2JVzu8ddFtLY73qBH7pd7gRUitDpxnGPuzFzYVQNZVbOWzNWDdm5cgO5asi1vyZg9AQmOQFXr4BWLuiwBr1dY5z9kO7FhZRG9TNaVoXsy0wWi4Vqc51C6Bp52UK5Z02SM3Jl-sH29Z_Ox8rWLUh-uvFg_PvNR1fvghc18qLGp-pngn5y79utvFSpGtPFnG-VtJSXQNWTu9vgqiEvXt47X7jwz5fB832Y_HSjXP5kNAHLW0gUQSJPyfKAshrmXzV7nk_M5-gXLbCkNWVJ0TpkSZE8aMhHX2005JPfHi_gxwvNRs3trsc6Qa8XyDgQcUd0vI6Iuo6MfBoFfuR3UZpG_Tr_7p8AAAD__5zDVL_9AwAA","fqdn":"sleepoverlimitprofound.com","domain":"sleepoverlimitprofound.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.356Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sleepoverlimitprofound.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 07:46:44 GMT","end":"Wed, 27 May 2026 07:46:43 GMT"},"fingerprint":{"sha1":"15:D7:39:A0:7C:1A:88:D2:D0:5B:FB:FE:9B:83:77:FF:65:A9:D6:86","sha256":"B8:A7:1B:87:3D:C6:BE:32:67:55:36:2E:23:EB:C8:0E:C9:BA:FD:04:BD:2A:D3:3D:46:3E:0E:07:24:9F:01:A2"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1RSP2wcxReeda5L8dOPBERBsQVCIMXn3b293VtcWIoIacAGYmQJRDH_9jJ4d2ezs3t3vjQOQdQuUlDufWfHFCgCiQohhM6ksoSULRBXxBKipQIpNTr7pMBI87339I1G3_fe-2JSnZE2Kjp_7109VklC17ptx359R2VCD429uW27TttZt3dUFvjr9mgBxeBNt-O3nTfsm5Lv6jXPcR3HdVz7bVXIWI_Wzlmo_OvIbUdO2_fabtfHqPhvbSoLhloQgzPyApRo_vdH_DEUnyFLv3lLmt1S59dupFVCS11gII4_zHYzPcyQPk_jwkKcHS9fQ5uGkC9XoLPjpQPoweHCAZhqyMpLT8Gy46VMsMHRhVKWQGZg4jKGgxlkMoOiM3B9H0o8IQAX2NxClj7c1MWQ7l2wdME2pPXsb6hhQ1pPryJLH11P1Mi-pZOqVDozGMU11GgG1Z8hr05Qjleghifg5WdQ4hey9uwdZOnhlkk0lKjP3at4BmosVIurLFSxhSq3kIq57Ts9n7u0E8SR4KHjU98XkjlRz3McGvEQFb8HJQ7Ai33kxT521QHM7RpGWDBlQ6z39zEQ9ZFIjGfqhyIxFXOX0VvGTj3VZX9Cj3TZlxkBLQ5QiPpQ5XfMffDy0nQcGzHVC6CsrKeUiXqqRElQ3Jm_6riRCGLfWw1C6a2G0nNXIx50VkMeel4Q9qj05SQ_I_9f9M_6_rXH2JVzu8ddFtLY73qBH7pd7gRUitDpxnGPuzFzYVQNZVbOWzNWDdm5cgO5asi1vyZg9AQmOQFXr4BWLuiwBr1dY5z9kO7FhZRG9TNaVoXsy0wWi4Vqc51C6Bp52UK5Z02SM3Jl-sH29Z_Ox8rWLUh-uvFg_PvNR1fvghc18qLGp-pngn5y79utvFSpGtPFnG-VtJSXQNWTu9vgqiEvXt47X7jwz5fB832Y_HSjXP5kNAHLW0gUQSJPyfKAshrmXzV7nk_M5-gXLbCkNWVJ0TpkSZE8aMhHX2005JPfHi_gxwvNRs3trsc6Qa8XyDgQcUd0vI6Iuo6MfBoFfuR3UZpG_Tr_7p8AAAD__5zDVL_9AwAA HTTP/1.1\r\nHost: sleepoverlimitprofound.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; u_pl28976837=1; nlec8c1b7af45264715c06aed705ff8c1fb1=[5941311,6437633]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 1\r\nHost: sleepoverlimitprofound.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: efd5b78733ba0dab2d561a919865330f\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T04:20:17.182226Z","times_seen":17555689,"resource_available":true,"data":null}},"time_used":657,"timings":{"blocked":273,"dns":1,"connect":94,"send":0,"wait":99,"receive":0,"ssl":187},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sleepoverlimitprofound.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"flushpersist.com/pxf.gif?uuid=f59ab984-ce3c-45b6-b79e-b4495b738bda\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=f6f34bba5142bf660fca81640b5656ad\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=22","fqdn":"flushpersist.com","domain":"flushpersist.com","tld":"com"},"ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"flushpersist.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 22:12:10 GMT","end":"Wed, 27 May 2026 22:12:09 GMT"},"fingerprint":{"sha1":"F8:CE:1C:DD:8F:86:0E:25:10:C6:86:56:A7:A3:47:DA:38:11:C7:3A","sha256":"19:3B:E0:74:B6:FC:9E:17:C4:75:30:39:E3:6A:CB:EF:32:91:9E:69:12:DF:51:AC:FA:76:15:EE:1B:D3:36:B8"}}},"request":{"raw":"GET /pxf.gif?uuid=f59ab984-ce3c-45b6-b79e-b4495b738bda\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=f6f34bba5142bf660fca81640b5656ad\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=22 HTTP/1.1\r\nHost: flushpersist.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Type: image/gif\r\nContent-Length: 1\r\nConnection: keep-alive\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\nx-envoy-upstream-service-time: 1\r\nHost: flushpersist.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: bc636e8e2f446ffa6f2ab67be61cf777\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T04:20:17.182226Z","times_seen":17555689,"resource_available":true,"data":null}},"time_used":776,"timings":{"blocked":338,"dns":56,"connect":92,"send":0,"wait":98,"receive":0,"ssl":189},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.storageimagedisplay.com/bi/10/22/85/1022851f8588320f84450c791299737b/1596641253.jpg","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.storageimagedisplay.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 02:33:25 GMT","end":"Fri, 05 Jun 2026 02:33:24 GMT"},"fingerprint":{"sha1":"4A:66:11:51:1F:1F:F3:84:B6:E4:4F:81:C1:03:83:9F:01:17:7E:82","sha256":"DA:55:E3:02:D5:3C:4E:3A:51:ED:21:0D:F4:32:52:C2:C5:31:87:50:DC:AB:13:D9:93:4A:15:0C:D9:8C:D6:4F"}}},"request":{"raw":"GET /bi/10/22/85/1022851f8588320f84450c791299737b/1596641253.jpg HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:41:56 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 10601\r\nserver: nginx/1.21.6\r\nlast-modified: Wed, 05 Aug 2020 15:27:36 GMT\r\netag: \"5f2acfe8-2969\"\r\nexpires: Fri, 10 Apr 2026 22:41:56 GMT\r\ncache-control: max-age=172800\r\nx-cdn-host-id: AH0543\r\nx-proxy-cache: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10601,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 468x60, components 3","md5":"54ae9ac1dd44fbc3e88664bd01578f42","sha1":"c5794fadc819a0a28f4926f8804796b6a5a96017","sha256":"b830843acc45486dae1fff67881e2c60115774064fa01ebdeb73982b5e0e39b5","sha512":"d8b1c675c01d50a1b081b2fdab738065c4e22d699daa2800bed762217039ba30b467b729bb3e0d3c1f529b63ec0de0518acdd33d89593190eb64ad8f3bc59e3e","ssdeep":"192:NllllldkiwlMy6sjj9xo1WQfygfGXxURPZs3JcWYypvKyiOzGvE7avvvvvvG:9HwlMyvxo1W2yp0+JaypSy3iM7avvvvm","tlshash":"ce227c0849ccf1fe21df2ab1c9526c7958fe3414a2a944f513e22ae1e765c328bf50f2","first_seen":"2023-05-07T23:26:47Z","last_seen":"2026-06-27T02:01:54.413156Z","times_seen":101,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":155,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.storageimagedisplay.com/si/d8/b1/09/d8b109165fc0ec08002c14fd9e81f6ece67b955e786b918b73abb33e5be5188f.png","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.363Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.storageimagedisplay.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 02:33:25 GMT","end":"Fri, 05 Jun 2026 02:33:24 GMT"},"fingerprint":{"sha1":"4A:66:11:51:1F:1F:F3:84:B6:E4:4F:81:C1:03:83:9F:01:17:7E:82","sha256":"DA:55:E3:02:D5:3C:4E:3A:51:ED:21:0D:F4:32:52:C2:C5:31:87:50:DC:AB:13:D9:93:4A:15:0C:D9:8C:D6:4F"}}},"request":{"raw":"GET /si/d8/b1/09/d8b109165fc0ec08002c14fd9e81f6ece67b955e786b918b73abb33e5be5188f.png HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:41:56 GMT\r\ncontent-type: image/png\r\ncontent-length: 57237\r\nserver: nginx/1.21.6\r\nlast-modified: Sun, 11 May 2025 14:02:30 GMT\r\netag: \"6820adf6-df95\"\r\nexpires: Fri, 10 Apr 2026 22:41:56 GMT\r\ncache-control: max-age=172800\r\nx-cdn-host-id: AH0543\r\nx-proxy-cache: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57237,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 320 x 240, 8-bit/color RGBA, non-interlaced","md5":"423a240fbfb182d7805dad3bb9e822bb","sha1":"6a853689b2cc95a6c36b98e6938e598bf2a28d52","sha256":"da19475c70c6669a83473eb52dec1feb61e629e374fdd426dd02024080d0b1a6","sha512":"98e063f429420821aa55688891aa4426d16d9e7ffa44f92f8d9d7f3e3870007872a66a718185428f197db14d070b7254e92a2cc7734cc54c39034c808daa7c8f","ssdeep":"1536:BP5oFAaPeX990yL036TelNvY6lEFLXmLw2JR:FWqaPeXz0yLDe7luXyH","tlshash":"ab430224ff03e61784be24af91eae88f1f6421bfb5b092807770221445b7c6b4282463","first_seen":"2025-05-16T16:44:08.672031Z","last_seen":"2026-07-25T05:37:10.751861Z","times_seen":6956,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":47,"dns":0,"connect":19,"send":0,"wait":65,"receive":15,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"myfreeemailsignature.com/","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"ip":{"addr":"173.28.194.34","port":443,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-08T22:41:53.898Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"myfreeemailsignature.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 19:07:38 GMT","end":"Sun, 05 Jul 2026 19:07:37 GMT"},"fingerprint":{"sha1":"96:E7:43:B2:64:81:A6:D1:D8:B3:96:76:EC:B7:7D:A2:50:9E:C2:0D","sha256":"5A:45:7E:5F:CA:C0:D7:9F:D8:3F:6C:B9:CF:E5:02:6F:47:0D:0C:FB:DD:09:BF:21:13:69:8D:92:D4:05:25:3B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: myfreeemailsignature.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 08 Apr 2026 22:41:54 GMT\r\ncontent-type: text/html\r\nvary: Origin\r\ncache-control: no-cache\r\netag: W/\"109f-wundJIZSMp73NMSsICSu4HRigFQ\"\r\ncontent-encoding: gzip\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4255,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"3b998231f47f1e9f46e108d75526b6e0","sha1":"c2e9dd248652329ef734c4ac2024aee074628054","sha256":"56db0a5eb29f87ec67f90a73f342c0983da5e81cd88da413b66edb757804199a","sha512":"7a483d51f0e5c4c90c5ff2f4735f2089fe868f7eb75b05030b1878e3b3631ffa87b86daddf5fe97ee77c98906d529e909f772e9d7a367dccabf8b49b49c9110b","ssdeep":"96:ABXvsCnNzZk3UFzIiLLL3yZo/yufyzg5g:2dm3UtIiLLL3yZo/yufyzga","tlshash":"e091315fd6a04c120321467130d2b16aaf66418b4f84ac1576ac826e1fcdeaf5be737e","first_seen":"2026-04-08T22:42:22.545729Z","last_seen":"2026-04-08T22:42:22.545729Z","times_seen":1,"resource_available":false,"data":null}},"time_used":957,"timings":{"blocked":402,"dns":105,"connect":144,"send":0,"wait":153,"receive":0,"ssl":150},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.205Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:57 GMT","end":"Mon, 08 Jun 2026 08:38:56 GMT"},"fingerprint":{"sha1":"92:E2:B6:93:F5:F7:5B:B5:A5:90:4A:FB:29:B8:D9:13:92:F0:4E:4C","sha256":"CE:CA:3C:A3:12:47:2D:AD:A2:EA:EF:0B:F3:9B:63:E0:B4:06:B9:4C:68:4B:B2:4C:AC:61:C1:39:E3:A0:50:B1"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://myfreeemailsignature.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 02 Apr 2026 01:38:11 GMT\r\nexpires: Fri, 02 Apr 2027 01:38:11 GMT\r\ncache-control: public, max-age=31536000\r\nage: 594224\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-27T04:19:22.964673Z","times_seen":247249,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":102,"dns":2,"connect":18,"send":0,"wait":16,"receive":22,"ssl":72},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.215Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Mar 2026 08:38:57 GMT","end":"Mon, 08 Jun 2026 08:38:56 GMT"},"fingerprint":{"sha1":"92:E2:B6:93:F5:F7:5B:B5:A5:90:4A:FB:29:B8:D9:13:92:F0:4E:4C","sha256":"CE:CA:3C:A3:12:47:2D:AD:A2:EA:EF:0B:F3:9B:63:E0:B4:06:B9:4C:68:4B:B2:4C:AC:61:C1:39:E3:A0:50:B1"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://myfreeemailsignature.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 02 Apr 2026 01:38:11 GMT\r\nexpires: Fri, 02 Apr 2027 01:38:11 GMT\r\ncache-control: public, max-age=31536000\r\nage: 594224\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-27T04:19:22.964673Z","times_seen":247249,"resource_available":false,"data":null}},"time_used":321,"timings":{"blocked":162,"dns":0,"connect":0,"send":0,"wait":16,"receive":9,"ssl":134},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.highperformanceformat.com/5b06e8eaa68d6786efe42f5486d1340d/invoke.js","fqdn":"www.highperformanceformat.com","domain":"highperformanceformat.com","tld":"com"},"ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.258Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"highperformanceformat.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Feb 2026 21:57:20 GMT","end":"Fri, 08 May 2026 21:57:19 GMT"},"fingerprint":{"sha1":"43:22:88:5B:AB:7D:58:1A:CD:69:B9:94:07:4B:02:03:3C:4C:54:C3","sha256":"F8:CB:C6:45:63:11:EE:A3:17:9B:78:73:01:DD:85:7E:1D:23:CB:86:BB:3A:41:31:C4:9B:59:42:52:8B:40:B3"}}},"request":{"raw":"GET /5b06e8eaa68d6786efe42f5486d1340d/invoke.js HTTP/1.1\r\nHost: www.highperformanceformat.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:55 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 20438\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 6\r\nHost: www.highperformanceformat.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 654dffb5fe76b363f5c4edbb6d865464\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51335,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (51335), with no line terminators","md5":"6fa7edd8345e4806e0d8a41bf44ec451","sha1":"2caec1905119d512526807d8e4c865fff4034e5a","sha256":"e1db929d826970a93e721080f5e6127ddbd419749b7ad57c577fd4e1660bba8a","sha512":"bfd2149de8d5f0da13c341d49caab321a301c2aa8d93af2c8978e43f33fc61d070156f7a148c34366aa4359353ed360655e67d4eb16da46622addb3c5e744c19","ssdeep":"768:xILsjP3R5MaFvQ003E9ZnANn7aw++nxKDpOI6sxt4U2CNFQb+DNI7bR:x/MaFvQfOsKpN6+2hbYUF","tlshash":"fb33c78c7fe1f0e416567c73323f60abf11a1c12958cd48cd906e4ae6ae8795e937b18","first_seen":"2026-04-08T22:42:22.536455Z","last_seen":"2026-04-08T22:42:22.536455Z","times_seen":1,"resource_available":true,"data":null}},"time_used":769,"timings":{"blocked":286,"dns":1,"connect":95,"send":0,"wait":101,"receive":92,"ssl":192},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"www.highperformanceformat.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"www.highperformanceformat.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"www.highperformanceformat.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=1916\u0026rd=1916\u0026fd=541\u0026bv=26.3.5226\u0026tmpl=70","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.822Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=1916\u0026rd=1916\u0026fd=541\u0026bv=26.3.5226\u0026tmpl=70 HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T04:20:17.182226Z","times_seen":17555689,"resource_available":true,"data":null}},"time_used":745,"timings":{"blocked":325,"dns":47,"connect":93,"send":0,"wait":93,"receive":0,"ssl":184},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kettledroopingcontinuation.com/watch.596847458610.js?key=5b06e8eaa68d6786efe42f5486d1340d\u0026kw=%5B%22my%22%2C%22free%22%2C%22email%22%2C%22signature%22%2C%22generator%22%2C%22no%22%2C%22login%22%2C%22paywall%22%5D\u0026refer=https%3A%2F%2Fmyfreeemailsignature.com%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=d0216e2c-8750-42a8-b58f-eaff3c89cd78%3A2%3A1","fqdn":"kettledroopingcontinuation.com","domain":"kettledroopingcontinuation.com","tld":"com"},"ip":{"addr":"172.240.127.234","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kettledroopingcontinuation.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 21:44:44 GMT","end":"Sun, 24 May 2026 21:44:43 GMT"},"fingerprint":{"sha1":"4C:9B:DC:71:4E:6F:7E:04:5A:F2:21:54:DA:06:E8:A0:34:82:CB:86","sha256":"23:FF:1C:4C:C9:81:C7:C0:A0:EB:2B:81:77:68:85:F3:47:33:36:DE:71:C4:DB:B4:66:77:5F:24:24:B9:A7:89"}}},"request":{"raw":"GET /watch.596847458610.js?key=5b06e8eaa68d6786efe42f5486d1340d\u0026kw=%5B%22my%22%2C%22free%22%2C%22email%22%2C%22signature%22%2C%22generator%22%2C%22no%22%2C%22login%22%2C%22paywall%22%5D\u0026refer=https%3A%2F%2Fmyfreeemailsignature.com%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=d0216e2c-8750-42a8-b58f-eaff3c89cd78%3A2%3A1 HTTP/1.1\r\nHost: kettledroopingcontinuation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nOrigin: https://myfreeemailsignature.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 307 Temporary Redirect\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:56 GMT\r\nContent-Type: text/html\r\nContent-Length: 0\r\nConnection: keep-alive\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://myfreeemailsignature.com\r\naccess-control-allow-credentials: true\r\nlocation: https://kettledroopingcontinuation.com/watch.596847458610.js?key=5b06e8eaa68d6786efe42f5486d1340d\u0026kw=%5B%22my%22%2C%22free%22%2C%22email%22%2C%22signature%22%2C%22generator%22%2C%22no%22%2C%22login%22%2C%22paywall%22%5D\u0026refer=https%3A%2F%2Fmyfreeemailsignature.com%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=d0216e2c-8750-42a8-b58f-eaff3c89cd78%3A2%3A1\u0026shu=7b2f021419e1ba35eee10e1d2a89d80576196980741e0b9ef4ea93e4518c99f8429ba71331debaea5c6ee4b62e10385e230b4319a187f1857f7db1802195b0f8090d064b728f3f416c4310f0d8e912131b574c0abc2d6da8e0e898\u0026pst=1775688176\u0026rmtc=t\u0026st1=3b0223d6cca7fd50ce44702c82342457\u0026ps1=1775688116\r\nset-cookie: uid_id2=d0216e2c-8750-42a8-b58f-eaff3c89cd78:2:1; expires=Wed, 15 Apr 2026 22:41:56 GMT; path=/; secure; SameSite=None\nain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyODk3NjgzOCwiayI6IjViMDZlOGVhYTY4ZDY3ODZlZmU0MmY1NDg2ZDEzNDBkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo1NzA2NTY1LCJwaWQiOjI5NDU2OTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MjgsImFpZCI6MjcsInB0Ijo0LCJwayI6ImkwM2FtYmQ5c3YiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6MjY2NTYxMTE1LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTM2OTI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEzNC4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiY3QiOnsiaWQiOjMxNDMyNDQsIm4iOiJPc2xvIn0sInJnIjp7ImlkIjoxODQ0LCJuIjoiT3NsbyBDb3VudHkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJpd2YiOnRydWUsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9teWZyZWVlbWFpbHNpZ25hdHVyZS5jb20vIiwidHoiOjIsImlkdWMiOjAsImFyIjpbXX19.br-wo88PVSga9-zG_zO01_T9uQHR4l7E8mfEikjxUb8; expires=Wed, 08 Apr 2026 22:42:56 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 3\r\nHost: kettledroopingcontinuation.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: f357eed381fd6fa9a4caeb24a0a808de\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":5113,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T04:20:17.182226Z","times_seen":17555689,"resource_available":true,"data":null}},"time_used":755,"timings":{"blocked":327,"dns":44,"connect":93,"send":0,"wait":100,"receive":0,"ssl":189},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.storageimagedisplay.com/cti/f0/fb/23/f0fb231c3868f7f970a30d973f7bfa93/1756662127.jpg","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.storageimagedisplay.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 02:33:25 GMT","end":"Fri, 05 Jun 2026 02:33:24 GMT"},"fingerprint":{"sha1":"4A:66:11:51:1F:1F:F3:84:B6:E4:4F:81:C1:03:83:9F:01:17:7E:82","sha256":"DA:55:E3:02:D5:3C:4E:3A:51:ED:21:0D:F4:32:52:C2:C5:31:87:50:DC:AB:13:D9:93:4A:15:0C:D9:8C:D6:4F"}}},"request":{"raw":"GET /cti/f0/fb/23/f0fb231c3868f7f970a30d973f7bfa93/1756662127.jpg HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:41:56 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 81446\r\nserver: nginx/1.21.6\r\nlast-modified: Sun, 31 Aug 2025 17:42:07 GMT\r\netag: \"68b4896f-13e26\"\r\nexpires: Fri, 10 Apr 2026 22:41:56 GMT\r\ncache-control: max-age=172800\r\nx-cdn-host-id: AH0543\r\nx-proxy-cache: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":81446,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 26.3 (Macintosh), datetime=2025:08:30 15:39:09], progressive, precision 8, 320x240, components 3","md5":"5cc1ea1ae22514d2a4e634a3fc00fc38","sha1":"17a827b9ae082506fe9d086fd2d006d0593ae5e8","sha256":"2a7d63fc873f793b91adea7c866b01e00bb59f075fc29953fd108f52fb5ede09","sha512":"9b57eb1e4bf4668182319d2f0bfa356c766de2afe94f188dc84054140014267d1f1ad0cf81b91421d88cdba16a9ad51b8acc87b9540c93c523bd66dd444304b5","ssdeep":"1536:LNkk6f2Nkk6fvhbg2DyMgTuF+faDypx3cvkYWMwjYz8+HjFOn:LZk2ZkJb+XTuF80sYWnYz8MjFQ","tlshash":"c183e125b3d1efb2e5d8973498a3c719f6219e45673760913e8db5a03fe2361da8c023","first_seen":"2025-09-02T19:18:23.934309Z","last_seen":"2026-07-24T18:34:51.899731Z","times_seen":1481,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":53,"dns":1,"connect":19,"send":0,"wait":58,"receive":32,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.storageimagedisplay.com/cti/f9/ad/1e/f9ad1e8c84bbfd29025a219de7a6e2e4/1756661889.jpg","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.storageimagedisplay.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 02:33:25 GMT","end":"Fri, 05 Jun 2026 02:33:24 GMT"},"fingerprint":{"sha1":"4A:66:11:51:1F:1F:F3:84:B6:E4:4F:81:C1:03:83:9F:01:17:7E:82","sha256":"DA:55:E3:02:D5:3C:4E:3A:51:ED:21:0D:F4:32:52:C2:C5:31:87:50:DC:AB:13:D9:93:4A:15:0C:D9:8C:D6:4F"}}},"request":{"raw":"GET /cti/f9/ad/1e/f9ad1e8c84bbfd29025a219de7a6e2e4/1756661889.jpg HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:41:56 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 72616\r\nserver: nginx/1.21.6\r\nlast-modified: Sun, 31 Aug 2025 17:38:09 GMT\r\netag: \"68b48881-11ba8\"\r\nexpires: Fri, 10 Apr 2026 22:41:56 GMT\r\ncache-control: max-age=172800\r\nx-cdn-host-id: AH0543\r\nx-proxy-cache: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72616,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 26.3 (Macintosh), datetime=2025:08:30 15:17:17], progressive, precision 8, 320x240, components 3","md5":"dc08b03725a02eb4bcce51a4c8bc3523","sha1":"833cebbe8351d267c41889bcae2a7060b73b2c47","sha256":"a6c47a6cd72ed353ef5b8b14eb91639b5a085c266b40021527d71874e77b7e3e","sha512":"ec649f021b9ccfd939c655659521cb3cee79713d91430c67933d5ad7e93c5f8fc9e9f50d323c4278bed3fa16a574d53ba0c55c44fe82da3344eb1f8771a74c5e","ssdeep":"1536:MAji72b6OQTAji72b6O5t6kf0k0RO6inwyxPkOdxGIw2:ri72bti72bN6kb0Q6inweckpw2","tlshash":"b663f139f3d2ef22e7f863784c51c6a3f102af4897932790bc2c65691b712a24c6d249","first_seen":"2025-09-02T19:18:23.955875Z","last_seen":"2026-05-25T10:53:19.655424Z","times_seen":1380,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":39,"dns":0,"connect":21,"send":0,"wait":21,"receive":46,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.storageimagedisplay.com/si/df/86/a1/df86a17c013d6d611c4c316a788bceb3aa091779ddda2e8baa8f20e874a22e14.png","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.storageimagedisplay.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 02:33:25 GMT","end":"Fri, 05 Jun 2026 02:33:24 GMT"},"fingerprint":{"sha1":"4A:66:11:51:1F:1F:F3:84:B6:E4:4F:81:C1:03:83:9F:01:17:7E:82","sha256":"DA:55:E3:02:D5:3C:4E:3A:51:ED:21:0D:F4:32:52:C2:C5:31:87:50:DC:AB:13:D9:93:4A:15:0C:D9:8C:D6:4F"}}},"request":{"raw":"GET /si/df/86/a1/df86a17c013d6d611c4c316a788bceb3aa091779ddda2e8baa8f20e874a22e14.png HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 08 Apr 2026 22:41:56 GMT\r\ncontent-type: image/png\r\ncontent-length: 45086\r\nserver: nginx/1.21.6\r\nlast-modified: Fri, 30 Jan 2026 12:20:07 GMT\r\netag: \"697ca1f7-b01e\"\r\nexpires: Fri, 10 Apr 2026 22:41:56 GMT\r\ncache-control: max-age=172800\r\nx-cdn-host-id: AH0543\r\nx-proxy-cache: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45086,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 320x240, components 3","md5":"87123eaf95e535261ad102ab95cd0246","sha1":"f52caba73ca12905586204c5b9e89a0d620871ef","sha256":"ddfd63f3462cd12677f379b5c2e5326649dc32c94adbd198bc9d8a4b16103d22","sha512":"8a28d183da1c4c7f4c12c97949160ee1a3d3aeff41547b211aad98d34e00d4ce57684065756e1df346371b738ec6bad05284ac0a388aa89209a2ee93727ebf2e","ssdeep":"768:CocEIiNszAeH3ihljPZFZLa0FqdD0TDD/gzWCSiXLgi5AEioVw0p:PcYNQAVlFFZLa045qwWCFbgi5AEi+w0p","tlshash":"b013f1646ba3b522cb11d4792a34c9db95f5290ee304551eb1f1d4e9a7202bb3f8ff02","first_seen":"2026-02-03T14:00:57.114814Z","last_seen":"2026-05-11T05:37:21.274303Z","times_seen":410,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":23,"send":0,"wait":61,"receive":21,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pl29077336.profitablecpmratenetwork.com/8c1b7af45264715c06aed705ff8c1fb1/invoke.js","fqdn":"pl29077336.profitablecpmratenetwork.com","domain":"profitablecpmratenetwork.com","tld":"com"},"ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:55.255Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"profitablecpmratenetwork.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Mar 2026 14:13:16 GMT","end":"Mon, 15 Jun 2026 14:13:15 GMT"},"fingerprint":{"sha1":"BC:8E:D7:91:CA:9C:82:79:1D:3B:0D:C4:5A:1C:38:F3:8E:BD:C6:B8","sha256":"33:27:4F:63:F0:BE:24:EB:26:AB:C6:CF:E1:2F:CD:8C:26:B0:D2:61:57:CF:32:A7:D3:E6:BE:24:A8:9F:34:82"}}},"request":{"raw":"GET /8c1b7af45264715c06aed705ff8c1fb1/invoke.js HTTP/1.1\r\nHost: pl29077336.profitablecpmratenetwork.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 08 Apr 2026 22:41:55 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 17516\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 5\r\nHost: pl29077336.profitablecpmratenetwork.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 2cdbfa3df23d84188f72b2cb4fcafe2c\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":47861,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (47859), with no line terminators","md5":"bb74948f75b5f8bcc03083d30c4d5fb6","sha1":"ce39a389c5884612fb5c5d6fb87e2dcb24cccabb","sha256":"2f3cf8cd9a014569f0f986e306f0fa35ee3c8c475c3cab50c29108c80fc07d8f","sha512":"86b10e40bcd21b70acab25f037f5169a2622b698a79ed057e788c392e9a3c40653bbc084ec57c8ef6d38a8eeb0dd118ce81a60a708f2da638432edd764630efb","ssdeep":"768:3JEOlhPyuK4VtK9OoQjPKpDHuiN1JyKxYNo0E6bO8xckTbkcA:+tg+pDBWucE7AFkD","tlshash":"cf23c6c87e40f23c16676076623fc50fe22e5f11978cfa98e167d5a82b6cf09993a705","first_seen":"2026-04-08T22:42:22.550091Z","last_seen":"2026-04-08T22:42:22.550091Z","times_seen":1,"resource_available":true,"data":null}},"time_used":855,"timings":{"blocked":331,"dns":46,"connect":98,"send":0,"wait":99,"receive":91,"ssl":186},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-08","alert":"Sinkholed","trigger":"pl29077336.profitablecpmratenetwork.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"myfreeemailsignature.com/favicon.ico","fqdn":"myfreeemailsignature.com","domain":"myfreeemailsignature.com","tld":"com"},"ip":{"addr":"173.28.194.34","port":443,"asn":30036,"as":"MEDIACOM-ENTERPRISE-BUSINESS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://myfreeemailsignature.com/","date":"2026-04-08T22:41:56.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"myfreeemailsignature.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Apr 2026 19:07:38 GMT","end":"Sun, 05 Jul 2026 19:07:37 GMT"},"fingerprint":{"sha1":"96:E7:43:B2:64:81:A6:D1:D8:B3:96:76:EC:B7:7D:A2:50:9E:C2:0D","sha256":"5A:45:7E:5F:CA:C0:D7:9F:D8:3F:6C:B9:CF:E5:02:6F:47:0D:0C:FB:DD:09:BF:21:13:69:8D:92:D4:05:25:3B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: myfreeemailsignature.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://myfreeemailsignature.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: dom3ic8zudi28v8lr6fgphwffqoz0j6c=f59ab984-ce3c-45b6-b79e-b4495b738bda%3A3%3A1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Wed, 08 Apr 2026 22:41:56 GMT\r\nvary: Origin\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/x-icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T04:20:17.182226Z","times_seen":17555689,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}