{"report_id":"a3be18b1-2b4c-41ac-8561-a1287d672350","version":6,"status":"done","tags":[],"date":"2026-02-27T06:32:08Z","url":{"schema":"http","addr":"velcuri.io","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"velcuri.io/","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"title":"(1) New Message!","dom":{"size":56769,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c6d5f337f1350e6ba86cc161117bda13","sha1":"d3aa1b06e5f5ea93c9618482d0ea00505fda7559","sha256":"76cc4921ad57cb5280e8e62c9adb1b3496b6a14b54bd1fb382615e63d25b8054","sha512":"5b47cf16892432708cef3d66a0f6aefef0d9cc1eb5207530f911f7cfb17c0cf9d0949ab35bf7447c5c68a79c2684cb0489a09b0c5205563a152666998ffd5f02","ssdeep":"384:FQ9lzpRpeiti8TKTbOb4HuHbFlFRFPFYWxyYydZZZQZjZ/fbfGO3O+pypiMR8HlF:WpRpeiti/bOb4HuHbFlFRFPFYWMSuF2","tlshash":"81438f9b2dd6410096164664e3ee6f28261c85c3181becf9b3a568ce8f15f7c93db60f","dom_hash":"domhash46b604aaa8817661f3941ebf25e5d86c","first_seen":"2026-02-27T06:32:24.928463Z","last_seen":"2026-02-27T06:32:24.928463Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"velcuri.io","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-03T06:32:08Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":23}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"protrafficinspector.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"pl27534969.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"pl27534969.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"pl27534969.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-02-22T22:14:59.650342Z","alert_count":0,"request_count":1,"received_data":43971,"sent_data":545,"comment":"","tags":null,"fingerprints":null},{"fqdn":"realizationnewestfangs.com","ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-09-03","domain_rank":0,"first_seen":"2025-10-02T06:26:57.543488Z","last_seen":"2026-02-27T06:15:10.842256Z","alert_count":4,"request_count":2,"received_data":93565,"sent_data":953,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"pl27534969.effectivegatecpm.com","ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2025-10-07","domain_rank":0,"first_seen":"2026-02-27T03:28:37.917564Z","last_seen":"2026-02-27T03:28:37.917564Z","alert_count":3,"request_count":1,"received_data":108682,"sent_data":459,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"weirdopt.com","ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-07-01","domain_rank":37519,"first_seen":"2025-07-08T12:55:47.272157Z","last_seen":"2026-02-26T11:37:33.494036Z","alert_count":3,"request_count":1,"received_data":377,"sent_data":413,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-02-22T22:18:02.864626Z","alert_count":0,"request_count":1,"received_data":17441,"sent_data":430,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"wayfarerorthodox.com","ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-09-03","domain_rank":0,"first_seen":"2025-08-08T11:06:50.216151Z","last_seen":"2026-02-27T02:47:25.217095Z","alert_count":24,"request_count":8,"received_data":11288,"sent_data":7022,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"protrafficinspector.com","ip":{"addr":"52.29.128.180","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2025-06-18","domain_rank":614186,"first_seen":"2025-07-25T22:45:21.95813Z","last_seen":"2026-02-25T19:05:35.017547Z","alert_count":1,"request_count":1,"received_data":419,"sent_data":436,"comment":"","tags":null,"fingerprints":null},{"fqdn":"preferencenail.com","ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-07-01","domain_rank":20606,"first_seen":"2025-07-08T12:55:47.271261Z","last_seen":"2026-02-26T05:36:47.065641Z","alert_count":6,"request_count":2,"received_data":171912,"sent_data":816,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.show-sb.com","ip":{"addr":"172.67.170.115","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-08-20","domain_rank":187612,"first_seen":"2024-08-31T03:46:04Z","last_seen":"2026-02-25T22:03:32.699781Z","alert_count":2,"request_count":1,"received_data":1858,"sent_data":471,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"flushpersist.com","ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2025-07-01","domain_rank":23810,"first_seen":"2025-07-08T10:43:12.76905Z","last_seen":"2026-02-26T05:36:47.125303Z","alert_count":6,"request_count":2,"received_data":1060,"sent_data":1522,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"raw.githubusercontent.com","ip":{"addr":"185.199.109.133","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2014-02-06","domain_rank":22021,"first_seen":"2014-03-01T07:08:08Z","last_seen":"2026-02-25T16:03:01.529093Z","alert_count":0,"request_count":1,"received_data":65287,"sent_data":489,"comment":"","tags":null,"fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"creative-sb1.com","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-07-01","domain_rank":22211,"first_seen":"2025-08-08T09:32:32.509707Z","last_seen":"2026-02-25T20:42:18.329747Z","alert_count":18,"request_count":6,"received_data":190470,"sent_data":2733,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"velcuri.io","ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-08-12","domain_rank":0,"first_seen":"2025-11-18T14:54:49.648644Z","last_seen":"2026-02-27T03:28:38.41086Z","alert_count":0,"request_count":6,"received_data":860736,"sent_data":2697,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.ppv.to","ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-11-04T01:29:46.760657Z","last_seen":"2026-02-25T20:30:49.430945Z","alert_count":0,"request_count":12,"received_data":179894,"sent_data":5688,"comment":"","tags":null,"fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"realizationnewestfangs.com/08/b9/d8/08b9d8469ec4ed128677c2468d462141.js","fqdn":"realizationnewestfangs.com","domain":"realizationnewestfangs.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f9c57db5e20caf690a74768a12e5a27","sha1":"0aa91d1493fb1c51c9366ec6ef7e3b9fcab3329b","sha256":"baca253acd1da8c52707965e77f0e7d094af4157f4a00554476f00fc8c2b2468","sha512":"be1df44e4fd21d03e3c21b061658265d078e746b8da44ae3d5915e64d6d561edcaf6dcf19cc4f8e448002d2933dbd294eb752276233f4d800b86f0acc6605142","ssdeep":"1536:w5f97i5KqAGQDSAiLoHL0cTIgV2BOPsuUd7s/KiR1WwurV4aYLuvGgIo5+phrtX/:wm5KTGQDSAiLoHQcTIgV2BGsuUd7s/Ko","tlshash":"2493d84c3f82b0d41397707b762f902bf23b5c955868e88de243adac5da9719a337e05","size":92188,"data":"","first_seen":"2026-02-27T06:32:24.99891Z","last_seen":"2026-02-27T06:32:24.99891Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","size":85379,"data":"","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-09T00:47:05.978823Z","times_seen":26097,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"creative-sb1.com/sb/notifications/games/lust-goddess/6/js/jquery.min.js","fqdn":"creative-sb1.com","domain":"creative-sb1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6326c600df01e3bfb9b40e1aa08176f8","sha1":"6b4fb754d29b297b539bf62ba9b4eaf0f33f314a","sha256":"df34524351c5fabc921a89183b5da5667aebd7b9e9a1c52255c76ff722935ea3","sha512":"641aaeecb9b89bcc319cabfef18f76faa9b1ba79f9de30c6d07f22d385fc78ac3f11a718fe9ec96f8a13d82e3dff4ca34944ccb449a4ef8e378ad65dfad581c0","ssdeep":"1536:oP10iSi65U/dXXeyhzeBuG+HYE0mdDuJO1z6Oy4sh3J1x72BjmN7TwpDKba98Hri:f+41hJiz6fhdlTqya98Hri","tlshash":"eb83d6d9b2c67062977734b851bf510bb17a98dab40c8c60f0a4d8e47eb4a8d517bf2c","size":84384,"data":"","first_seen":"2023-03-07T01:10:11Z","last_seen":"2026-08-08T17:57:23.737822Z","times_seen":13336,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"90a9049bd9feb99c8c0873fecc4ad53c","sha1":"731742487307886d08bb6082bf222d4b89ddf016","sha256":"c1e109325bbe8c48bcfba464357c06344ca1e0efd7081ff8ae640f879b98a9fd","sha512":"a3e2af6e62be3254d09c5ee619c5fc632f6af40e13df1a70ffdc48e2e514dab3adb00e6b7a770fda3e08f237310489f6146df21cdf947d6ebf712fe42bd847ba","ssdeep":"","tlshash":"52f02d9c104ac330de7bf0d0d0873b55762a079691051289b43cf66f2d74f5583c2c9b","size":607,"data":"","first_seen":"2026-02-27T06:32:25.007011Z","last_seen":"2026-02-27T06:32:25.007011Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"velcuri.io/registerSW.js","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1872c500de691dce40960bb85481de07","sha1":"b83dfcba8d2c57ca8837324bf395f34748033a50","sha256":"9742073ef7fc795e7673d98f272992843298426a0ffd8cb3507784df5143608b","sha512":"bf592ecb654fd8c3dba5db1816c3e454d72e3ef9cf078ca71314b68782e8f564b585ef21d7ca0b4a69540d2843ec713058d86cf40419b6b099f58df5f6f82041","ssdeep":"","tlshash":"2cc02b4fca4dc93e0830e0324c0b7b03331f0385c080049007f2030850c3414d1ae481","size":134,"data":"","first_seen":"2023-03-11T15:21:23Z","last_seen":"2026-08-09T00:21:37.622677Z","times_seen":15988,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pl27534969.effectivegatecpm.com/de/ff/c0/deffc03c7ca644daeac5d42043d99bb9.js","fqdn":"pl27534969.effectivegatecpm.com","domain":"effectivegatecpm.com","tld":"com"},"ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"51e0f699c2b2ce7581c2bdd0334429b8","sha1":"cf739369347fc5cc95258d0f6e4b522bb8b76f3a","sha256":"c5bfad39296e84f02e3cade1f3db2982ad2dcdf064b40275f2d08de9504a52a2","sha512":"b6e4e8755ba42e3ff5149df4561f1dcbc497f9f02f954802e10364a06ffdb4f9e8912e0c88208838f3c9ac31e4815584d12ffb152b7c75e00f5398726e7103a2","ssdeep":"1536:W6wV1LAGB7i2tDV62GWcGQ0WYmQI196wr/PsZX7EMh3uwV5r7hukjKr:1w37XE6wrX0XwMh3uwV5r7BC","tlshash":"65b3e98c3f50f1dd02a27033153f680af0299e9220cde5a8e247f5957ab979ae43df65","size":107704,"data":"","first_seen":"2026-02-27T06:32:24.996657Z","last_seen":"2026-02-27T06:32:24.996657Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"velcuri.io/registerSW.js","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1872c500de691dce40960bb85481de07","sha1":"b83dfcba8d2c57ca8837324bf395f34748033a50","sha256":"9742073ef7fc795e7673d98f272992843298426a0ffd8cb3507784df5143608b","sha512":"bf592ecb654fd8c3dba5db1816c3e454d72e3ef9cf078ca71314b68782e8f564b585ef21d7ca0b4a69540d2843ec713058d86cf40419b6b099f58df5f6f82041","ssdeep":"","tlshash":"2cc02b4fca4dc93e0830e0324c0b7b03331f0385c080049007f2030850c3414d1ae481","size":134,"data":"","first_seen":"2023-03-11T15:21:23Z","last_seen":"2026-08-09T00:21:37.622677Z","times_seen":15988,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","size":85379,"data":"","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-09T00:47:05.978823Z","times_seen":26097,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"velcuri.io/assets/index-Cr2HM40C.js","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cba7c4eb528b767dce36ff736c811012","sha1":"78fe0ba6aec980ee7352c4bf740777763cb47e50","sha256":"8098ad41af002b1e533e9d55bd12d61738b5ac07cc19a4804196875565b8fcb9","sha512":"782298a8f0c76769a599dc1cf3a2a7708afa72f288afe78235c784d0eaba94efeb3b9b322edcb28c8dcd57930c1a38a706973cc23eb7171f868750d13583ef69","ssdeep":"24576:CJSY4ddQri+aUY45Abxln5gUlwSEkMS1qjxm/++ArDBsswMt7Wxe0gpiHTa7FA02:9Y4ddQri+aUY45Abxln5gUlwSEkMS1qG","tlshash":"1f055be932aaa4169bd146c5507b4112733d7c0a740cc4bcfa3dedeb2a65941b07bfb8","size":847898,"data":"","first_seen":"2026-02-07T11:51:02.357925Z","last_seen":"2026-02-27T06:32:24.952679Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"creative-sb1.com/sb/notifications/games/lust-goddess/6/img/close.png","fqdn":"creative-sb1.com","domain":"creative-sb1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.086Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"creative-sb1.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Feb 2026 22:50:15 GMT","end":"Sat, 23 May 2026 23:48:46 GMT"},"fingerprint":{"sha1":"E0:64:EB:B0:39:B0:1B:31:05:CE:A0:93:C8:74:E7:A4:DE:D1:B3:77","sha256":"6D:BC:A3:C7:8F:67:2C:FE:E1:7A:88:EA:6C:8E:07:D4:1D:1F:CA:FD:54:30:02:80:22:B2:74:B5:95:C4:99:75"}}},"request":{"raw":"GET /sb/notifications/games/lust-goddess/6/img/close.png HTTP/1.1\r\nHost: creative-sb1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Feb 2026 06:31:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 7005\r\nserver: cloudflare\r\nlast-modified: Thu, 10 Apr 2025 14:45:57 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"67f7d9a5-1b5d\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\naccept-ranges: bytes\r\nage: 1306709\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nL9Qd3p22poI3oQ7SBYvzthQR%2Bm38eRpA3XqLMyd01HVhp%2FBoF2x2c2AqQ2VkE9osk5vo%2BIrVKOhCL1%2BIlNQbjhjHIGrdZMvhDA%2FtMLRGOg%3D\"}]}\r\ncf-ray: 9d45a43a08b92efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7005,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"5127599f81c439cb0cf21166da26e991","sha1":"a750620e45c25855fb32ede5f1adb69ad28c1eeb","sha256":"9402058e0a31e79cd70001ebb397de51144d6e638a482f33bcee9a94dc20a6ff","sha512":"4e01869e43212009dc3811b4fc2303c39ab9aa123ce034ff4df220539a1e65784835b6cb0873cea4f6de027a7dcf1dd440ac0631e6b9c9db9085804473e3a0a8","ssdeep":"192:FkknNHG5WNN4kVyitdix/Inm2I6BRvBevoIPkucZ:9nNmoN4kVyiswm2I6BFBpuI","tlshash":"dee17d19dda17e1005d57f8a2fef815243638390c2856282dced8c5237e40f1ec6e4cb","first_seen":"2025-07-04T18:28:09.283921Z","last_seen":"2026-08-08T08:20:17.879648Z","times_seen":3265,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcreative-sb1.com%2Fsb%2Fnotifications%2Fgames%2Flust-goddess%2F6%2Fjs%2Fscript.js\u0026l=392\u0026fd=480","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.674Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcreative-sb1.com%2Fsb%2Fnotifications%2Fgames%2Flust-goddess%2F6%2Fjs%2Fscript.js\u0026l=392\u0026fd=480 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl28382109=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:50 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":110,"timings":{"blocked":15,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/impr.gif?sid=H4sIAAAAAAAC_1RSy4scRRiv3t1bDmJWBQ9CHzwoOrP9mpmeBBIIvkDdDSYxh5zq1ZNyarraru6ZyZw2RjyvNy9Cz292syIi5j-QWQ_KgmAfhDlkET15E4ScZWYHFr_D933Fryh-j_piWp6RBkq6uPmhmSit6U6r6bmv3VWpMCPr7t52fa_pXXXvqrQdXXXHy5YPr_hh1PRed9-VvG92As_3PN_z3XdULhMz3lmhUNl3Xb_Z9ZpR0PRbEcb5_8-2dGCpAzE8I5ehRP3cX8k9KD5HOvjhLWn7hcnefHtQalqYHENxfCftp2aUYnCxJrmDJD1e34axNSFfbcCkx2sFMMPDpQIwVZONl56CpcdrmmDDo3OmTEOmYOISRsM5pJ5D0Tm4eQQlfiMAF9jdQzp4vGvyEX1wjtIlWpOtZ_9CjWqy9fQFpIPvb2g1dm8ZXRbKpBbjpIIaz6F6c2TlCYqJAzU6AS8-gxK_kp1nHyAdHO5ZbaDE4tVOEtF2nISNQIRxI4oT2Yj9Fm0kLclCzrsR64iVRSqZg9pNlNZBqRyUiYMyczAQCzfy4oj7NGwnXcE7XkSjSEjmdePA82iXd1Dyh1DiADzfR5bvo68OYO9XsMKBLQiGojoS2ga2eiy0LZm_nsF6htXMFL0pOzJFT6Yd0PwAuagOVfapfQRebM4miRUzs2yUFdWMMlHNlCg2ptkZeX7pm_Nk-2v05cL1YtYVcdTuSh5J4Qdxu9PhQdSORdQO_MiHVRWU3QC1DiaqJjffuIxM1WTz4y0wegKrT8DVNmj5CuioAr1fYZJ-O5Sal7lqKgNhKmTFFooHzlSfke3ZR7dv_LgKj738DSQ_vf4PWRV4XiHLK3yifiLo6YdP9rJCDdSELtO8VdBCboKqmly6JsBVTV7c-HP1sTq_74Nn-7DZxVvWELDMgVY1ee_eH9Dy9PrfP78vrg1_AWUVrDwl6wK72Kf2c_RyB0w7M6Zz55DpXH95TtWqhZuEMuCeF3fafhgn0g8jwZNWHHVFm3phKFHYWk2v3PkvAAD__6xp3jXaAwAA","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /impr.gif?sid=H4sIAAAAAAAC_1RSy4scRRiv3t1bDmJWBQ9CHzwoOrP9mpmeBBIIvkDdDSYxh5zq1ZNyarraru6ZyZw2RjyvNy9Cz292syIi5j-QWQ_KgmAfhDlkET15E4ScZWYHFr_D933Fryh-j_piWp6RBkq6uPmhmSit6U6r6bmv3VWpMCPr7t52fa_pXXXvqrQdXXXHy5YPr_hh1PRed9-VvG92As_3PN_z3XdULhMz3lmhUNl3Xb_Z9ZpR0PRbEcb5_8-2dGCpAzE8I5ehRP3cX8k9KD5HOvjhLWn7hcnefHtQalqYHENxfCftp2aUYnCxJrmDJD1e34axNSFfbcCkx2sFMMPDpQIwVZONl56CpcdrmmDDo3OmTEOmYOISRsM5pJ5D0Tm4eQQlfiMAF9jdQzp4vGvyEX1wjtIlWpOtZ_9CjWqy9fQFpIPvb2g1dm8ZXRbKpBbjpIIaz6F6c2TlCYqJAzU6AS8-gxK_kp1nHyAdHO5ZbaDE4tVOEtF2nISNQIRxI4oT2Yj9Fm0kLclCzrsR64iVRSqZg9pNlNZBqRyUiYMyczAQCzfy4oj7NGwnXcE7XkSjSEjmdePA82iXd1Dyh1DiADzfR5bvo68OYO9XsMKBLQiGojoS2ga2eiy0LZm_nsF6htXMFL0pOzJFT6Yd0PwAuagOVfapfQRebM4miRUzs2yUFdWMMlHNlCg2ptkZeX7pm_Nk-2v05cL1YtYVcdTuSh5J4Qdxu9PhQdSORdQO_MiHVRWU3QC1DiaqJjffuIxM1WTz4y0wegKrT8DVNmj5CuioAr1fYZJ-O5Sal7lqKgNhKmTFFooHzlSfke3ZR7dv_LgKj738DSQ_vf4PWRV4XiHLK3yifiLo6YdP9rJCDdSELtO8VdBCboKqmly6JsBVTV7c-HP1sTq_74Nn-7DZxVvWELDMgVY1ee_eH9Dy9PrfP78vrg1_AWUVrDwl6wK72Kf2c_RyB0w7M6Zz55DpXH95TtWqhZuEMuCeF3fafhgn0g8jwZNWHHVFm3phKFHYWk2v3PkvAAD__6xp3jXaAwAA HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl28382109=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:51 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nset-cookie: iprc_l+488c237cdf58f287e261e78f00173fb5=6429096; expires=Sat, 28 Feb 2026 06:31:51 GMT; path=/; secure; SameSite=None\niprc_l:6429096=3; expires=Sat, 28 Feb 2026 06:31:51 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 3\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 8945bf34a3f3105411c4c88e97212e70\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":103,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"protrafficinspector.com/stats","fqdn":"protrafficinspector.com","domain":"protrafficinspector.com","tld":"com"},"ip":{"addr":"52.29.128.180","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.842Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"statistics.it.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 18 Feb 2026 00:00:00 GMT","end":"Fri, 19 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"FF:73:E7:93:27:CB:4F:C3:84:85:D5:0E:06:52:E6:94:2D:2B:A5:C6","sha256":"09:27:72:13:57:CD:B4:25:3A:BE:58:AD:CC:13:D2:7D:D4:D4:F6:12:80:69:D9:B9:38:71:43:36:A9:56:FE:70"}}},"request":{"raw":"GET /stats HTTP/1.1\r\nHost: protrafficinspector.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nOrigin: https://velcuri.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Feb 2026 06:31:47 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 40\r\nserver: fasthttp\r\naccess-control-allow-origin: https://velcuri.io\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\nset-cookie: uid_id2=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d:3:1; expires=Mon, 25 Feb 2036 06:31:47 GMT; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"ca5085938401a39b329c20843f2a074d","sha1":"1621999f27b32f82d3d11f7dcf7b1035d15c9a60","sha256":"28aa7464fb0b956a3acfb3678116e1458a9bd2e24178e8f26ed1e8669b6b6a5b","sha512":"6fd2271bd373721c54aa68f9ee8da9b97ca65cfd23c2dce4cc468e54ea2259c682a8ce4daca303ccfb831dd51eed2bbb4168e555b92eeb7ed553fff9b326c11b","ssdeep":"","tlshash":"25900411d4130c35451504544c0cdd47fd45d30f0113f3c75c4453f14d1144145d007d","first_seen":"2026-02-27T06:32:24.937164Z","last_seen":"2026-02-27T06:32:24.937164Z","times_seen":1,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":121,"dns":33,"connect":22,"send":0,"wait":22,"receive":0,"ssl":69},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"protrafficinspector.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"velcuri.io/vite.svg","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.358Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"velcuri.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 20 Jan 2026 16:15:59 GMT","end":"Mon, 20 Apr 2026 17:15:54 GMT"},"fingerprint":{"sha1":"D1:D0:C2:54:8C:C7:0B:4D:D0:C3:E8:BC:B5:34:0E:BA:D7:52:FD:BF","sha256":"38:20:BC:EA:06:B3:C1:1D:B9:A8:40:FC:59:03:34:07:2C:0C:21:C9:B3:CB:6F:C3:F7:F3:11:7F:29:B2:0A:D4"}}},"request":{"raw":"GET /vite.svg HTTP/1.1\r\nHost: velcuri.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: dom3ic8zudi28v8lr6fgphwffqoz0j6c=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d%3A3%3A1; pp_main_deffc03c7ca644daeac5d42043d99bb9=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: accept-encoding\r\npriority: u=6,i=?0\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\ndate: Fri, 27 Feb 2026 06:31:48 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2EzY1guYPkiVClTo%2BZHCR4zhPc1oIJl6g2PvuljVgJLBx%2BDrNSXpwOxlUUGVY58wuH6G0jd9PkqvQCskgjs90Rb5c4ojx5cmssQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"971db90182ee109ebef3f8d055503f61\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9d45a42f3afd1525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1497,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8e3a10e157f75ada21ab742c022d5430","sha1":"f7f39d7237b791a945d52a5cd7a8fb365f313366","sha256":"4a748afd443918bb16591c834c401dae33e87861ab5dbad0811c3a3b4a9214fb","sha512":"fbf065e26d907454cb432a17d831f448e1c3df0f33cd681ccc52b63e5bc26bc9e4de08591a2de579e5b05219fcffd3b4d4261ada6fa55299e731343df860488d","ssdeep":"","tlshash":"2031451fda7fd4fec0a6cb48e612b047962c30d95e41c5b4d9845f0e64a19f17c0aa64","first_seen":"2023-05-18T16:20:30Z","last_seen":"2026-08-08T23:16:54.043057Z","times_seen":6376,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/08315ad57706c7a611c612681a37da0c-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/08315ad57706c7a611c612681a37da0c-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=pi1jA2IOx5SNpIwo; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:49 GMT\n__ddg10_=1772173909; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:49 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:49 GMT\n__ddg1_=n4fQ0R5fLri1eiMxF5Uc; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:49 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 16780\r\nlast-modified: Thu, 26 Feb 2026 05:00:41 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd379-418c\"\r\nage: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":16780,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"e296700e0d57527a1bef118940fd6470","sha1":"bf369b0d785364aceeee7fc9fe279d892e11ad40","sha256":"5a6da27515fe9a5f73ed00df2c6eca3e1354f3e85f520daff15d621681991c29","sha512":"a5b2eab577f7247ca82c1ef8f71ee5da94b63b79f76f29ee64b273811007483988b428be3259d678b9984707c35e1b7427f3a9685ad388dc7c98c96e8d594684","ssdeep":"384:R4mGu1oCKbbBN36+9KOUH0RrZLWYbqCncLSDI:R4mt11WbBN36Ke0RlCYb7ncSU","tlshash":"0e72c02d4b309b518ac9dcc1381cc215430fdef0dc9b59354dee8bb5f660a65ab31a76","first_seen":"2026-02-27T03:28:40.593815Z","last_seen":"2026-02-27T06:32:24.942898Z","times_seen":2,"resource_available":false,"data":null}},"time_used":788,"timings":{"blocked":344,"dns":61,"connect":26,"send":0,"wait":85,"receive":1,"ssl":64},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/47257eaf9b58d1c8c220045d6ec01846-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/47257eaf9b58d1c8c220045d6ec01846-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=dXYBrURiB3Oh0HHR; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg10_=1772173908; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg1_=Fyjbvcm5TskWEJjid8vx; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:48 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 13321\r\nlast-modified: Thu, 26 Feb 2026 05:00:41 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,HIT\r\netag: \"699fd379-3409\"\r\nage: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":13321,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"83c87c079ab4675509cd9b9a2616c593","sha1":"eec19271d023bd4e0c03e428724c0327201374cc","sha256":"c996730deb4328a810b14ecf691d087f1f51d34aee9f491743138ca7668a7bdb","sha512":"95ab4155a514c063070515442633d67fbc8ae60b556ac64897705fcf024485f9dfd39b1cfdb20a1abd385ac074325dd2689523196210f6a8122f5de847ded692","ssdeep":"384:RZip1dLd7BTfBd9NbK+LgdDxp1TR55555555Y:Rohd7TNpgfH5555555G","tlshash":"8652c06436568dc2fb8861e6f0f0e53ac6d381c0691f86010d2485a97a2dc76c7bc39f","first_seen":"2026-02-27T03:28:40.581208Z","last_seen":"2026-02-27T06:32:24.948269Z","times_seen":2,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":98,"dns":0,"connect":0,"send":0,"wait":33,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcreative-sb1.com%2Fsb%2Fnotifications%2Fgames%2Flust-goddess%2F6%2Fcss%2Fmagic.css\u0026l=45054\u0026fd=519","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.493Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcreative-sb1.com%2Fsb%2Fnotifications%2Fgames%2Flust-goddess%2F6%2Fcss%2Fmagic.css\u0026l=45054\u0026fd=519 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl28382109=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:50 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF","sha256":"5E:E3:2A:C0:F5:10:AE:D1:9D:11:A4:88:D0:66:44:3B:31:B7:05:05:0D:A7:35:66:17:B5:35:88:23:3C:E3:F1"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://velcuri.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 25 Feb 2026 13:47:54 GMT\r\nexpires: Thu, 25 Feb 2027 13:47:54 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nage: 146637\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43136,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-09T00:49:09.375284Z","times_seen":257741,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":66,"dns":1,"connect":8,"send":0,"wait":9,"receive":10,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"velcuri.io/assets/index-Cr2HM40C.js","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.255Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"velcuri.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 20 Jan 2026 16:15:59 GMT","end":"Mon, 20 Apr 2026 17:15:54 GMT"},"fingerprint":{"sha1":"D1:D0:C2:54:8C:C7:0B:4D:D0:C3:E8:BC:B5:34:0E:BA:D7:52:FD:BF","sha256":"38:20:BC:EA:06:B3:C1:1D:B9:A8:40:FC:59:03:34:07:2C:0C:21:C9:B3:CB:6F:C3:F7:F3:11:7F:29:B2:0A:D4"}}},"request":{"raw":"GET /assets/index-Cr2HM40C.js HTTP/1.1\r\nHost: velcuri.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\ncontent-type: application/javascript\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\ndate: Fri, 27 Feb 2026 06:31:47 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bL8yRUFqQYepyAS0ijohSo1rU1Y7t%2FP8xcMS8%2FNV%2BcRTgWO0PRVgbX40A4Z2k%2F3478dGJ9igqamRIDhpOhNMp40Ir721eXvXX3E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"180308fb5dc7daa4285c782db41ddaa5\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9d45a42859d51525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":847898,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (42670)","md5":"cba7c4eb528b767dce36ff736c811012","sha1":"78fe0ba6aec980ee7352c4bf740777763cb47e50","sha256":"8098ad41af002b1e533e9d55bd12d61738b5ac07cc19a4804196875565b8fcb9","sha512":"782298a8f0c76769a599dc1cf3a2a7708afa72f288afe78235c784d0eaba94efeb3b9b322edcb28c8dcd57930c1a38a706973cc23eb7171f868750d13583ef69","ssdeep":"24576:CJSY4ddQri+aUY45Abxln5gUlwSEkMS1qjxm/++ArDBsswMt7Wxe0gpiHTa7FA02:9Y4ddQri+aUY45Abxln5gUlwSEkMS1qG","tlshash":"1f055be932aaa4169bd146c5507b4112733d7c0a740cc4bcfa3dedeb2a65941b07bfb8","first_seen":"2026-02-07T11:51:02.357925Z","last_seen":"2026-02-27T06:32:24.952679Z","times_seen":3,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.840Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"preferencenail.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 01:24:35 GMT","end":"Thu, 28 May 2026 01:24:34 GMT"},"fingerprint":{"sha1":"66:45:2B:BB:A2:6D:D3:A2:B6:16:36:65:94:BA:4A:C6:5E:05:66:09","sha256":"A4:2E:A7:56:DB:44:FF:55:9A:FA:4D:EC:2A:78:CB:C5:02:CD:CF:B2:FB:A7:A7:75:77:EC:01:DB:19:71:C0:77"}}},"request":{"raw":"GET /sfp.js HTTP/1.1\r\nHost: preferencenail.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:47 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 32181\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nP3P: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\nAccess-Control-Allow-Origin: *\r\nVary: Accept-Encoding\r\nHost: preferencenail.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: ae701eb1b53b404e0c3e0af695d95687\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85379,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators","md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-09T00:47:05.978823Z","times_seen":26097,"resource_available":true,"data":null}},"time_used":150,"timings":{"blocked":54,"dns":1,"connect":17,"send":0,"wait":20,"receive":18,"ssl":37},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/1066c517734d784a94dd65d9f031c1ab-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/1066c517734d784a94dd65d9f031c1ab-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=vy82jvCWAtJmvqmH; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:49 GMT\n__ddg10_=1772173909; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:49 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:49 GMT\n__ddg1_=J2M6Wur5mf0KWCpOy27E; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:49 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 15372\r\nlast-modified: Thu, 26 Feb 2026 05:00:40 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd378-3c0c\"\r\nage: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":15372,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"e04eee767cc4cd3a3e88f6ffd8fa3f9d","sha1":"d8e828eae3415a63267778df64dedfd85177e16c","sha256":"ab5aaae4a4f4ab78ecb96930d5c680cfa03925352c8229da54b3d0d2ffe844fd","sha512":"ff24fedc4f1f8d151dac45f805ba7cb3d66a74c6e8012db80e24179c74794d3941668e28a615ad3af9a4488a97b2accce1dc62ea09732b2dca623ab5214c37f9","ssdeep":"384:RoIleFxnLy+Plohgv2IUowmASbUUUUKg3:RoIleFxnNmsnUowSbUUUUKg3","tlshash":"dc62b062d247fe24c0e5d06b1bfad5178b3a705e1d4706de02860fea7ca19662e4cced","first_seen":"2026-02-27T03:28:40.599338Z","last_seen":"2026-02-27T06:32:24.957446Z","times_seen":2,"resource_available":false,"data":null}},"time_used":947,"timings":{"blocked":332,"dns":57,"connect":26,"send":0,"wait":275,"receive":2,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.show-sb.com/sb/notifications/games/lust-goddess/6/index.html","fqdn":"cdn.show-sb.com","domain":"show-sb.com","tld":"com"},"ip":{"addr":"172.67.170.115","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:49.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"show-sb.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 03 Feb 2026 22:39:28 GMT","end":"Mon, 04 May 2026 23:38:03 GMT"},"fingerprint":{"sha1":"DE:44:B7:F9:65:9F:D2:6E:27:46:3E:12:7A:23:24:E9:D7:2B:16:7E","sha256":"E1:09:99:E2:19:59:48:E0:83:95:4C:4F:63:09:68:08:82:8E:16:17:8D:20:09:B6:93:1D:B5:84:B7:46:68:C1"}}},"request":{"raw":"GET /sb/notifications/games/lust-goddess/6/index.html HTTP/1.1\r\nHost: cdn.show-sb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nOrigin: https://velcuri.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Feb 2026 06:31:49 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Thu, 10 Apr 2025 14:45:46 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=brS4mZo%2BmkAQ1N3hd9a%2F3m%2B1RtRrVPOJ%2BN4xiJNhbvr7M4UCZLJRysAsDd7jbVHbDk0I8v0inil5LmQ8uWWEkY%2ByQLETPzqd3GRwiaQJgw%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9d45a4384a19783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":1106,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"855b7fc47924fbac10e22c435b1f00ab","sha1":"bda74a5268a367de62738446b3b523e372483ff2","sha256":"611b60b9fe1069ba98abad8b11a86d3c547cad91696c4b3217aab39d01de4e2c","sha512":"be6f0be9dd736081066303338b5d09a07316d5c91bb5af87e9201935a94ad40da23e6b72883cfc21b246c517b8afcd8591557e419058950953f843fb14620adb","ssdeep":"","tlshash":"79113d4b6998827220d2a0da7b317fdbbc92e287c90b484077fcd9618b96d51dd13e0b","first_seen":"2026-01-27T19:52:43.565622Z","last_seen":"2026-03-23T06:05:48.024768Z","times_seen":374,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":39,"dns":21,"connect":1,"send":0,"wait":120,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbs?c=1","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.979Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbs?c=1 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl28382109=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:51 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"preferencenail.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 01:24:35 GMT","end":"Thu, 28 May 2026 01:24:34 GMT"},"fingerprint":{"sha1":"66:45:2B:BB:A2:6D:D3:A2:B6:16:36:65:94:BA:4A:C6:5E:05:66:09","sha256":"A4:2E:A7:56:DB:44:FF:55:9A:FA:4D:EC:2A:78:CB:C5:02:CD:CF:B2:FB:A7:A7:75:77:EC:01:DB:19:71:C0:77"}}},"request":{"raw":"GET /sfp.js HTTP/1.1\r\nHost: preferencenail.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:48 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 32181\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nP3P: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\nAccess-Control-Allow-Origin: *\r\nVary: Accept-Encoding\r\nHost: preferencenail.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: e21e6e6934fe269d41542bbb9936cdb2\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85379,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators","md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-09T00:47:05.978823Z","times_seen":26097,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":21,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/62f4ebe8e19343c5d42fd69d9c32496f-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.664Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/62f4ebe8e19343c5d42fd69d9c32496f-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=Wu0bU7dGXsNeMH3M; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:49 GMT\n__ddg10_=1772173909; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:49 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:49 GMT\n__ddg1_=V8PD4sARXAhMpPTPedja; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:49 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 14315\r\nlast-modified: Thu, 26 Feb 2026 05:00:39 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd377-37eb\"\r\nage: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":14315,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"63f6aee627c9d1e6104d705d067d6bf9","sha1":"5d136f604e72a2b565f82906048d8fab9f9c4f12","sha256":"747152ad13698f0d00a1e594b44bb5b9064dbf8776733f391a575ee3afabd0e2","sha512":"d58b8122ca940b78a34d5b33582b176e2d8557008d04416c33537da9d88a65f6649de597e81ef52e648041e4af1c72df74c3f3c0f4a332e72920035f62fd77c9","ssdeep":"384:R5yipxM1uNCtwu6XCfYl7xAH9WpIAMb2djy1a3z:R5yipxMEgeWfYl6cwb2de4z","tlshash":"7c52cf202fbef9aad5fecfab291fd2902434f381a403e161ad00db657c6e4c2451d748","first_seen":"2026-02-27T03:28:40.597348Z","last_seen":"2026-02-27T06:32:24.966589Z","times_seen":2,"resource_available":false,"data":null}},"time_used":934,"timings":{"blocked":349,"dns":65,"connect":18,"send":0,"wait":229,"receive":4,"ssl":57},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/7e6ed21d938815ede82075a1f1f6fd57-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.680Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/7e6ed21d938815ede82075a1f1f6fd57-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=CjQE0qYzAopYR3uo; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg10_=1772173908; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg1_=MIn0YlVvbJqbLhjNmf8C; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:49 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 14580\r\nlast-modified: Thu, 26 Feb 2026 05:00:41 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd379-38f4\"\r\nage: 1\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":14580,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"4bea891b0d502a9ec76953cf47453cdc","sha1":"b16d602efa5bb1573eace193c25759ce4fc02cbd","sha256":"3287af737cf0cf19f500d76569f0cad821634f0c39ba0430a6c35a03bdb4d28e","sha512":"f123689cfaf639c96f38c6e0eb49dc5fa33945f336ccdb439968bc109fef3b22d13f172e61e3bf4ad034d4ddec85de5f9c0608a43f95772704b1e89a020f74fb","ssdeep":"384:RR/cSvxhb8loy+shRlJS8GoMTWKuOPH54nSHqzTNSA:RR1h4OydlJuoKWKuOit","tlshash":"3162bf7d634b9f8387cea09c1865fdb75e2ad1c530a302e6a1271d9bfd00960168b7bc","first_seen":"2026-02-27T03:28:40.57644Z","last_seen":"2026-02-27T06:32:24.970065Z","times_seen":2,"resource_available":false,"data":null}},"time_used":355,"timings":{"blocked":103,"dns":0,"connect":0,"send":0,"wait":251,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/957673de66e7cba0f9e78bdd16c66f42-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/957673de66e7cba0f9e78bdd16c66f42-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=mCsCTR4jXlpzf1ul; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg10_=1772173908; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg1_=kkX2qIC1L7OfH6TZ1QXQ; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:48 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 13672\r\nlast-modified: Thu, 26 Feb 2026 05:00:42 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd37a-3568\"\r\nage: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":13672,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"7f1d11d1d9f00789586ebd34ae1d7c82","sha1":"61ea472bd5adcc8b0328f40ca6a829f75fd2683a","sha256":"628790aa91651ec7dcd5b9e479d4599f899e07b8f007315c72b1b9fccea2d823","sha512":"194a9f9175c7eda1aea782a9cac7f88c032ba1e49bdf2f691bd993e1cc997130e64477bf6adac98d72e3fd176a31499ba28060ef837d7db031675b3a456ad26c","ssdeep":"384:RjjgdBTMUzat+u4EO9ORKvILrHolA5KM1Ykqz0g:R3iBTQgsR/olAVz+0g","tlshash":"6752bf6e8a523cd1dcf7c15d04aadcd352251f98965fac922820afa4f321b897ac7361","first_seen":"2026-02-27T03:28:40.566505Z","last_seen":"2026-02-27T06:32:24.977137Z","times_seen":2,"resource_available":false,"data":null}},"time_used":343,"timings":{"blocked":100,"dns":0,"connect":0,"send":0,"wait":229,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/ren.gif?sid=H4sIAAAAAAAC_1RSy4scRRiv3t1bDmJWBQ9CHzwourP9qOnpTiCB4AvU3WASc8ipHt2bcmu62q7umcmcNkY8rzcvQs9vdrMiIuY_kFkPyoJgH4Q9ZBE9eROEnGVmBxa_w_d9xa8ofo_6YlKfkQ3U7PTmh2astGab3Y7nvnZX5dIMrbt12_W9jnfVvavyiF51R_NWDq74Ie14r7vvpmLXbAae73m-57vvqDLNzGhzgUIV3yV-J_E6NOj4XYpR-f-zrR1Y5kAOzshlKNk-91d2D0rMkPd_eCu1u5Up3ny7X2tWmRIDeXQn383NMEf_Ys1KB1l-tLwNY1tCvlqByY-WCmAGB3MF4KolKy89Bc-PljTBB4fnTLlGmoPLSxgOZkj1DIrNIMwjKPkbAYTE1jby_uMtUw7Zg3OUzdGWrD37F2rYkrWnLyDvf39Dq5F7y-i6Uia3GGUN1GgGtTNDUR-jGjtQw2OI6jMo-SvZfPYB8v7BttUGSp6-2ssoi-Is3AhkGG_QOEs3Yr_LNrJuykMhEsp7cmGRymZgdhW1dVArB3XmoC4c9OWpS72YCp-FUZZI0fMoo1Sm3EviwPNYInqoxUMouQ9R7qEo97Cr9mHvN7DSga0IBrI5lNoGtnksta25v5zBcobN1FQ7E35oqp0074GV-yhlc6CKT-0jiGp1Os6snJp5Y7xqpozLZqpktTIpzsjzc9-cJ-tfYzc9db2YJzKmUZIKmko_iKNeTwQ0iiWNAp_6sKqBsitg1sFYteTmG5dRqJasfrwGzo5h9TGEWgerXwEbNmD3G4zzbwepFnWpOspAmgZFtYbqgTPRZ2R9-tHtGz8uwuMvf4NUnFz_hywKomxQlA0-UT8R7OiHT7aLSvXVmM3TvFWxKl0FUy25dE1CqJa8uPLn4mP1ft-DKPZgi4u3rCHghQOtWvLevT-g05Prf__8vrw2-AWMN7DpCVkW-MU-sZ9jp3TAtTPlunQOuC71l-dUrTp1uwEPoziO0iySWSjDIJRJ10sTypKIJrSLyrZqcuXOfwEAAP__UAFO69oDAAA=","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:49.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1RSy4scRRiv3t1bDmJWBQ9CHzwourP9qOnpTiCB4AvU3WASc8ipHt2bcmu62q7umcmcNkY8rzcvQs9vdrMiIuY_kFkPyoJgH4Q9ZBE9eROEnGVmBxa_w_d9xa8ofo_6YlKfkQ3U7PTmh2astGab3Y7nvnZX5dIMrbt12_W9jnfVvavyiF51R_NWDq74Ie14r7vvpmLXbAae73m-57vvqDLNzGhzgUIV3yV-J_E6NOj4XYpR-f-zrR1Y5kAOzshlKNk-91d2D0rMkPd_eCu1u5Up3ny7X2tWmRIDeXQn383NMEf_Ys1KB1l-tLwNY1tCvlqByY-WCmAGB3MF4KolKy89Bc-PljTBB4fnTLlGmoPLSxgOZkj1DIrNIMwjKPkbAYTE1jby_uMtUw7Zg3OUzdGWrD37F2rYkrWnLyDvf39Dq5F7y-i6Uia3GGUN1GgGtTNDUR-jGjtQw2OI6jMo-SvZfPYB8v7BttUGSp6-2ssoi-Is3AhkGG_QOEs3Yr_LNrJuykMhEsp7cmGRymZgdhW1dVArB3XmoC4c9OWpS72YCp-FUZZI0fMoo1Sm3EviwPNYInqoxUMouQ9R7qEo97Cr9mHvN7DSga0IBrI5lNoGtnksta25v5zBcobN1FQ7E35oqp0074GV-yhlc6CKT-0jiGp1Os6snJp5Y7xqpozLZqpktTIpzsjzc9-cJ-tfYzc9db2YJzKmUZIKmko_iKNeTwQ0iiWNAp_6sKqBsitg1sFYteTmG5dRqJasfrwGzo5h9TGEWgerXwEbNmD3G4zzbwepFnWpOspAmgZFtYbqgTPRZ2R9-tHtGz8uwuMvf4NUnFz_hywKomxQlA0-UT8R7OiHT7aLSvXVmM3TvFWxKl0FUy25dE1CqJa8uPLn4mP1ft-DKPZgi4u3rCHghQOtWvLevT-g05Prf__8vrw2-AWMN7DpCVkW-MU-sZ9jp3TAtTPlunQOuC71l-dUrTp1uwEPoziO0iySWSjDIJRJ10sTypKIJrSLyrZqcuXOfwEAAP__UAFO69oDAAA= HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl28382109=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 1\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 9ec9cff72e8b4f3c13481e85ca41e66d\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"velcuri.io/","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-27T06:31:46.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"velcuri.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 20 Jan 2026 16:15:59 GMT","end":"Mon, 20 Apr 2026 17:15:54 GMT"},"fingerprint":{"sha1":"D1:D0:C2:54:8C:C7:0B:4D:D0:C3:E8:BC:B5:34:0E:BA:D7:52:FD:BF","sha256":"38:20:BC:EA:06:B3:C1:1D:B9:A8:40:FC:59:03:34:07:2C:0C:21:C9:B3:CB:6F:C3:F7:F3:11:7F:29:B2:0A:D4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: velcuri.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Feb 2026 06:31:47 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LIn7EzGhHsjBdYtyY%2Ba%2F6j2ukDsOtJco%2BQd5A5xq4AIXy1xOL2ke2M5mTvkxKUedOsjEsD3r%2FvXIEL4tDezKMbS6eYQDyl9msow%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9d45a426de29c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1254,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"bc6ad9ce8d23ecc0a5170a0a525014df","sha1":"b69387aadc396daaaba3374ce055d822da39bec6","sha256":"087b0769bd208fd30edf5d76cbeb0bd242b78adad523aa0d237ca90df3266943","sha512":"bbca530cf86ab25aad0b6f287b22fe5051b23994e3b2f500ae8d2253173b4b8232eb37cb6f64d4061292fac15ea367b987702e638dc49ea5140754f04cc4a4ed","ssdeep":"","tlshash":"4821024bdcc8c557809023689e97f00d95eac148d389d89026fe70ae7ec2bd0852bd69","first_seen":"2026-02-07T11:51:02.369153Z","last_seen":"2026-02-27T06:32:24.980781Z","times_seen":3,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":71,"dns":51,"connect":1,"send":0,"wait":51,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"velcuri.io/assets/index-D7UlvGAM.css","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.299Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"velcuri.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 20 Jan 2026 16:15:59 GMT","end":"Mon, 20 Apr 2026 17:15:54 GMT"},"fingerprint":{"sha1":"D1:D0:C2:54:8C:C7:0B:4D:D0:C3:E8:BC:B5:34:0E:BA:D7:52:FD:BF","sha256":"38:20:BC:EA:06:B3:C1:1D:B9:A8:40:FC:59:03:34:07:2C:0C:21:C9:B3:CB:6F:C3:F7:F3:11:7F:29:B2:0A:D4"}}},"request":{"raw":"GET /assets/index-D7UlvGAM.css HTTP/1.1\r\nHost: velcuri.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-type: text/css; charset=utf-8\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\ndate: Fri, 27 Feb 2026 06:31:47 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bBBkLbQKrHTMr1Yl220r%2FtTiq822ZsWzB1ZHXUOdrdoCXdm%2B%2BoBw21MvAJbl0ddQqynRJcT%2FedoEKNeflLCemUZc8KRpDG60U48%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"1394b36ebbee40d04d935576d681dc51\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9d45a42859d81525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5124,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (5123)","md5":"a911869bf8f02697e6c99ede9ab2ef49","sha1":"86b86eb8fdecbe3e2578794fb97f3d2032bb0c0a","sha256":"3271a0ea78d555fcc3c1dd698468f929ca066175456347fe13670b542c6f037f","sha512":"d51db24b2f1c88fb3b3d4d3fd6364133fbafb5445669782c4f1bb387cb9e0041856b8ad786dc3153deb5e9de73dc2e94886fcaa69739154dc40db5445e89cf17","ssdeep":"96:Lrm8hDglGsfD50CMANxT81xp2oyLiVzNXI:hC0sf1dMANxT81xpVeiVzhI","tlshash":"77b1d76fb641522cf637dda215e4a3cd8218e4a5c0134beeb883a635c9cb7e306b164c","first_seen":"2026-02-07T11:51:02.383853Z","last_seen":"2026-02-27T06:32:24.983531Z","times_seen":3,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/542df6d9a611195b9b58b38dd3ea1f6f-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.687Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/542df6d9a611195b9b58b38dd3ea1f6f-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=034GlRIyLpJnIe0K; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg10_=1772173908; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg1_=TS71PC8gKS5JKvPtCVfM; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:48 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 14325\r\nlast-modified: Thu, 26 Feb 2026 05:00:41 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd379-37f5\"\r\nage: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":14325,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"20d4e170aeea893603154d20e3485121","sha1":"d1f0a1b0f8332c4911d37fb854e78ef7c7963e59","sha256":"bacf6f155e7132fba7a20dda1aa0c9b53f5541268db24eabb286175f16138ec4","sha512":"400f0e84371f7f9b1d6a0afd47ceacfb0934aa77939905359c62fae83d07fcba3b2a959750340a1dca7e922da74a426c3d11da3d6378ecdf8489cece92fb1321","ssdeep":"384:RA6lllZFq/ZGLKLHxcvh7KpOwGnT3rfKv1:RA+s/gsM5Tbyd","tlshash":"0c52a00738376c964fdd858a4211e07c1e0a9753798326a85ad74de0f378dba6c2a2bd","first_seen":"2026-02-27T03:28:40.550018Z","last_seen":"2026-02-27T06:32:24.985805Z","times_seen":2,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":97,"dns":0,"connect":0,"send":0,"wait":227,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"realizationnewestfangs.com/pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=860\u0026rd=860\u0026fd=559\u0026bv=26.2.5025\u0026tmpl=70","fqdn":"realizationnewestfangs.com","domain":"realizationnewestfangs.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"realizationnewestfangs.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 23:39:43 GMT","end":"Wed, 27 May 2026 23:39:42 GMT"},"fingerprint":{"sha1":"2F:D0:7E:69:4A:D0:06:61:89:AF:78:09:0A:5A:F1:7B:F9:4A:B7:96","sha256":"24:55:49:F2:2C:E7:D7:3D:E6:6E:54:6C:64:30:D7:3C:F6:39:2F:A0:A7:A2:AA:25:93:8D:6B:C2:15:40:66:C2"}}},"request":{"raw":"GET /pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=860\u0026rd=860\u0026fd=559\u0026bv=26.2.5025\u0026tmpl=70 HTTP/1.1\r\nHost: realizationnewestfangs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:48 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nHost: realizationnewestfangs.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":728,"timings":{"blocked":307,"dns":27,"connect":94,"send":0,"wait":112,"receive":0,"ssl":186},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/21d7499d91f528a5dfcd77a1e9a7fdb8-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/21d7499d91f528a5dfcd77a1e9a7fdb8-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=43ZrmAX85cSva01S; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg10_=1772173908; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg1_=aUNq1U88AaMP1wImGZfF; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:48 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 16585\r\nlast-modified: Thu, 26 Feb 2026 05:00:40 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd378-40c9\"\r\nage: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":16585,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"6014bd518b51d5fdfc9d2c1613411e2e","sha1":"388582784118313edb418a650e45d83a05808104","sha256":"7e2b7d4559763d62b984d9f3750b55b038ddae6985379d9e1405d87b0701a78f","sha512":"c426fdc7ef43291ff0e420c9a8850917b8dc3116c5e7113132ce2604853807488620d5055a08047916f451fb3d3bf56dbd77fba3d6718703a1d4072b33330a28","ssdeep":"384:RvtApAnlp0GHC+E6sxmwYSnnB7go/t0evrbZ7eHbq:RvK2nlp0GHCp6mXBso/v3Z7eO","tlshash":"5f72cfd7d6506b9039c6187b31b3a0b94ae4cd8640078997f8ca9717fa3b5e1ed093f1","first_seen":"2026-02-27T03:28:40.601402Z","last_seen":"2026-02-27T06:32:24.992252Z","times_seen":2,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":99,"dns":0,"connect":0,"send":0,"wait":218,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/0ff3de1d29f343400f50986498cc8b1e-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/0ff3de1d29f343400f50986498cc8b1e-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=68gghKj7C7kW7Q3r; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg10_=1772173908; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg1_=qDYkMgUaNWvsgwUR4YDK; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:48 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 7949\r\nlast-modified: Thu, 26 Feb 2026 05:00:40 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd378-1f0d\"\r\nage: 2\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":7949,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"d88dc0d5a8108fb8b41b214562635174","sha1":"d3bd21b78d12c31eb6e31bbfcba1533cd245f3e1","sha256":"02f6037ea96dd4c82fa0a52275ae8f87451b5a470e7b9e774b98418befccb28e","sha512":"3f4e97c9edd2ca355522c2cceb605b4d12f7cac5ddd2d5446fe5159b90364d6735c8eacc335f4491c4933618b846f9630eae69670d4b40bdc9f5a8861713a4d9","ssdeep":"192:Rbd/UevyzLxRhHABLRzQBnVbnBHp+x3oxLDv7:RbRsRwRspVbBJ+BWD","tlshash":"31f17c26f7c3ee504bc708e8125cfd6b434266e403c7165e100b6ed17725fae44a24be","first_seen":"2026-02-27T03:28:40.545843Z","last_seen":"2026-02-27T06:32:24.993209Z","times_seen":2,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":99,"dns":0,"connect":0,"send":0,"wait":244,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.show-sb.com%2Fsb%2Fnotifications%2Fgames%2Flust-goddess%2F6%2Findex.html\u0026l=1106\u0026fd=166","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:49.967Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.show-sb.com%2Fsb%2Fnotifications%2Fgames%2Flust-goddess%2F6%2Findex.html\u0026l=1106\u0026fd=166 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl28382109=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:50 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"creative-sb1.com/sb/notifications/games/lust-goddess/6/css/style.css","fqdn":"creative-sb1.com","domain":"creative-sb1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:49.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"creative-sb1.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Feb 2026 22:50:15 GMT","end":"Sat, 23 May 2026 23:48:46 GMT"},"fingerprint":{"sha1":"E0:64:EB:B0:39:B0:1B:31:05:CE:A0:93:C8:74:E7:A4:DE:D1:B3:77","sha256":"6D:BC:A3:C7:8F:67:2C:FE:E1:7A:88:EA:6C:8E:07:D4:1D:1F:CA:FD:54:30:02:80:22:B2:74:B5:95:C4:99:75"}}},"request":{"raw":"GET /sb/notifications/games/lust-goddess/6/css/style.css HTTP/1.1\r\nHost: creative-sb1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nOrigin: https://velcuri.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Feb 2026 06:31:50 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Thu, 10 Apr 2025 14:45:50 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"67f7d99e-180b\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6pOAoMPT3uzUEUaXnFBv0eAKGO9ff7cMrQHr6LUfPx1eKK1yNfoBNeIQ6yI3yNxc3KRuDYFapKoKSd2E9NVJwHF6d%2BXFMqJH1u7Z8z6%2FC2Q%3D\"}]}\r\ncf-ray: 9d45a439bf782efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6155,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"6532ece80ec3d1740d2fe39a5f044490","sha1":"f612b17ee2b80e1b6080ab79f7ac164176ef70a5","sha256":"ddb15ee4469f05d5cbf59ae8edc2d2db8e17ab879c8885242affbb7681fa21fe","sha512":"68b515a474bfc86e0f13461de21dc8debb891cb093fab8987efe3a25ebbfe3ce47205013f41426264db1a498b9b55fad0e469b687af8885b387701d4c4d6e071","ssdeep":"96:WzMUmZ1CfICcfXgCfViOtAYiY5mnM0pfionK4OHBCHL+OCvsMsTkuCo1ZC/1FCHB:8MFInadiOyXnMCM0s0Vkj4BXs4ksh","tlshash":"38c120a617650204740fd85a3a426f176368c053ef0fd9b96ed2145c8fca6ce46e378f","first_seen":"2026-01-27T19:52:43.532514Z","last_seen":"2026-03-23T06:05:48.05041Z","times_seen":358,"resource_available":false,"data":null}},"time_used":589,"timings":{"blocked":58,"dns":34,"connect":1,"send":0,"wait":471,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"creative-sb1.com/sb/notifications/games/lust-goddess/6/img/banner.jpg","fqdn":"creative-sb1.com","domain":"creative-sb1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"creative-sb1.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Feb 2026 22:50:15 GMT","end":"Sat, 23 May 2026 23:48:46 GMT"},"fingerprint":{"sha1":"E0:64:EB:B0:39:B0:1B:31:05:CE:A0:93:C8:74:E7:A4:DE:D1:B3:77","sha256":"6D:BC:A3:C7:8F:67:2C:FE:E1:7A:88:EA:6C:8E:07:D4:1D:1F:CA:FD:54:30:02:80:22:B2:74:B5:95:C4:99:75"}}},"request":{"raw":"GET /sb/notifications/games/lust-goddess/6/img/banner.jpg HTTP/1.1\r\nHost: creative-sb1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Feb 2026 06:31:50 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 42861\r\nserver: cloudflare\r\nlast-modified: Thu, 10 Apr 2025 14:45:56 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"67f7d9a4-a76d\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\naccept-ranges: bytes\r\nage: 2637006\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nhZSmd0kEvsHdL7HhhtJWZQglkAC7rcs7r0nIiXvON%2Bg9USAn2jdgxFVkT3ADsW79Ymz2IK90WEh7jYKCR3BCjvwb%2FX7uvMXXm5KYpYuXW0%3D\"}]}\r\ncf-ray: 9d45a43a08be2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42861,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=1], baseline, precision 8, 300x500, components 3","md5":"08b362a8fc092ab285701190a8922ebe","sha1":"b932a30789e222ef95f5990df33aed1652d0aa44","sha256":"df8ccce9072151df4d74ec3060982db68ceb00ac192283e8b80553644891efae","sha512":"8491c26e8754f618b446401bbb5d32853cd8922c5628b7317af712bb9aa85dec394dfed598f87e7343daefebce784268779c503f54b4bb7c417e7aaeabe3ddc2","ssdeep":"768:Dw2CbyfWEHrmHczy9Dg7jZg1AoufUsB+o4O63GGsbGYZiLFF8Ox3Lm4r16C:0VyVLm8u9Dg780+bO63GJbTHOxbxJ","tlshash":"dc13f175ab421091d957227fff7a4f1808fd1da12873cac6a12b7aca9eb1144386df34","first_seen":"2026-01-27T19:52:43.555428Z","last_seen":"2026-03-23T06:05:47.99323Z","times_seen":365,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"creative-sb1.com/sb/notifications/games/lust-goddess/6/js/jquery.min.js","fqdn":"creative-sb1.com","domain":"creative-sb1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.088Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"creative-sb1.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Feb 2026 22:50:15 GMT","end":"Sat, 23 May 2026 23:48:46 GMT"},"fingerprint":{"sha1":"E0:64:EB:B0:39:B0:1B:31:05:CE:A0:93:C8:74:E7:A4:DE:D1:B3:77","sha256":"6D:BC:A3:C7:8F:67:2C:FE:E1:7A:88:EA:6C:8E:07:D4:1D:1F:CA:FD:54:30:02:80:22:B2:74:B5:95:C4:99:75"}}},"request":{"raw":"GET /sb/notifications/games/lust-goddess/6/js/jquery.min.js HTTP/1.1\r\nHost: creative-sb1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Feb 2026 06:31:50 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Thu, 10 Apr 2025 14:45:53 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dw%2B%2BKLYDekKXoAJbW82DV4P20jJsivsxcK28qBNxnN1NlzVlD5npsBsWde3lRgGbJqlzxrmwO3LwEZZt8tVaj27SMhMVbXf6GAfLtTLOixs%3D\"}]}\r\nage: 1122065\r\ncf-cache-status: HIT\r\netag: W/\"67f7d9a1-149a0\"\r\ncontent-encoding: br\r\ncf-ray: 9d45a43a08cf2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":84384,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32025), with CRLF line terminators","md5":"6326c600df01e3bfb9b40e1aa08176f8","sha1":"6b4fb754d29b297b539bf62ba9b4eaf0f33f314a","sha256":"df34524351c5fabc921a89183b5da5667aebd7b9e9a1c52255c76ff722935ea3","sha512":"641aaeecb9b89bcc319cabfef18f76faa9b1ba79f9de30c6d07f22d385fc78ac3f11a718fe9ec96f8a13d82e3dff4ca34944ccb449a4ef8e378ad65dfad581c0","ssdeep":"1536:oP10iSi65U/dXXeyhzeBuG+HYE0mdDuJO1z6Oy4sh3J1x72BjmN7TwpDKba98Hri:f+41hJiz6fhdlTqya98Hri","tlshash":"eb83d6d9b2c67062977734b851bf510bb17a98dab40c8c60f0a4d8e47eb4a8d517bf2c","first_seen":"2023-03-07T01:10:11Z","last_seen":"2026-08-08T17:57:23.737822Z","times_seen":13336,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"creative-sb1.com/sb/notifications/games/lust-goddess/6/js/script.js","fqdn":"creative-sb1.com","domain":"creative-sb1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.191Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"creative-sb1.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Feb 2026 22:50:15 GMT","end":"Sat, 23 May 2026 23:48:46 GMT"},"fingerprint":{"sha1":"E0:64:EB:B0:39:B0:1B:31:05:CE:A0:93:C8:74:E7:A4:DE:D1:B3:77","sha256":"6D:BC:A3:C7:8F:67:2C:FE:E1:7A:88:EA:6C:8E:07:D4:1D:1F:CA:FD:54:30:02:80:22:B2:74:B5:95:C4:99:75"}}},"request":{"raw":"GET /sb/notifications/games/lust-goddess/6/js/script.js HTTP/1.1\r\nHost: creative-sb1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nOrigin: https://velcuri.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Feb 2026 06:31:50 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Thu, 10 Apr 2025 14:45:53 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nH411lgwTdKoYIQ3E1%2FQSSwEryB3cSbZ8kryX4X3qfFThS3bi61elKJqgExCz75Fy4opa84Q5vp9TWQzz%2FL%2Fl6h30wrR6KrZ5myWMRSRjyk%3D\"}]}\r\ncf-cache-status: MISS\r\netag: W/\"67f7d9a1-188\"\r\ncontent-encoding: br\r\ncf-ray: 9d45a43abb962efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":392,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"b9a492b9bcd385acc7d07632269e351b","sha1":"f0aea77f137af873fe4fe11e1d5ac01382310e3c","sha256":"f9e72f595d5d77fac38ef5fca20e757a289bc334e24694890cff05af2f1e49e6","sha512":"db2621f34b76fe7afc78c77980cd27edf384cf1a5f4daa0b8b24af529ab097a38f811f6e2927fe7dec9809ec694cd300c1d5b3c8fce47e624a00c3bd88597079","ssdeep":"","tlshash":"e1e02b3851544234c7fbc1e2618b679f2630465ed00a425eb02c574f0de1fb612c1da7","first_seen":"2026-01-27T19:52:43.574142Z","last_seen":"2026-03-23T06:05:47.985533Z","times_seen":356,"resource_available":false,"data":null}},"time_used":478,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pl27534969.effectivegatecpm.com/de/ff/c0/deffc03c7ca644daeac5d42043d99bb9.js","fqdn":"pl27534969.effectivegatecpm.com","domain":"effectivegatecpm.com","tld":"com"},"ip":{"addr":"172.240.108.84","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"effectivegatecpm.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Feb 2026 21:41:44 GMT","end":"Tue, 05 May 2026 21:41:43 GMT"},"fingerprint":{"sha1":"4D:33:AA:27:56:E6:86:A8:20:28:DE:BA:58:20:8F:ED:14:AF:E9:3D","sha256":"88:F1:AE:B6:50:35:09:46:90:C7:F5:97:81:4D:0C:B9:E5:48:83:71:DB:76:DE:91:44:2F:85:FD:AC:1B:21:42"}}},"request":{"raw":"GET /de/ff/c0/deffc03c7ca644daeac5d42043d99bb9.js HTTP/1.1\r\nHost: pl27534969.effectivegatecpm.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:47 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 38904\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nset-cookie: 4b4e7ab587d59b22ad7bcd2439afc363_HD-45954-2=0; expires=Fri, 27 Feb 2026 06:31:47 GMT; secure; SameSite=None\r\nx-envoy-upstream-service-time: 8\r\nHost: pl27534969.effectivegatecpm.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 03589be404fd640028b5c81f5048c938\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":107704,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"51e0f699c2b2ce7581c2bdd0334429b8","sha1":"cf739369347fc5cc95258d0f6e4b522bb8b76f3a","sha256":"c5bfad39296e84f02e3cade1f3db2982ad2dcdf064b40275f2d08de9504a52a2","sha512":"b6e4e8755ba42e3ff5149df4561f1dcbc497f9f02f954802e10364a06ffdb4f9e8912e0c88208838f3c9ac31e4815584d12ffb152b7c75e00f5398726e7103a2","ssdeep":"1536:W6wV1LAGB7i2tDV62GWcGQ0WYmQI196wr/PsZX7EMh3uwV5r7hukjKr:1w37XE6wrX0XwMh3uwV5r7BC","tlshash":"65b3e98c3f50f1dd02a27033153f680af0299e9220cde5a8e247f5957ab979ae43df65","first_seen":"2026-02-27T06:32:24.996657Z","last_seen":"2026-02-27T06:32:24.996657Z","times_seen":1,"resource_available":true,"data":null}},"time_used":856,"timings":{"blocked":329,"dns":53,"connect":91,"send":0,"wait":103,"receive":92,"ssl":185},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"pl27534969.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"pl27534969.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"pl27534969.effectivegatecpm.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"velcuri.io/registerSW.js","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"velcuri.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 20 Jan 2026 16:15:59 GMT","end":"Mon, 20 Apr 2026 17:15:54 GMT"},"fingerprint":{"sha1":"D1:D0:C2:54:8C:C7:0B:4D:D0:C3:E8:BC:B5:34:0E:BA:D7:52:FD:BF","sha256":"38:20:BC:EA:06:B3:C1:1D:B9:A8:40:FC:59:03:34:07:2C:0C:21:C9:B3:CB:6F:C3:F7:F3:11:7F:29:B2:0A:D4"}}},"request":{"raw":"GET /registerSW.js HTTP/1.1\r\nHost: velcuri.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-type: application/javascript\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\ndate: Fri, 27 Feb 2026 06:31:47 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aQNESn47gwaUIYaCs3Tl2Xb%2B16PyRs7ecfKtM0kHYyL5oLETX4qL3WcTIoHYMJ2vp6PR9yjbeFJAUTZun6GCHE7E46Xg0XYqYYI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"deea95fdc0d94f1e17d79f957942afc2\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9d45a42849d21525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":134,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with no line terminators","md5":"1872c500de691dce40960bb85481de07","sha1":"b83dfcba8d2c57ca8837324bf395f34748033a50","sha256":"9742073ef7fc795e7673d98f272992843298426a0ffd8cb3507784df5143608b","sha512":"bf592ecb654fd8c3dba5db1816c3e454d72e3ef9cf078ca71314b68782e8f564b585ef21d7ca0b4a69540d2843ec713058d86cf40419b6b099f58df5f6f82041","ssdeep":"","tlshash":"2cc02b4fca4dc93e0830e0324c0b7b03331f0385c080049007f2030850c3414d1ae481","first_seen":"2023-03-11T15:21:23Z","last_seen":"2026-08-09T00:21:37.622677Z","times_seen":15988,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"realizationnewestfangs.com/08/b9/d8/08b9d8469ec4ed128677c2468d462141.js","fqdn":"realizationnewestfangs.com","domain":"realizationnewestfangs.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"realizationnewestfangs.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 23:39:43 GMT","end":"Wed, 27 May 2026 23:39:42 GMT"},"fingerprint":{"sha1":"2F:D0:7E:69:4A:D0:06:61:89:AF:78:09:0A:5A:F1:7B:F9:4A:B7:96","sha256":"24:55:49:F2:2C:E7:D7:3D:E6:6E:54:6C:64:30:D7:3C:F6:39:2F:A0:A7:A2:AA:25:93:8D:6B:C2:15:40:66:C2"}}},"request":{"raw":"GET /08/b9/d8/08b9d8469ec4ed128677c2468d462141.js HTTP/1.1\r\nHost: realizationnewestfangs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:48 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 34683\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 5\r\nHost: realizationnewestfangs.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: e2782d00723aa5b76289abcee6dabb6f\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92188,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7f9c57db5e20caf690a74768a12e5a27","sha1":"0aa91d1493fb1c51c9366ec6ef7e3b9fcab3329b","sha256":"baca253acd1da8c52707965e77f0e7d094af4157f4a00554476f00fc8c2b2468","sha512":"be1df44e4fd21d03e3c21b061658265d078e746b8da44ae3d5915e64d6d561edcaf6dcf19cc4f8e448002d2933dbd294eb752276233f4d800b86f0acc6605142","ssdeep":"1536:w5f97i5KqAGQDSAiLoHL0cTIgV2BOPsuUd7s/KiR1WwurV4aYLuvGgIo5+phrtX/:wm5KTGQDSAiLoHQcTIgV2BGsuUd7s/Ko","tlshash":"2493d84c3f82b0d41397707b762f902bf23b5c955868e88de243adac5da9719a337e05","first_seen":"2026-02-27T06:32:24.99891Z","last_seen":"2026-02-27T06:32:24.99891Z","times_seen":1,"resource_available":true,"data":null}},"time_used":806,"timings":{"blocked":300,"dns":26,"connect":91,"send":0,"wait":109,"receive":93,"ssl":184},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"realizationnewestfangs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"weirdopt.com/ad/advertisers.js","fqdn":"weirdopt.com","domain":"weirdopt.com","tld":"com"},"ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"weirdopt.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:36:35 GMT","end":"Thu, 28 May 2026 00:36:34 GMT"},"fingerprint":{"sha1":"3B:4C:F2:03:6C:C6:DA:E6:E5:93:49:86:A6:67:E2:2E:41:01:7E:73","sha256":"93:F0:FD:1B:36:7E:76:5F:50:F1:AB:BE:4B:3B:DD:2E:E3:64:D8:D6:B5:3C:24:9F:1B:A4:5D:ED:C6:D7:D5:E2"}}},"request":{"raw":"GET /ad/advertisers.js HTTP/1.1\r\nHost: weirdopt.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:48 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 0\r\nConnection: keep-alive\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 902413e91e994dc997d69cfb60fbf893\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":64,"dns":1,"connect":18,"send":0,"wait":17,"receive":1,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"weirdopt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/e6f72fc984a1ff4ceb77b1e61a96863d-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/e6f72fc984a1ff4ceb77b1e61a96863d-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=5zsthK8LIILd5CZ8; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg10_=1772173908; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg1_=6tX1ley1hf4geucFAvDR; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:49 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 12714\r\nlast-modified: Thu, 26 Feb 2026 05:00:40 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd378-31aa\"\r\nage: 1\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":12714,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"f084a4db4b5cf779ae40c4b181256fb8","sha1":"9e6ef1e942afe032abfcdeee0d8233bca16181e3","sha256":"45ef062074dffbdb218658a2506b625bff0040d3d6d45160f95a93f4d199d921","sha512":"614df07644a011049adf8bb038206bb4ba3f6daf55fa2a7eff7b4b21d2d74373a656a59214859fc2f26e1a2787986a235c26d92fe572c0cf836e0a70ba623fd2","ssdeep":"384:Rftq6hTVOWUvgexVVt62DIZVg2SCqhiGlj6u:Rfw6fO7vdVk2t29w6u","tlshash":"6e429e259a330f127ee458951cc8c6d4f64edfc9fb418010cba6b05ebd5c5c692a6b72","first_seen":"2026-02-27T03:28:40.588672Z","last_seen":"2026-02-27T06:32:25.000391Z","times_seen":2,"resource_available":false,"data":null}},"time_used":517,"timings":{"blocked":134,"dns":69,"connect":22,"send":0,"wait":238,"receive":1,"ssl":47},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flushpersist.com/pxf.gif?uuid=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=deffc03c7ca644daeac5d42043d99bb9\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=6","fqdn":"flushpersist.com","domain":"flushpersist.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:49.049Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"flushpersist.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 22:12:10 GMT","end":"Wed, 27 May 2026 22:12:09 GMT"},"fingerprint":{"sha1":"F8:CE:1C:DD:8F:86:0E:25:10:C6:86:56:A7:A3:47:DA:38:11:C7:3A","sha256":"19:3B:E0:74:B6:FC:9E:17:C4:75:30:39:E3:6A:CB:EF:32:91:9E:69:12:DF:51:AC:FA:76:15:EE:1B:D3:36:B8"}}},"request":{"raw":"GET /pxf.gif?uuid=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=deffc03c7ca644daeac5d42043d99bb9\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=6 HTTP/1.1\r\nHost: flushpersist.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 1\r\nConnection: keep-alive\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\nx-envoy-upstream-service-time: 1\r\nHost: flushpersist.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 39e22ba0ee80538568449855fdf5aa98\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":651,"timings":{"blocked":279,"dns":0,"connect":91,"send":0,"wait":94,"receive":0,"ssl":184},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto:300,400,700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:07 GMT","end":"Mon, 27 Apr 2026 08:38:06 GMT"},"fingerprint":{"sha1":"6B:DB:3B:B8:9F:A1:8E:49:35:74:D9:D8:24:91:F2:5E:42:56:2F:58","sha256":"37:ED:DF:C4:FB:A3:96:16:9E:47:69:CE:86:A5:35:8E:B5:3A:0B:0B:6A:A1:08:A2:DF:DE:6C:7C:31:BE:94:B1"}}},"request":{"raw":"GET /css?family=Roboto:300,400,700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 27 Feb 2026 06:31:50 GMT\r\ndate: Fri, 27 Feb 2026 06:31:50 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16755,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"1936a90eef3ebd4c6b40eb59d72e164d","sha1":"4c698f8dc97e2e6186d46215e209aca1b1194a5d","sha256":"412d98c2f4410a048131a7d9362fb38456ce2ff67cd4731ea411708a7996a021","sha512":"07ad2431175e5566ae435738d94d4da3e96e4856a1fe1d5917c52474cab28808cd940fec0e8f75eb2f3d573e6fe8497fc12636ef4738d1b67e9144725192b580","ssdeep":"384:p9f59g9P9r9yU9/qY4+949Y9p9fM919W969yh9/qY4X9N9t949fd9k9D939yQ9/O:pDS99YURRuWDyjooYhREHPWP2ZZYQRVs","tlshash":"48721091041704009b834ce223cebf35fe1f52117142d0b5abfd9b6b9ddbca6526939d","first_seen":"2026-02-19T22:28:01.752187Z","last_seen":"2026-08-09T00:32:12.981968Z","times_seen":10453,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":122,"dns":1,"connect":15,"send":0,"wait":38,"receive":0,"ssl":106},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcreative-sb1.com%2Fsb%2Fnotifications%2Fgames%2Flust-goddess%2F6%2Fcss%2Fstyle.css\u0026l=6075\u0026fd=539","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:50.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcreative-sb1.com%2Fsb%2Fnotifications%2Fgames%2Flust-goddess%2F6%2Fcss%2Fstyle.css\u0026l=6075\u0026fd=539 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl28382109=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:50 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":176,"timings":{"blocked":81,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"velcuri.io/registerSW.js","fqdn":"velcuri.io","domain":"velcuri.io","tld":"io"},"ip":{"addr":"104.21.42.166","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:47.843Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"velcuri.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 20 Jan 2026 16:15:59 GMT","end":"Mon, 20 Apr 2026 17:15:54 GMT"},"fingerprint":{"sha1":"D1:D0:C2:54:8C:C7:0B:4D:D0:C3:E8:BC:B5:34:0E:BA:D7:52:FD:BF","sha256":"38:20:BC:EA:06:B3:C1:1D:B9:A8:40:FC:59:03:34:07:2C:0C:21:C9:B3:CB:6F:C3:F7:F3:11:7F:29:B2:0A:D4"}}},"request":{"raw":"GET /registerSW.js HTTP/1.1\r\nHost: velcuri.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\ncontent-type: application/javascript\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\ndate: Fri, 27 Feb 2026 06:31:47 GMT\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aQNESn47gwaUIYaCs3Tl2Xb%2B16PyRs7ecfKtM0kHYyL5oLETX4qL3WcTIoHYMJ2vp6PR9yjbeFJAUTZun6GCHE7E46Xg0XYqYYI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"deea95fdc0d94f1e17d79f957942afc2\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9d45a42bfa591525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":134,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with no line terminators","md5":"1872c500de691dce40960bb85481de07","sha1":"b83dfcba8d2c57ca8837324bf395f34748033a50","sha256":"9742073ef7fc795e7673d98f272992843298426a0ffd8cb3507784df5143608b","sha512":"bf592ecb654fd8c3dba5db1816c3e454d72e3ef9cf078ca71314b68782e8f564b585ef21d7ca0b4a69540d2843ec713058d86cf40419b6b099f58df5f6f82041","ssdeep":"","tlshash":"2cc02b4fca4dc93e0830e0324c0b7b03331f0385c080049007f2030850c3414d1ae481","first_seen":"2023-03-11T15:21:23Z","last_seen":"2026-08-09T00:21:37.622677Z","times_seen":15988,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/ab3cb14ae4c244a1d2f8e0053d40ac2a-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/ab3cb14ae4c244a1d2f8e0053d40ac2a-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=2s8sB1OsqwJ9WLpW; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg10_=1772173908; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg1_=fJQJqdPRcl3wUR6AtEfQ; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:49 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 18337\r\nlast-modified: Thu, 26 Feb 2026 05:00:40 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd378-47a1\"\r\nage: 1\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":18337,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"50d7ebbf86b711acb4a8fe3b6c30bf43","sha1":"1adc7183f19be2f7ad437990e6640e22b25bd0a7","sha256":"f7ba5e284fc2362b81f2891e24b849e6d23df5842bbd2e9089eeffb03e8c2f3c","sha512":"9281341a16d491f3a3b723fbed9b57218451d461c827d254031b0983f10b66f10ba166a150816edd099b640ca52e1c256c56e11c5c0b02245e969d804243705f","ssdeep":"384:RKcn80Rv5Ulvi+e1B54OzfSflmjsgZul7FMNhlNp/drEg:RKc80OviHuMjsg0lZm3pV5","tlshash":"0982cf4ad464dda1bdd444bb4bf8e0a0618888d5dbbfb896814b8134b2b1f0cce4fc5d","first_seen":"2026-02-27T03:28:40.591428Z","last_seen":"2026-02-27T06:32:25.001747Z","times_seen":2,"resource_available":false,"data":null}},"time_used":507,"timings":{"blocked":110,"dns":68,"connect":22,"send":0,"wait":268,"receive":3,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"raw.githubusercontent.com/albinchristo04/ptv/refs/heads/main/events_with_m3u8.json","fqdn":"raw.githubusercontent.com","domain":"raw.githubusercontent.com","tld":"githubusercontent.com"},"ip":{"addr":"185.199.109.133","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 07 Mar 2025 00:00:00 GMT","end":"Sat, 07 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"8C:FF:59:E5:8E:C4:FA:76:FE:AF:2D:C5:C0:D4:13:6A:77:2D:F9:91","sha256":"7D:11:22:EA:96:98:52:34:1E:8D:D9:2B:CC:0C:7E:CC:00:96:30:D1:4D:A7:34:D7:CA:42:D5:B5:4A:2B:20:97"}}},"request":{"raw":"GET /albinchristo04/ptv/refs/heads/main/events_with_m3u8.json HTTP/1.1\r\nHost: raw.githubusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nOrigin: https://velcuri.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=300\r\ncontent-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox\r\ncontent-type: text/plain; charset=utf-8\r\netag: W/\"af530765595490bc067026ea4426d11964eb7b3e197f38a2f0ad544aa05dc944\"\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nx-frame-options: deny\r\nx-xss-protection: 1; mode=block\r\nx-github-request-id: EFC2:192CFB:6FACFE:7F5619:69A13A53\r\ncontent-encoding: gzip\r\naccept-ranges: bytes\r\ndate: Fri, 27 Feb 2026 06:31:48 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-hel1410025-HEL\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1772173908.152103,VS0,VE158\r\nvary: Authorization,Accept-Encoding\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-fastly-request-id: 56d3e245a3754b1769a541b6da7eb4d1170700ca\r\nexpires: Fri, 27 Feb 2026 06:36:48 GMT\r\nsource-age: 0\r\ncontent-length: 9800\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"GitHub Pages","description":"GitHub Pages is a static site hosting service.","website":"https://pages.github.com/","common_platform_enumeration":"","icon":"GitHub.svg","categories":["PaaS"]},{"name":"Fastly","description":"Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video \u0026 streaming services.","website":"https://www.fastly.com","common_platform_enumeration":"","icon":"Fastly.svg","categories":["CDN"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":64373,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"JSON text data","md5":"958209f7a53b942e9e7de84733e4126a","sha1":"e8c7487432a772fad64281044732e2d907221bf2","sha256":"1fe185cfb26d97f4aed3504fb5483ef4f5d660cfbc7d619066a03ac2ef2f6e04","sha512":"5c4d6dd3b00228393f1726d68c74a9f4688c432915b95e5d65f03c58af7c082722fb6ee1227564e45055d620391c387ab0b800c522e3a92cf988091bf7b782f7","ssdeep":"384:GkjZBAi+mw6Lh24Fu7txBdPvzHfwrBu7RU7SFteEmIpPBD:k4w4wphH4GhmKD","tlshash":"7853bbb7c5b60c47688168b4849817c7b19152430f8a3d4977aec98c1f9eeaf39b623d","first_seen":"2026-02-27T03:28:40.57059Z","last_seen":"2026-02-27T06:32:25.002784Z","times_seen":2,"resource_available":false,"data":null}},"time_used":384,"timings":{"blocked":98,"dns":31,"connect":26,"send":0,"wait":185,"receive":2,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.ppv.to/assets/thumb/676a00266118bd5918ff28bf23a97794-thumbnail.jpg","fqdn":"api.ppv.to","domain":"ppv.to","tld":"to"},"ip":{"addr":"185.178.208.158","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:48.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ppv.to","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 17:53:21 GMT","end":"Fri, 22 May 2026 17:53:20 GMT"},"fingerprint":{"sha1":"50:7F:AC:79:59:07:23:FB:FC:CA:7D:A8:09:16:56:EB:E7:72:4F:3B","sha256":"EF:DF:ED:0D:99:A0:FE:C4:69:6A:9D:37:82:73:9F:06:E9:90:54:14:16:AF:B0:A9:3B:47:83:55:F1:1E:DA:F5"}}},"request":{"raw":"GET /assets/thumb/676a00266118bd5918ff28bf23a97794-thumbnail.jpg HTTP/1.1\r\nHost: api.ppv.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=ErCM9nW1LE9EiVUO; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg10_=1772173908; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg9_=91.90.42.154; Domain=.ppv.to; Path=/; Expires=Fri, 27-Feb-2026 06:51:48 GMT\n__ddg1_=uUhw31FFCXsgsYr0VXtT; Domain=.ppv.to; HttpOnly; Path=/; Expires=Sat, 27-Feb-2027 06:31:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Fri, 27 Feb 2026 06:31:48 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 13618\r\nlast-modified: Thu, 26 Feb 2026 05:00:39 GMT\r\naccept-ranges: bytes\r\nddg-cache-status: MISS,MISS\r\netag: \"699fd377-3532\"\r\nage: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":13618,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 94\", baseline, precision 8, 300x168, components 3","md5":"ea0aebf4537b9075b4f4bfd915d488f9","sha1":"3a31a3af04e594c35577c18197c72b3b0aacf49a","sha256":"5b29a69d238d32d0daae571a562c9037ad710772bd712932176e6e3047538577","sha512":"e52c7f62828fc019288b45d4871c35c34301fde3d8058b76ce24288964d466a9bfd58a90d37199e9e0c335c2904592d1cbb6005cb0091e8823fa4c9427e8749d","ssdeep":"384:RfW2bhQ5DINBT/VUoXTz6YIEppppppppppppppqw:Rq+buoX//I/w","tlshash":"1652af35fb871f0c925f06abe5bec93d00264f185aebbda4a475f648b30e674c050946","first_seen":"2026-02-27T03:28:40.572086Z","last_seen":"2026-02-27T06:32:25.003348Z","times_seen":2,"resource_available":false,"data":null}},"time_used":483,"timings":{"blocked":123,"dns":64,"connect":22,"send":0,"wait":230,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"flushpersist.com/pxf.gif?uuid=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=08b9d8469ec4ed128677c2468d462141\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=6","fqdn":"flushpersist.com","domain":"flushpersist.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:49.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"flushpersist.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 22:12:10 GMT","end":"Wed, 27 May 2026 22:12:09 GMT"},"fingerprint":{"sha1":"F8:CE:1C:DD:8F:86:0E:25:10:C6:86:56:A7:A3:47:DA:38:11:C7:3A","sha256":"19:3B:E0:74:B6:FC:9E:17:C4:75:30:39:E3:6A:CB:EF:32:91:9E:69:12:DF:51:AC:FA:76:15:EE:1B:D3:36:B8"}}},"request":{"raw":"GET /pxf.gif?uuid=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d\u0026eb=bff3d6bf6d16c0bb5e58232c1a99ef63\u0026te=fe015aeda515c30449c87b1701cc307f\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.3095\u0026b_frame=0\u0026pk=08b9d8469ec4ed128677c2468d462141\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=6 HTTP/1.1\r\nHost: flushpersist.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:49 GMT\r\nContent-Type: image/gif\r\nContent-Length: 1\r\nConnection: keep-alive\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\nx-envoy-upstream-service-time: 1\r\nHost: flushpersist.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 9136ea916bbe84efc7ab97c887ad53da\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T00:49:09.385487Z","times_seen":17789936,"resource_available":true,"data":null}},"time_used":666,"timings":{"blocked":284,"dns":1,"connect":94,"send":0,"wait":96,"receive":0,"ssl":188},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/sbar.json?key=08b9d8469ec4ed128677c2468d462141\u0026uuid=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d%3A3%3A1","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:49.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /sbar.json?key=08b9d8469ec4ed128677c2468d462141\u0026uuid=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d%3A3%3A1 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nOrigin: https://velcuri.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Fri, 27 Feb 2026 06:31:49 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 3913\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://velcuri.io\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\nset-cookie: uid_id2=7f4a68f3-2d38-48fe-815a-f5eb3cc94b7d:3:1; expires=Fri, 06 Mar 2026 06:31:49 GMT; path=/; secure; SameSite=None\npdhtkv=true; expires=Sat, 28 Feb 2026 06:31:49 GMT; path=/; secure; SameSite=None\nuncs=1; expires=Sat, 28 Feb 2026 06:31:49 GMT; path=/; secure; SameSite=None\npdhtkv29=true; expires=Sat, 28 Feb 2026 06:31:49 GMT; path=/; secure; SameSite=None\nuncs29=1; expires=Sat, 28 Feb 2026 06:31:49 GMT; path=/; secure; SameSite=None\nu_pl28382109=1; expires=Sat, 28 Feb 2026 06:31:49 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 218\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: d1f33286d3800848ef4a19f75f208174\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5288,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"JSON text data","md5":"4f65a2c5230d05b16b6ce820d56fdfaa","sha1":"e64500ca1693927453df1bcb61c490ca7eeba8d8","sha256":"53f15575e429fe399f24cf44e8fd852456cd889abb67b06f6cfcb2ae194a23f4","sha512":"697edc092e493ee4c0fbda8df55cc348f5c10056c9e7252ef2f726cb75f49668b8a6bcde33a286dd899ed8b4f3f74182219653fc0c4fd609edafe5f2ed5f261a","ssdeep":"96:9zy+nH77OXhlkrHYa3M7Rfv0XwrVGjBVxetikxUIKMaH/R8/0Uy9:9zyUH77YhlGjM7Z0XwrVGnYMkLER8/0n","tlshash":"2fb17d5b290426a49e33cc5b18762ff93c546d0f68f5807ac5deb1dfe71a80acb07141","first_seen":"2026-02-27T06:32:25.004091Z","last_seen":"2026-02-27T06:32:25.004091Z","times_seen":1,"resource_available":false,"data":null}},"time_used":901,"timings":{"blocked":293,"dns":15,"connect":91,"send":0,"wait":313,"receive":1,"ssl":186},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"creative-sb1.com/sb/notifications/games/lust-goddess/6/css/magic.css","fqdn":"creative-sb1.com","domain":"creative-sb1.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://velcuri.io/","date":"2026-02-27T06:31:49.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"creative-sb1.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 22 Feb 2026 22:50:15 GMT","end":"Sat, 23 May 2026 23:48:46 GMT"},"fingerprint":{"sha1":"E0:64:EB:B0:39:B0:1B:31:05:CE:A0:93:C8:74:E7:A4:DE:D1:B3:77","sha256":"6D:BC:A3:C7:8F:67:2C:FE:E1:7A:88:EA:6C:8E:07:D4:1D:1F:CA:FD:54:30:02:80:22:B2:74:B5:95:C4:99:75"}}},"request":{"raw":"GET /sb/notifications/games/lust-goddess/6/css/magic.css HTTP/1.1\r\nHost: creative-sb1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://velcuri.io/\r\nOrigin: https://velcuri.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 27 Feb 2026 06:31:50 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Thu, 10 Apr 2025 14:45:49 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"67f7d99d-affe\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FIgOr8m4gbWJQPvfthTJUiLpEK75eddx0wGWXPuxn4mV3hDXmJGKQc1w%2B4TMlagtGFMfvNv5eiNk8m8Qd2UOr8tUA59rw6O7MNXhWJQDH2E%3D\"}]}\r\ncf-ray: 9d45a439bf882efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45054,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"bcd1967f8c2604f55f57197de0ae895e","sha1":"c31a10c3ecde74b50450a0a1ad21aa474ff05e7d","sha256":"787eac5d9417257a04de7b18ef21f5ec887de3aee642ceba9a7d56a8209eea2a","sha512":"b37f1a61bbe740bc29308e664227701366ac978d4fbed081f13c47200edd74a792ab980559a236cff39ae27d3fda3ffffef3f1ac2dc420612b616496b44e9df8","ssdeep":"384:lQLl1pRp0itimTKDbObwHuHXFlF7FPFSWRyYyRZZZaZjZPfbfUO3OipypE:GpRp0itiFbObwHuHXFlF7FPFSWX","tlshash":"b913276b2dd2114086564365a3fe6b2c261c85c31c6becfab3a218ce8f1567c53db61f","first_seen":"2025-06-11T18:18:27.729381Z","last_seen":"2026-08-08T08:20:17.876563Z","times_seen":5770,"resource_available":false,"data":null}},"time_used":574,"timings":{"blocked":63,"dns":34,"connect":1,"send":0,"wait":448,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"creative-sb1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}