{"report_id":"9e258b86-a4c7-4233-a3d7-918e5dbf0ba6","version":6,"status":"done","tags":[],"date":"2025-08-17T01:53:50Z","url":{"schema":"http","addr":"room-backroom.xyz/","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":0,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"final":{"url":{"schema":"https","addr":"room-backroom.xyz/","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"title":"Backroom — ROOM"},"submit":{"url":{"schema":"http","addr":"room-backroom.xyz/","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":0,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-21T01:53:50Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.74.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2025-08-13T15:10:36.82984Z","alert_count":0,"request_count":3,"received_data":166873,"sent_data":1688,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-08-13T15:26:13.000794Z","alert_count":0,"request_count":1,"received_data":761315,"sent_data":446,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.ipwho.org","ip":{"addr":"69.62.76.167","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2025-05-08","domain_rank":0,"first_seen":"2025-07-11T11:18:46.569057Z","last_seen":"2025-08-13T13:06:08.210473Z","alert_count":0,"request_count":1,"received_data":405,"sent_data":437,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2025-08-13T15:14:14.224423Z","alert_count":0,"request_count":1,"received_data":12302,"sent_data":531,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"room-backroom.xyz","ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"domain_registered":"2025-08-15","domain_rank":0,"first_seen":"2025-08-17T01:53:52.587511Z","last_seen":"2025-08-17T01:53:52.587511Z","alert_count":12,"request_count":12,"received_data":5473708,"sent_data":5142,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"room-backroom.xyz/main.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"2775343500668bd6d58c77f761b0b75d","sha1":"cf37dd62a04cbd294bba714155e45e1a12b181fe","sha256":"321a4af44635e1a516f11c0c7646082063ab1e52ed273a4de63efc0b79b95ceb","sha512":"491368e7fe17f21fb2d4b4b45f53974574eae60b6a0f785ea392f5d1eea0f698ab3e691df56fc809ad44adf8f4741368dbe60a208dfae4b02689fe903bd5c2c6","ssdeep":"3072:pWURGEx9xWw3C9xWw3LlsxQvqTvrVZ7JN5f1SkksR3:sTmCls+K1T","tlshash":"1434a6952ec7f76dbed08fa297690c7eedc16c4686442512ee88a21030deff753da610","size":231059,"data":"","first_seen":"2025-08-17T01:53:55.756163Z","last_seen":"2025-08-17T01:53:55.756163Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/modals.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"ecbc5043a1e25f2bd5bbd6e3c3be49f0","sha1":"d66eb695679871221c52958d94029c6358b7613d","sha256":"6d0c2c8d032982e9a86a1bed14f709911058b6b693abb5d46335a0106c12c411","sha512":"38b9aedf74859ade1e5445634b338f560c4d0520ab126de202ad98942bc0f34e740b93c7123a3bc53dcdded31944c174ad06bf1ca006e137cb4e06a949e86088","ssdeep":"768:ywjvL/eQ0ae2vBKRDpoKvTQv4n59+Y44U7kFlaoGHv5:ywz2n59J4inM5","tlshash":"943311071cbe31361daf0fa3b7cc1a1b4e2eb351e612aaee71bd1446438bd74c5a5618","size":52833,"data":"","first_seen":"2025-07-20T10:23:41.460008Z","last_seen":"2026-07-27T00:59:02.776062Z","times_seen":745,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/bundle.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"29681f25e1e25a870bd6656b8d48646f","sha1":"7b8c8d1c3af639b6ec50c84660a9e9f0a3a2d3a3","sha256":"969be4f64afdeaca0568779c3b0f7291bc9a7185cc983a5104fbd90e4f901039","sha512":"69c94d52b83c5cfc9b4d86e042cf6b99ab9d00c1b9f417ed35f789a41b2d21a92606bef9e1a7a02e64622e31feecb9cdb451ed23f8fa7a69392a0575944867e9","ssdeep":"49152:LRIMXDbdUW4HlHZg+dY3yBgS6cUKZJNrl4G1SE0BuuJpxHiRo6r3XOWxYrowVpaz:Qg+wyBgSxUKZTRbUajO9U7","tlshash":"abc56d907395a46c03b352d458771101f339684aa40d80ecf7ecd9e7afb998a897bf39","size":2510372,"data":"","first_seen":"2025-07-20T10:23:41.470184Z","last_seen":"2026-07-27T00:59:02.779275Z","times_seen":711,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"Function","is_inline":false,"md5":"53489c28a3b03929fbd0322c75bdc6d9","sha1":"459679c86115e07aca84648cee893b18567a2137","sha256":"54edba43c5902604522efbb9e98054528bc70ffe963eedc14b637b45faf53733","sha512":"6cbd1163cf294af8931a923a6af919ede60cff69705d44aa8fa3ed0092585f5a9481217ab34ddb5e2f43f9cb6ca67e775a4654c98b8f03390edc247cf71e50a2","ssdeep":"3072:IhzqIKne9xWW3s9xWW3rlsVK9ITv9P37TVX11SkkAR7:FvWclsc0rV","tlshash":"8c2494552ec7b66dbed08fa297681c7eedc16c4686842502fe88621030dfff753da624","size":227267,"data":"","first_seen":"2025-08-17T01:53:55.76629Z","last_seen":"2025-08-17T01:53:55.76629Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/bundle.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"29681f25e1e25a870bd6656b8d48646f","sha1":"7b8c8d1c3af639b6ec50c84660a9e9f0a3a2d3a3","sha256":"969be4f64afdeaca0568779c3b0f7291bc9a7185cc983a5104fbd90e4f901039","sha512":"69c94d52b83c5cfc9b4d86e042cf6b99ab9d00c1b9f417ed35f789a41b2d21a92606bef9e1a7a02e64622e31feecb9cdb451ed23f8fa7a69392a0575944867e9","ssdeep":"49152:LRIMXDbdUW4HlHZg+dY3yBgS6cUKZJNrl4G1SE0BuuJpxHiRo6r3XOWxYrowVpaz:Qg+wyBgSxUKZTRbUajO9U7","tlshash":"abc56d907395a46c03b352d458771101f339684aa40d80ecf7ecd9e7afb998a897bf39","size":2510372,"data":"","first_seen":"2025-07-20T10:23:41.470184Z","last_seen":"2026-07-27T00:59:02.779275Z","times_seen":711,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/fpbundle.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"1c59909ad8d56060bf239a34a275da3d","sha1":"1164057a0631f6b5dd80387a1c3a9e332fb00bb4","sha256":"126a8b465ef8734b4d7a289781e0535cd283ccf24394e08c44f23ae300be3a5a","sha512":"39d33737c908bf2a1430f157990f931a0644471a0cf20de61721596e1330fe5867108db7e47d1869576710a72f886ef42e7492a2c0ed05fde2644f6d338e3eac","ssdeep":"768:v8UXI0Nc5VArhXDh1bnUsAq1++umYUT15+2gT/RcKrNcFV3BT/Vo:vN/NcnArV7f5+9cxT6","tlshash":"a413c7a873c67139a217b0719dcf4845b67d6d182289884dca2ec4a4b879d3dc77ecec","size":45503,"data":"","first_seen":"2025-07-11T11:18:53.943693Z","last_seen":"2026-07-27T00:59:02.766896Z","times_seen":743,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/modals.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"ecbc5043a1e25f2bd5bbd6e3c3be49f0","sha1":"d66eb695679871221c52958d94029c6358b7613d","sha256":"6d0c2c8d032982e9a86a1bed14f709911058b6b693abb5d46335a0106c12c411","sha512":"38b9aedf74859ade1e5445634b338f560c4d0520ab126de202ad98942bc0f34e740b93c7123a3bc53dcdded31944c174ad06bf1ca006e137cb4e06a949e86088","ssdeep":"768:ywjvL/eQ0ae2vBKRDpoKvTQv4n59+Y44U7kFlaoGHv5:ywz2n59J4inM5","tlshash":"943311071cbe31361daf0fa3b7cc1a1b4e2eb351e612aaee71bd1446438bd74c5a5618","size":52833,"data":"","first_seen":"2025-07-20T10:23:41.460008Z","last_seen":"2026-07-27T00:59:02.776062Z","times_seen":745,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/ethers@5.7.2/dist/ethers.umd.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"71f8c498e792c6179d4e2840228f777a","sha1":"b651545587f6257345dc3de9ddaa444b10dedf3e","sha256":"a66293a6a2bb4dee061a68612be0be3c5c0ab7e4068ab8d98a4a357baf664c73","sha512":"14371563e83bbdce425c035bad34a0d4ae6a2f2ae20ac183602134d8b8b5b5711874d40fbcb3c7344fab4f63237a2f0dedf65b7b458b870dbb8f64ab191a5d32","ssdeep":"12288:TfamYTKkkAJs8P+H8Xb2F/nNuwEYtnob6qQr:TfjkhPaNnN9EYtwo","tlshash":"35f43b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","size":760171,"data":"","first_seen":"2023-03-13T00:48:53Z","last_seen":"2026-07-27T00:59:02.764737Z","times_seen":3713,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/fpbundle.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"introduction_type":"scriptElement","is_inline":false,"md5":"1c59909ad8d56060bf239a34a275da3d","sha1":"1164057a0631f6b5dd80387a1c3a9e332fb00bb4","sha256":"126a8b465ef8734b4d7a289781e0535cd283ccf24394e08c44f23ae300be3a5a","sha512":"39d33737c908bf2a1430f157990f931a0644471a0cf20de61721596e1330fe5867108db7e47d1869576710a72f886ef42e7492a2c0ed05fde2644f6d338e3eac","ssdeep":"768:v8UXI0Nc5VArhXDh1bnUsAq1++umYUT15+2gT/RcKrNcFV3BT/Vo:vN/NcnArV7f5+9cxT6","tlshash":"a413c7a873c67139a217b0719dcf4845b67d6d182289884dca2ec4a4b879d3dc77ecec","size":45503,"data":"","first_seen":"2025-07-11T11:18:53.943693Z","last_seen":"2026-07-27T00:59:02.766896Z","times_seen":743,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"room-backroom.xyz/favicon.ico","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:28.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:28 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 4286\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:24:54 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"8484a3891dda2cf027a822bf160cb6c2","sha1":"0d1c0cea4ff30d910247d5594d31660e6f9ee941","sha256":"e833ce12a63e8c151d8f60d6de55b70ee013f79c4792deb0a6c6e636cec9ef8d","sha512":"ec707fd9c2ed13a9a65c99f6e1fb5438ccaa71a0a5abfc4b570a8bc48b98812f310a6a767e6a302bfbd0c11a43a2f59a88b54ddcd84928bdf039fc329c439e6c","ssdeep":"12:suyafKhdvBK0AbIaQ5BS3jUrCmCaiH3RWvP68iC:suyPhvnIQ5BJrCmXiH3UvP6z","tlshash":"839127236951dca5ca0813b8817fdfb832479dd7abe5ab6140e4fc1738321c08a96115","first_seen":"2025-08-17T01:53:55.751758Z","last_seen":"2025-08-17T01:53:55.751758Z","times_seen":1,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-17T01:53:26.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:27 GMT\r\nContent-Type: text/html\r\nContent-Length: 3719\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:30:46 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3719,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"65d1699344bb77c1a9e40c26dc5387ec","sha1":"ba75b7b7b5a5bd8add4cb24cf92412978cb4b363","sha256":"360a835e7f51742d813249e71a41dd02e5f4d552e4053287a55cdfab1a3e9657","sha512":"201be8224ff9d8f600c4738fd6c00ded5733017dbe9de183b03739e70a1e076378097515b29347b001fdef2b2038f310e6884b28f164b3389fb97ea1be3eb5a0","ssdeep":"","tlshash":"c571b7255a80742e743246922fe5224efa598003d3125ea47bde93678ff6d95c473f44","first_seen":"2025-08-17T01:53:55.754785Z","last_seen":"2025-08-17T01:53:55.754785Z","times_seen":1,"resource_available":false,"data":null}},"time_used":314,"timings":{"blocked":148,"dns":103,"connect":17,"send":0,"wait":18,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/main.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /main.js HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:27 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 231059\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:28:00 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":231059,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"2775343500668bd6d58c77f761b0b75d","sha1":"cf37dd62a04cbd294bba714155e45e1a12b181fe","sha256":"321a4af44635e1a516f11c0c7646082063ab1e52ed273a4de63efc0b79b95ceb","sha512":"491368e7fe17f21fb2d4b4b45f53974574eae60b6a0f785ea392f5d1eea0f698ab3e691df56fc809ad44adf8f4741368dbe60a208dfae4b02689fe903bd5c2c6","ssdeep":"3072:pWURGEx9xWw3C9xWw3LlsxQvqTvrVZ7JN5f1SkksR3:sTmCls+K1T","tlshash":"1434a6952ec7f76dbed08fa297690c7eedc16c4686442512ee88a21030deff753da610","first_seen":"2025-08-17T01:53:55.756163Z","last_seen":"2025-08-17T01:53:55.756163Z","times_seen":1,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/bundle.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.268Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /bundle.js HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:27 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 2510372\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:28:04 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2510372,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11784), with CRLF line terminators","md5":"a579f43be016af96b1d14b0be3ab2239","sha1":"eb0403b0e34d6943a3242206f9845843fab6d225","sha256":"9b2c009690d8d43f3a351bc36362316b6474ce1fc03c24fdd1cf2ce2da5b2509","sha512":"64befe664a2fbf04844b475a8b918dd5feed48a9c77110963a9f589be8e19e04d3a98233a44ae343b1efe20fafe18770dc18dc10e39402e822bf37c63d081619","ssdeep":"24576:LREHMe8DbdUW4HlHZg+dY3yBgS6cUKZd3NlNUQ4G1SE0Byz5o:LRIMXDbdUW4HlHZg+dY3yBgS6cUKZJNW","tlshash":"60254c9072a6f07603a755d864761101f2385854700d90ecfafc9debbfa988a867ff39","first_seen":"2025-07-26T22:48:52.272458Z","last_seen":"2026-07-27T00:59:02.770119Z","times_seen":673,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":39,"dns":0,"connect":19,"send":0,"wait":35,"receive":160,"ssl":22},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:35:11 GMT","end":"Mon, 29 Sep 2025 08:35:10 GMT"},"fingerprint":{"sha1":"43:A0:95:35:FB:C7:02:15:92:9E:20:20:0D:0A:E7:8F:93:61:52:CD","sha256":"F1:59:AE:4E:F0:84:C7:D9:0F:67:4F:CB:FE:A6:ED:7D:47:17:4F:83:AA:B4:ED:FE:F5:F2:69:A8:AB:43:0E:0B"}}},"request":{"raw":"GET /s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://room-backroom.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 14 Aug 2025 10:37:47 GMT\r\nexpires: Fri, 14 Aug 2026 10:37:47 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 28 May 2025 18:51:44 GMT\r\ncontent-type: font/woff2\r\nage: 227740\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-27T01:46:54.4345Z","times_seen":247153,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":86,"dns":5,"connect":7,"send":0,"wait":8,"receive":10,"ssl":44},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/fraunces/v37/6NU78FyLNQOQZAnv9bYEvDiIdE9Ea92uemAk_WBq8U_9v0c2Wa0KxC9TeA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:35:11 GMT","end":"Mon, 29 Sep 2025 08:35:10 GMT"},"fingerprint":{"sha1":"43:A0:95:35:FB:C7:02:15:92:9E:20:20:0D:0A:E7:8F:93:61:52:CD","sha256":"F1:59:AE:4E:F0:84:C7:D9:0F:67:4F:CB:FE:A6:ED:7D:47:17:4F:83:AA:B4:ED:FE:F5:F2:69:A8:AB:43:0E:0B"}}},"request":{"raw":"GET /s/fraunces/v37/6NU78FyLNQOQZAnv9bYEvDiIdE9Ea92uemAk_WBq8U_9v0c2Wa0KxC9TeA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://room-backroom.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 67304\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 14 Aug 2025 10:40:02 GMT\r\nexpires: Fri, 14 Aug 2026 10:40:02 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 29 May 2025 18:25:09 GMT\r\ncontent-type: font/woff2\r\nage: 227605\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":67304,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 67304, version 1.0","md5":"069cb90e11a337bf264eadfb15ad00f5","sha1":"48642176d960affe01a1a57fc8179e05c618793d","sha256":"7234ed860a9cc83045413c4faee63c960a8f2d1917adcf728119307d56e0d783","sha512":"1c076a1b528a83e283f57d408c8e4f0a629b8daa47e8e10e2607fa26e346b7ea5ad1d237f815be91b553adfe644227877cb4693d1db9568028b6c2c68ed3f1d2","ssdeep":"1536:suAREpsv3Xf8UR8UX2S6teGGD7BhviSVDQ2AV4QnsKBn3Fa9dT1G5w6:GdPXzeUX2S60GGD36uOZFATM","tlshash":"d663020d07b99b3c436f5c9319b2ede92e2ea41b2486f045feb7b891e4405c591bcc97","first_seen":"2025-01-24T12:50:21.10871Z","last_seen":"2026-07-27T01:52:00.533153Z","times_seen":3385,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":85,"dns":4,"connect":21,"send":0,"wait":15,"receive":7,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/ethers@5.7.2/dist/ethers.umd.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:28.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /npm/ethers@5.7.2/dist/ethers.umd.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 17 Aug 2025 01:53:28 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 155070\r\ncf-ray: 970589b71804712b-OSL\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 5.7.2\r\nx-jsd-version-type: version\r\netag: W/\"b996b-tlFUVYf2JXNF3D3p3apESxDe3z4\"\r\ncontent-encoding: br\r\nx-served-by: cache-fra-eddf8230173-FRA, cache-lga21927-LGA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: HIT\r\nage: 3690991\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=JouQoTKMbV5ByzCBmHPDtPZAcxubQl8YeBhzTfT0a3sVTDhfIYI24lCNas7r5oYEV3f62shhByWg8w8I5QnQAJDtoU6MOFdtzTb76GJ6Z7u2%2F9NWsJnEUPy4wHsy0es9K6c%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":760171,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"71f8c498e792c6179d4e2840228f777a","sha1":"b651545587f6257345dc3de9ddaa444b10dedf3e","sha256":"a66293a6a2bb4dee061a68612be0be3c5c0ab7e4068ab8d98a4a357baf664c73","sha512":"14371563e83bbdce425c035bad34a0d4ae6a2f2ae20ac183602134d8b8b5b5711874d40fbcb3c7344fab4f63237a2f0dedf65b7b458b870dbb8f64ab191a5d32","ssdeep":"12288:TfamYTKkkAJs8P+H8Xb2F/nNuwEYtnob6qQr:TfjkhPaNnN9EYtwo","tlshash":"35f43b80b3b1b0b583c729a4143f6046f63af46a505840a8f659faf279f9d4c957bb3c","first_seen":"2023-03-13T00:48:53Z","last_seen":"2026-07-27T00:59:02.764737Z","times_seen":3713,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":7,"dns":1,"connect":1,"send":0,"wait":10,"receive":5,"ssl":9},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:28.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"HEAD / HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://room-backroom.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"HEAD"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:28 GMT\r\nContent-Type: text/html\r\nContent-Length: 3719\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:30:46 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T01:51:03.161607Z","times_seen":17553488,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ipwho.org/me","fqdn":"api.ipwho.org","domain":"ipwho.org","tld":"org"},"ip":{"addr":"69.62.76.167","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:28.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipwho.org","organization":""},"issuer":{"commonName":"E6","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Jul 2025 16:08:31 GMT","end":"Tue, 14 Oct 2025 16:08:30 GMT"},"fingerprint":{"sha1":"87:88:D2:F8:B6:23:06:38:98:C4:B0:E2:06:68:C4:E3:63:EA:AB:2B","sha256":"21:76:B6:9A:29:3A:7D:88:85:23:77:5F:33:A5:A8:D9:7F:63:79:69:AD:62:6A:CC:8F:63:72:1D:81:74:45:82"}}},"request":{"raw":"GET /me HTTP/1.1\r\nHost: api.ipwho.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://room-backroom.xyz/\r\nOrigin: https://room-backroom.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Sun, 17 Aug 2025 01:53:29 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-07-27T01:32:27.164274Z","times_seen":544022,"resource_available":true,"data":null}},"time_used":704,"timings":{"blocked":283,"dns":1,"connect":136,"send":0,"wait":137,"receive":0,"ssl":143},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/backroom.svg","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /backroom.svg HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 13259\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:17:56 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13259,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4057d0b73b9d9f54c9d2cd2c70b31605","sha1":"fffb379e3e9fad25855ecdef43500831c0b6ded5","sha256":"1fa30d2499de19d05c55ca5b743c6387722eafa952075912a5109468ad2c74d2","sha512":"53a940e1586ac3c9bcd8eb02947812088bc378eafed6988b262ba530940b59448e299420af02e370706c2abd9499785fa0c8a2e950fa61c794d0f602c3159cc6","ssdeep":"192:LWWe8PwZessi/PNXl6Z2KPMMzUW1V3br1AlElfWUheMqhsMRhrQ4HiN2sWd:LWqPIehaXQZ2QMm/aCfN7qCMLrQLUd","tlshash":"fd5254ee5bd239e4c88886e3be1146a87e1f957b1b468b71c3bcdf2535068bce5508c1","first_seen":"2025-08-17T01:53:55.761117Z","last_seen":"2025-08-17T01:53:55.761117Z","times_seen":1,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":124,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/modals.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /modals.js HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:27 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 52833\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:27:54 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52833,"size_decoded":0,"mime_type":"text/javascript","magic":"Unicode text, UTF-8 text, with very long lines (52831), with no line terminators","md5":"ecbc5043a1e25f2bd5bbd6e3c3be49f0","sha1":"d66eb695679871221c52958d94029c6358b7613d","sha256":"6d0c2c8d032982e9a86a1bed14f709911058b6b693abb5d46335a0106c12c411","sha512":"38b9aedf74859ade1e5445634b338f560c4d0520ab126de202ad98942bc0f34e740b93c7123a3bc53dcdded31944c174ad06bf1ca006e137cb4e06a949e86088","ssdeep":"768:ywjvL/eQ0ae2vBKRDpoKvTQv4n59+Y44U7kFlaoGHv5:ywz2n59J4inM5","tlshash":"943311071cbe31361daf0fa3b7cc1a1b4e2eb351e612aaee71bd1446438bd74c5a5618","first_seen":"2025-07-20T10:23:41.460008Z","last_seen":"2026-07-27T00:59:02.776062Z","times_seen":745,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":39,"dns":0,"connect":19,"send":0,"wait":33,"receive":18,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/fpbundle.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.267Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /fpbundle.js HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:27 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 45503\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:27:56 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45503,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44961), with CRLF line terminators","md5":"1c59909ad8d56060bf239a34a275da3d","sha1":"1164057a0631f6b5dd80387a1c3a9e332fb00bb4","sha256":"126a8b465ef8734b4d7a289781e0535cd283ccf24394e08c44f23ae300be3a5a","sha512":"39d33737c908bf2a1430f157990f931a0644471a0cf20de61721596e1330fe5867108db7e47d1869576710a72f886ef42e7492a2c0ed05fde2644f6d338e3eac","ssdeep":"768:v8UXI0Nc5VArhXDh1bnUsAq1++umYUT15+2gT/RcKrNcFV3BT/Vo:vN/NcnArV7f5+9cxT6","tlshash":"a413c7a873c67139a217b0719dcf4845b67d6d182289884dca2ec4a4b879d3dc77ecec","first_seen":"2025-07-11T11:18:53.943693Z","last_seen":"2026-07-27T00:59:02.766896Z","times_seen":743,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":36,"dns":1,"connect":17,"send":0,"wait":35,"receive":19,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,300;9..144,400;9..144,700\u0026family=Inter:wght@400;500;600\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.260Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:35:11 GMT","end":"Mon, 29 Sep 2025 08:35:10 GMT"},"fingerprint":{"sha1":"DF:A1:DB:1F:BC:5E:31:D7:F8:FE:26:E3:B9:B3:02:98:B1:C8:50:EC","sha256":"A2:57:20:B6:AE:46:89:B9:39:C7:57:9B:1E:43:96:E3:5A:BC:7E:3F:1D:18:10:34:CC:53:3D:DB:78:4E:5C:21"}}},"request":{"raw":"GET /css2?family=Fraunces:opsz,wght@9..144,300;9..144,400;9..144,700\u0026family=Inter:wght@400;500;600\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 17 Aug 2025 01:53:27 GMT\r\ndate: Sun, 17 Aug 2025 01:53:27 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11616,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"5117636930aeaa7a8dbde534c74eabc6","sha1":"546a9a54cec1ecafeb9189f828dd78b063e5749b","sha256":"63b8fbf677240807e36d9397b47085617d6e3b67a87cf2b030299c2b95c496d5","sha512":"e9b533976502623468c93fdf8f9670f6a75c7e1a0e8db9a1e212593eefada7489293dd1b6ecbea19b26d2dbd3d3937cee713ce24217935fc45d1192b3e6cfaf0","ssdeep":"192:c0p0pEJpwppppEUpwwpwpEdp5xNktq346lDYxOLuq3/pl8xxruLq3iwllV:cTYgbGo4VJ","tlshash":"7d320e82442ba500eb971cc233cf3e36ae8e61846085c17d6ffd1c969cdad6a536871e","first_seen":"2025-08-17T01:53:55.763243Z","last_seen":"2025-08-17T01:53:55.763243Z","times_seen":1,"resource_available":false,"data":null}},"time_used":230,"timings":{"blocked":97,"dns":1,"connect":7,"send":0,"wait":30,"receive":0,"ssl":92},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/modals.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:28.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /modals.js HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:28 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 52833\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:27:54 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52833,"size_decoded":0,"mime_type":"text/javascript","magic":"Unicode text, UTF-8 text, with very long lines (52831), with no line terminators","md5":"ecbc5043a1e25f2bd5bbd6e3c3be49f0","sha1":"d66eb695679871221c52958d94029c6358b7613d","sha256":"6d0c2c8d032982e9a86a1bed14f709911058b6b693abb5d46335a0106c12c411","sha512":"38b9aedf74859ade1e5445634b338f560c4d0520ab126de202ad98942bc0f34e740b93c7123a3bc53dcdded31944c174ad06bf1ca006e137cb4e06a949e86088","ssdeep":"768:ywjvL/eQ0ae2vBKRDpoKvTQv4n59+Y44U7kFlaoGHv5:ywz2n59J4inM5","tlshash":"943311071cbe31361daf0fa3b7cc1a1b4e2eb351e612aaee71bd1446438bd74c5a5618","first_seen":"2025-07-20T10:23:41.460008Z","last_seen":"2026-07-27T00:59:02.776062Z","times_seen":745,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/fpbundle.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:28.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /fpbundle.js HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:28 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 45503\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:27:56 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45503,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44961), with CRLF line terminators","md5":"1c59909ad8d56060bf239a34a275da3d","sha1":"1164057a0631f6b5dd80387a1c3a9e332fb00bb4","sha256":"126a8b465ef8734b4d7a289781e0535cd283ccf24394e08c44f23ae300be3a5a","sha512":"39d33737c908bf2a1430f157990f931a0644471a0cf20de61721596e1330fe5867108db7e47d1869576710a72f886ef42e7492a2c0ed05fde2644f6d338e3eac","ssdeep":"768:v8UXI0Nc5VArhXDh1bnUsAq1++umYUT15+2gT/RcKrNcFV3BT/Vo:vN/NcnArV7f5+9cxT6","tlshash":"a413c7a873c67139a217b0719dcf4845b67d6d182289884dca2ec4a4b879d3dc77ecec","first_seen":"2025-07-11T11:18:53.943693Z","last_seen":"2026-07-27T00:59:02.766896Z","times_seen":743,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/logo.webp","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /logo.webp HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:27 GMT\r\nContent-Type: image/webp\r\nContent-Length: 1386\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:18:12 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1386,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"961be94d800dd4153e5607727b030b92","sha1":"05f270728dbca5576b54961bf8ef1210e37b4cff","sha256":"20a3e3119e65c32ccdc0583649dcb7d5f9b750acb45145f28d8b143bbcae06b4","sha512":"356d1125d21a23497f608a40d04a5cd2de05a5abc243a3dd7572429d53003ca23a30432cc4b4440f54659931d12806d938015a9cb45e0cf1e7d38fbdd7f83995","ssdeep":"","tlshash":"c521d8e17df3e4e0f45cbe996c0e745a7eea91519f423cbd06c46180a194d146068c41","first_seen":"2025-08-17T01:53:55.764379Z","last_seen":"2025-08-17T01:53:55.764379Z","times_seen":1,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":126,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:27.481Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Jul 2025 08:35:11 GMT","end":"Mon, 29 Sep 2025 08:35:10 GMT"},"fingerprint":{"sha1":"43:A0:95:35:FB:C7:02:15:92:9E:20:20:0D:0A:E7:8F:93:61:52:CD","sha256":"F1:59:AE:4E:F0:84:C7:D9:0F:67:4F:CB:FE:A6:ED:7D:47:17:4F:83:AA:B4:ED:FE:F5:F2:69:A8:AB:43:0E:0B"}}},"request":{"raw":"GET /s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://room-backroom.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 14 Aug 2025 10:37:47 GMT\r\nexpires: Fri, 14 Aug 2026 10:37:47 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 28 May 2025 18:51:44 GMT\r\ncontent-type: font/woff2\r\nage: 227740\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-27T01:46:54.4345Z","times_seen":247153,"resource_available":false,"data":null}},"time_used":170,"timings":{"blocked":83,"dns":3,"connect":10,"send":0,"wait":20,"receive":5,"ssl":47},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"room-backroom.xyz/bundle.js","fqdn":"room-backroom.xyz","domain":"room-backroom.xyz","tld":"xyz"},"ip":{"addr":"213.111.154.75","port":443,"asn":0,"as":"","country":"Ukraine","country_code":"UA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://room-backroom.xyz/","date":"2025-08-17T01:53:28.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.room-backroom.xyz","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Fri, 15 Aug 2025 22:27:30 GMT","end":"Thu, 13 Nov 2025 22:27:29 GMT"},"fingerprint":{"sha1":"6C:CF:6D:02:A6:C5:87:88:5D:B6:E0:77:1F:6E:6F:EC:99:A0:BA:63","sha256":"61:FC:66:AA:56:A8:4B:A6:88:8C:40:6F:CF:55:82:0A:25:65:CF:F7:36:77:75:97:AA:D3:08:B6:B9:41:45:7B"}}},"request":{"raw":"GET /bundle.js HTTP/1.1\r\nHost: room-backroom.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://room-backroom.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 17 Aug 2025 01:53:28 GMT\r\nContent-Type: text/javascript\r\nContent-Length: 2510372\r\nConnection: keep-alive\r\nLast-Modified: Sat, 16 Aug 2025 04:28:04 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2510372,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11784), with CRLF line terminators","md5":"a579f43be016af96b1d14b0be3ab2239","sha1":"eb0403b0e34d6943a3242206f9845843fab6d225","sha256":"9b2c009690d8d43f3a351bc36362316b6474ce1fc03c24fdd1cf2ce2da5b2509","sha512":"64befe664a2fbf04844b475a8b918dd5feed48a9c77110963a9f589be8e19e04d3a98233a44ae343b1efe20fafe18770dc18dc10e39402e822bf37c63d081619","ssdeep":"24576:LREHMe8DbdUW4HlHZg+dY3yBgS6cUKZd3NlNUQ4G1SE0Byz5o:LRIMXDbdUW4HlHZg+dY3yBgS6cUKZJNW","tlshash":"60254c9072a6f07603a755d864761101f2385854700d90ecfafc9debbfa988a867ff39","first_seen":"2025-07-26T22:48:52.272458Z","last_seen":"2026-07-27T00:59:02.770119Z","times_seen":673,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-17","alert":"Sinkholed","trigger":"room-backroom.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}