{"report_id":"b3292a9f-9aa8-466d-8c21-f567b52ecd38","version":6,"status":"done","tags":[],"date":"2025-03-26T06:53:31Z","url":{"schema":"http","addr":"krar29.cc/?from_host=kr2.expert","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"krar29.cc/","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"title":"Just a moment..."},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-04T06:53:31Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"krar29.cc","ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-03-21","domain_rank":0,"first_seen":"2025-03-26T06:53:31.435361Z","last_seen":"2025-03-26T06:53:31.435361Z","alert_count":8,"request_count":8,"received_data":72272,"sent_data":5614,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}]},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"krar29.cc/","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a1edc37c8e3ac768dd33e2d4cb42cafe","sha1":"18a8b4436ac3a7c43c4e0a4b0447fa0a0c4326f1","sha256":"5e65b7779aa16aca85d3187a963ac1ecad9ce623c7df36c7fb315b00fcb2c6a9","sha512":"02b5bc7079232b511de90c8d5ac447721b96a1472138cf0e9de274ba3d895b52e4e781a05812ce8f32a30a3822c9240cc7fde176731d9a04a76cf7a3ac352e36","ssdeep":"","tlshash":"899002a359b1509b87265a14524671122b260971870e5717155a0a718574744e941b55","size":57,"data":"","first_seen":"2025-03-07T11:01:59.145819Z","last_seen":"2026-07-22T17:23:02.6655Z","times_seen":831,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/js/connect.min.js?2","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ddc1c95b6ab9223711ed7f50a15bc930","sha1":"7d6cf05a1da4d78f98f5ceba3784a0bc210116a3","sha256":"9fa0fd5b129cc1062500cf31c6be66f6617d829c3e4ccf0dc7cdba46f992632e","sha512":"115c9699f4ef5c42484fe47b58b2e87dec9cf96515a2b6da929237e7d4f3b579f2f20b4c61b9795ca549d9b3f24f85ec5afcc18431e26c215108366f3491f4cc","ssdeep":"192:op2O/++sssVpvqUl87UlCUldUlQwV3drycp3FJQipv8DIk1FBHwKs/XsUCbl3Pii:o0O/++sss6UlyUlCUldUlBXp3PDN8Dhl","tlshash":"84329840eae4f855a613139da70bbbc4f10815aa30201f97a76c1d88f95e47be6b3d73","size":11274,"data":"","first_seen":"2023-05-03T10:33:12Z","last_seen":"2026-07-22T17:23:02.658701Z","times_seen":1046,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5395242a0bfb4fd0959fe2d970527657","sha1":"37b508997b5cfb014d544f49c1118c9efe1eb488","sha256":"9075900ad1e7f61a99bd147150afec571bd67ecbe842c694d338eb7c7f3279b3","sha512":"c3195da87f6da9ed0cc393075d8a4353176d13034b9d7774c90a80504d547ee6cb3f5ea3ed8ee522f8610242fc751df25dafd9e92cf70f9ccca19ede943ee58a","ssdeep":"","tlshash":"8090024585867151d432257441ad50a0416854016c1dec12210c9c210d4032b5d44291","size":53,"data":"","first_seen":"2025-03-07T11:01:59.148941Z","last_seen":"2026-06-07T07:16:29.618226Z","times_seen":885,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/cloudflare_captcha_frame.php","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5c44a1351b676d21630ad494130fc92e","sha1":"71e23457ad44c5dff057ca9780274cf03fa21d5c","sha256":"ad396249ae1173bfcb60b44b4eaa16814b8674c63161446b7300af7bfb5e2468","sha512":"a7ebe5f08f88ee21a0b398933313d5e70c4d616b3f194f5cbe573db6b954367bfd483234d7c2be477f68305cb9e292f30d966b203e89f8a2f027fc0624e4ec57","ssdeep":"","tlshash":"e5f046af3fb706750ddb96b238ba8bc9383294125981aa06fa3c4070cc21e933036dd5","size":580,"data":"","first_seen":"2025-03-07T11:01:59.146646Z","last_seen":"2025-12-11T13:00:26.353828Z","times_seen":93,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"krar29.cc/?from_host=kr2.expert","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"","requested_by":"","date":"2025-03-26T06:53:09.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krar29.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 21 Mar 2025 19:39:04 GMT","end":"Thu, 19 Jun 2025 20:37:46 GMT"},"fingerprint":{"sha1":"74:CA:C3:7B:DB:0D:6C:34:B2:DC:2F:8C:10:2D:15:21:9E:76:A1:82","sha256":"AA:C7:90:58:A0:16:FA:03:46:54:FE:73:E2:F5:54:CF:91:48:E1:94:E6:53:2A:D9:18:26:D5:E5:F3:B9:79:A7"}}},"request":{"raw":"GET /?from_host=kr2.expert HTTP/1.1\r\nHost: krar29.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Wed, 26 Mar 2025 06:53:09 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nset-cookie: http_refererq2=https%3A%2F%2Fkr2.expert; expires=Wed, 26 Mar 2025 07:53:09 GMT; Max-Age=3600; path=/; domain=.krar29.cc\r\nlocation: /\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=MPGNNc6QanrhV7vgPEsl9V4RngEbODj%2Fu8gBv%2BMB8qftBsm%2B94zlCjYtXOKDJXzuO0enz0cnw1a09EEJhv0D1jvoFuSbSdZ%2FQjG6V72LUhf2hJtbyQDpHbbhy%2FM%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9264bab509fe56a5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=492\u0026min_rtt=449\u0026rtt_var=127\u0026sent=7\u0026recv=10\u0026lost=0\u0026retrans=0\u0026sent_bytes=3191\u0026recv_bytes=1137\u0026delivery_rate=7156507\u0026cwnd=253\u0026unsent_bytes=0\u0026cid=b89b16dfb5e7f531\u0026ts=67\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":null,"data":{"size":910,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T07:24:32.824991Z","times_seen":17471071,"resource_available":true,"data":null}},"time_used":112,"timings":{"blocked":35,"dns":5,"connect":1,"send":0,"wait":42,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"","requested_by":"","date":"2025-03-26T06:53:09.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krar29.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 21 Mar 2025 19:39:04 GMT","end":"Thu, 19 Jun 2025 20:37:46 GMT"},"fingerprint":{"sha1":"74:CA:C3:7B:DB:0D:6C:34:B2:DC:2F:8C:10:2D:15:21:9E:76:A1:82","sha256":"AA:C7:90:58:A0:16:FA:03:46:54:FE:73:E2:F5:54:CF:91:48:E1:94:E6:53:2A:D9:18:26:D5:E5:F3:B9:79:A7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: krar29.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkr2.expert; tor_scheme_id=1743604038; tor_port=9147; session_id=80ad4e99cd4b1c38368c1b871a07fa16; session_id_e=48f46b53dddc85d4975ce78cfe3cd52d; connecting_hash_lite_version=1742971989; connecting_hash=848955ae4736cc9f70e40df3a28a17e6; onion_server_id=4; session_temp_active=1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 26 Mar 2025 06:53:09 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\npriority: u=1,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=0iYuk5OvRQMupVFZ7ko8zdcjNATTlp8hp%2F5XjICGTD5ZUoLDITcq%2B%2BOh5xdkVu1NBx8qtf9fu%2BuotwqKNisgJn%2B2nONbJMQWeW92jtZXTB1ZnsGm70xX1LWmPyc%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9264bab82dd81bfe-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=6130\u0026min_rtt=2346\u0026rtt_var=5676\u0026sent=22\u0026recv=14\u0026lost=0\u0026retrans=0\u0026sent_bytes=9473\u0026recv_bytes=2940\u0026delivery_rate=17212\u0026cwnd=12000\u0026unsent_bytes=0\u0026cid=8fa4dc6ee7701aa9\u0026ts=454\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":14155,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T07:24:32.824991Z","times_seen":17471071,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/cdn-cgi/images/trace/managed/nojs/transparent.gif?ray=794d630be9c098f7","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"","requested_by":"https://krar29.cc/","date":"2025-03-26T06:53:09.853Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krar29.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 21 Mar 2025 19:39:04 GMT","end":"Thu, 19 Jun 2025 20:37:46 GMT"},"fingerprint":{"sha1":"74:CA:C3:7B:DB:0D:6C:34:B2:DC:2F:8C:10:2D:15:21:9E:76:A1:82","sha256":"AA:C7:90:58:A0:16:FA:03:46:54:FE:73:E2:F5:54:CF:91:48:E1:94:E6:53:2A:D9:18:26:D5:E5:F3:B9:79:A7"}}},"request":{"raw":"GET /cdn-cgi/images/trace/managed/nojs/transparent.gif?ray=794d630be9c098f7 HTTP/1.1\r\nHost: krar29.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krar29.cc/\r\nCookie: http_refererq2=https%3A%2F%2Fkr2.expert; tor_scheme_id=1743604038; tor_port=9147; session_id=80ad4e99cd4b1c38368c1b871a07fa16; session_id_e=48f46b53dddc85d4975ce78cfe3cd52d; connecting_hash_lite_version=1742971989; connecting_hash=848955ae4736cc9f70e40df3a28a17e6; onion_server_id=4; session_temp_active=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Wed, 26 Mar 2025 06:53:09 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncf-ray: 9264bab89e341bfe-OSL\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":151,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"f881a8d5c091a058c57c9a0a39c25273","sha1":"a0278a1d1cac199fa7e5d1678c61b5e74197a061","sha256":"214074544b89b4b0bb7b0ff09d7ff12a8c129fc6579a65101ca8780aca0f5d32","sha512":"7bc261348597de7f6df3fc85dd53bffe5d40fea88361c7540d4ec0723e2f558d08f6c2495be33066ec982e4825f87fcf82fe57e1c3db4b2a344af71a754e5140","ssdeep":"","tlshash":"78c08c2cb863720445038aa10ac33582d28aa226a4fa8022068a4203e0ca2fac4ea3d5","first_seen":"2024-01-09T16:14:11Z","last_seen":"2025-04-06T10:31:59.390286Z","times_seen":106,"resource_available":false,"data":null}},"time_used":4,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/favicon.ico","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"","requested_by":"https://krar29.cc/","date":"2025-03-26T06:53:09.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krar29.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 21 Mar 2025 19:39:04 GMT","end":"Thu, 19 Jun 2025 20:37:46 GMT"},"fingerprint":{"sha1":"74:CA:C3:7B:DB:0D:6C:34:B2:DC:2F:8C:10:2D:15:21:9E:76:A1:82","sha256":"AA:C7:90:58:A0:16:FA:03:46:54:FE:73:E2:F5:54:CF:91:48:E1:94:E6:53:2A:D9:18:26:D5:E5:F3:B9:79:A7"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: krar29.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krar29.cc/\r\nCookie: http_refererq2=https%3A%2F%2Fkr2.expert; tor_scheme_id=1743604038; tor_port=9147; session_id=80ad4e99cd4b1c38368c1b871a07fa16; session_id_e=48f46b53dddc85d4975ce78cfe3cd52d; connecting_hash_lite_version=1742971989; connecting_hash=848955ae4736cc9f70e40df3a28a17e6; onion_server_id=4; session_temp_active=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET","post_data":{"size":1537,"data":"{\"signature\":\"UxFdVMwNFNwN0wzODEybVeyJhcHBfdmVyc2lvbiI6IjAuNi40IiwiY2FmX2NsaWVudF9pZCI6InBhcnRuZXItZHAtYm9kaXM0MiIsImNhZl90aW1lZF9vdXQiOmZhbHNlLCJjaGFubmVsIjoicGlkLWJvZGlzLWdjb250cm9sNDcscGlkLWJvZGlzLWdjb250cm9sMTA2LHBpZC1ib2Rpcy1nY29udHJvbDQyNyxwaWQtYm9kaXMtZ2NvbnRyb2wxNDkscGlkLWJvZGlzLWdjb250cm9sMTk0IiwiZGVza3RvcCI6dHJ1ZSwidGVybXMiOiIiLCJmZF9zZXJ2ZXJfZGF0ZXRpbWUiOjE3NDI5NzE5ODcsImZkX3NlcnZlciI6ImlwLTEwLTIwMS00NC0yMDUuZWMyLmludGVybmFsIiwiZmxleF9ydWxlIjp7ImFjdGlvbiI6IiIsImN1c3RvbV9yZWFzb24iOiIiLCJmbGV4X2lkIjowLCJtaXNtYXRjaCI6ZmFsc2V9LCJob3N0IjoiY2FyLXdyZWNrLWxhd3llci1uZWFyLW1lLXVzLTQ1My54eXoiLCJpcCI6IjkxLjkwLjQyLjE1NCIsIml2dCI6ZmFsc2UsIm1vYmlsZSI6ZmFsc2UsInBhZ2VfaGVhZGVycyI6e30sInBhZ2VfbWV0aG9kIjoiR0VUIiwicGFnZV9yZXF1ZXN0Ijp7fSwicGFnZV90aW1lIjoxNzQyOTcxOTg2LCJwYWdlX3VybCI6Imh0dHBzOi8vY2FyLXdyZWNrLWxhd3llci1uZWFyLW1lLXVzLTQ1My54eXovIiwidGFibGV0IjpmYWxzZSwidGVtcGxhdGVfaWQiOjM0NCwidHlwZSI6ImludmFsaWRfcmVmZXJyYWwiLCJ1c2VyX2hhc19hZF9ibG9ja2VyIjpudWxsLCJ1c2VyX2lkIjo5NjY2MywidXVpZCI6IjkwN2VkN2RhLTk5OWQtNDc3OC05ODU2LWZlMWU2ZWQwMjJiOSIsInplcm9jbGljayI6e30sInBvcHVwIjpmYWxzZSwidGltZXpvbmVfb2Zmc2V0IjowLCJ1c2VyX3ByZWZlcmVuY2UiOnsibG9jYWxlIjoiZW4tVVMiLCJjYWxlbmRhciI6ImdyZWdvcnkiLCJudW1iZXJpbmdTeXN0ZW0iOiJsYXRuIiwidGltZVpvbmUiOiJVVEMiLCJ5ZWFyIjoibnVtZXJpYyIsIm1vbnRoIjoibnVtZXJpYyIsImRheSI6Im51bWVyaWMifSwidXNlcl91c2luZ19kYXJrbW9kZSI6ZmFsc2UsInVzZXJfc3VwcG9ydHNfZGFya21vZGUiOnRydWUsIndpbmRvd19yZXNvbHV0aW9uIjp7IndpZHRoIjoxMjgwLCJoZWlnaHQiOjEwMjR9LCJzY3JlZW5fcmVzb2x1dGlvbiI6eyJ3aWR0aCI6MTI4MCwiaGVpZ2h0IjoxMDI0fSwiZnJhbWUiOm51bGx9\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 26 Mar 2025 06:53:09 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\nlast-modified: Sun, 09 Feb 2025 16:09:29 GMT\r\netag: W/\"256-62db7d10c4fa0\"\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\npriority: u=6,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=jM9B%2B7L46E%2FPGGB9WZ3slylXGe%2BvH4Txf37ywV%2FArslU0bxly%2F6M5XE4AB7%2FkJYPyqNyjQfCfnwvbd7P7SgIT0iK3HLwlVmXkriRzw6yZHc2f1W21ghG6Wh9vEY%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 9264bab8ce641bfe-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=5644\u0026min_rtt=1363\u0026rtt_var=5084\u0026sent=42\u0026recv=20\u0026lost=0\u0026retrans=0\u0026sent_bytes=24218\u0026recv_bytes=4646\u0026delivery_rate=958\u0026cwnd=12000\u0026unsent_bytes=0\u0026cid=8fa4dc6ee7701aa9\u0026ts=567\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":598,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced","md5":"88dce50c34a848e75b6c7d916711e6b9","sha1":"0355f55c57c14900477cc886f3345b1e898fe28e","sha256":"4f0b7e5217318eedc1b42ca1ce5e128c649c97082912f1d800eec1325207ad96","sha512":"f6e0828ce51c9e2cb462b4884f01a5fb7083e4f26eeea1b596c5d04144b9226efb62347199546ce81e0473d97231cb1f6468ccc94e620cf83ffd9035fb63eed5","ssdeep":"","tlshash":"faf00ce3e838f489c98e2ca222911201da7585a723800819b6fac008ac20b885933f92","first_seen":"2023-05-10T12:46:36Z","last_seen":"2026-07-22T17:23:02.659981Z","times_seen":3747,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"","requested_by":"","date":"2025-03-26T06:53:09.357Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krar29.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 21 Mar 2025 19:39:04 GMT","end":"Thu, 19 Jun 2025 20:37:46 GMT"},"fingerprint":{"sha1":"74:CA:C3:7B:DB:0D:6C:34:B2:DC:2F:8C:10:2D:15:21:9E:76:A1:82","sha256":"AA:C7:90:58:A0:16:FA:03:46:54:FE:73:E2:F5:54:CF:91:48:E1:94:E6:53:2A:D9:18:26:D5:E5:F3:B9:79:A7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: krar29.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkr2.expert\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET","post_data":{"size":995,"data":"{\"ek.platformVersion\":\"a7945e4a\",\"ek.tabId\":\"83de7e67391be3ee39ffdd4ce778e8c0dbec1a2d184d9643b3fcaac17036\",\"ek.timestampCreated\":1742971983,\"ek.deviceFlags\":\"1310720|10001110001000000\",\"ek.httpHost\":\"sexcam-free.com\",\"ek.httpPath\":\"/syka0001?abtest=gototheroom_aaa_2\u0026abtestvariant=gototheroom_aaa_2_paidusers_51\u0026affiliateid=191124ciqtlhqfchtfb7vpjahqpu1ic3i7sdxvdt8wlxpbdvnfjda578i2gz0g2e\u0026campaignid=sildenafilcitrate50.com\u0026realdomain=go.rmhfrtnd.com\u0026referrer=https:/bing.com/\u0026stripbotvariation=nullwidget\u0026userid=5aa5341149705d4bd02e6e0d921c311f22c02c76af5dd36c43167e9f488db3d4\",\"ek.isDocumentHidden\":0,\"ek.isTabFocused\":0,\"ek.pageClass\":\"uncategorized\",\"g.guestIdUnique\":\"d0f80d314cb595fb107a6d6912d6b53850fd97cb613dcd91cb05b1f7b291e6ea\",\"abta.assignmentTimestamp\":1742971983,\"abta.key\":\"streaming_cdn\",\"abta.name\":\"ab_streaming_cdn_cdn77_bityplus\",\"abta.userGroup\":\"X\",\"abta.userPart\":319,\"eventName\":\"gabtass\",\"ek.contractVersion\":\"v0.3.0\",\"ek.eventId\":\"c18c1247-1ad8-4b3a-a08e-34c469e4d27a\"}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 26 Mar 2025 06:53:09 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nset-cookie: tor_scheme_id=1743604038; expires=Thu, 26 Mar 2026 06:53:09 GMT; Max-Age=31536000; path=/\ntor_port=9147; expires=Thu, 26 Mar 2026 06:53:09 GMT; Max-Age=31536000; path=/\nsession_id=80ad4e99cd4b1c38368c1b871a07fa16; expires=Thu, 26 Mar 2026 06:53:09 GMT; Max-Age=31536000; path=/\nsession_id_e=48f46b53dddc85d4975ce78cfe3cd52d; expires=Thu, 26 Mar 2026 06:53:09 GMT; Max-Age=31536000; path=/; domain=.krar29.cc\nconnecting_hash_lite_version=1742971989; expires=Thu, 26 Mar 2026 06:53:09 GMT; Max-Age=31536000; path=/; domain=.krar29.cc\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=zTVUPYrqzKcvrdeMdVfWP52mDNcyynYcwcF%2FChuHYJoWAJRjct%2Fmt9wrXgNVAb8qPrue7CK7JxbNtN5lHB9Y8DvYh1GGp3wvCwHwD5WLXH6dchoSX22y3YgDVRM%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9264bab57a7956a5-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=8423\u0026min_rtt=449\u0026rtt_var=13351\u0026sent=9\u0026recv=12\u0026lost=0\u0026retrans=0\u0026sent_bytes=3901\u0026recv_bytes=1234\u0026delivery_rate=7156507\u0026cwnd=256\u0026unsent_bytes=0\u0026cid=b89b16dfb5e7f531\u0026ts=123\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":910,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (993), with no line terminators","md5":"e20ba977541160b4b2623e3fc7a04ecc","sha1":"d84102a88468963e3b9c8ac901cb9fbe18ee9d12","sha256":"10d718b4ef1adcbb83caa3143bfbfca893c19e49f1a795be7f831b95dbf062ce","sha512":"c5945da5776750d20574ebc48151d880a564b0d54beabe22f9056eb39f9d2fa2dff58f7b8421dffea2927675cfe740653cbcad6791d8ab9412e2dee87bc1ceee","ssdeep":"","tlshash":"8311531f3cf1c1958a014ed179feba3c6a9db8566b10dc4863c8483ec198bf4da67788","first_seen":"2025-03-26T06:53:34.98072Z","last_seen":"2025-03-26T06:53:34.98072Z","times_seen":1,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/js/connect.min.js?2","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"","requested_by":"https://krar29.cc/","date":"2025-03-26T06:53:09.644Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krar29.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 21 Mar 2025 19:39:04 GMT","end":"Thu, 19 Jun 2025 20:37:46 GMT"},"fingerprint":{"sha1":"74:CA:C3:7B:DB:0D:6C:34:B2:DC:2F:8C:10:2D:15:21:9E:76:A1:82","sha256":"AA:C7:90:58:A0:16:FA:03:46:54:FE:73:E2:F5:54:CF:91:48:E1:94:E6:53:2A:D9:18:26:D5:E5:F3:B9:79:A7"}}},"request":{"raw":"GET /js/connect.min.js?2 HTTP/1.1\r\nHost: krar29.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krar29.cc/\r\nCookie: http_refererq2=https%3A%2F%2Fkr2.expert; tor_scheme_id=1743604038; tor_port=9147; session_id=80ad4e99cd4b1c38368c1b871a07fa16; session_id_e=48f46b53dddc85d4975ce78cfe3cd52d; connecting_hash_lite_version=1742971989\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 26 Mar 2025 06:53:09 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 2923\r\nlast-modified: Sun, 09 Feb 2025 16:09:42 GMT\r\netag: \"2c0a-62db7d1d5dcca-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 1258\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=W3fRUAJwktzSmDjvrAi4i3fwoHO7PFlDGG8AyOTaAUn8Szmm0x9ikZ3iRw9d3tsp4vw%2FhgfQBUC%2Fk0r7ygP%2Frw7jeSUbq2EOparKBPZFYpNeHWinxK1qrG88htk%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9264bab74d3a1bfe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=3134\u0026min_rtt=3131\u0026rtt_var=1176\u0026sent=13\u0026recv=8\u0026lost=0\u0026retrans=0\u0026sent_bytes=4140\u0026recv_bytes=1336\u0026delivery_rate=189701\u0026cwnd=12000\u0026unsent_bytes=0\u0026cid=8fa4dc6ee7701aa9\u0026ts=304\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11274,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (11274), with no line terminators","md5":"ddc1c95b6ab9223711ed7f50a15bc930","sha1":"7d6cf05a1da4d78f98f5ceba3784a0bc210116a3","sha256":"9fa0fd5b129cc1062500cf31c6be66f6617d829c3e4ccf0dc7cdba46f992632e","sha512":"115c9699f4ef5c42484fe47b58b2e87dec9cf96515a2b6da929237e7d4f3b579f2f20b4c61b9795ca549d9b3f24f85ec5afcc18431e26c215108366f3491f4cc","ssdeep":"192:op2O/++sssVpvqUl87UlCUldUlQwV3drycp3FJQipv8DIk1FBHwKs/XsUCbl3Pii:o0O/++sss6UlyUlCUldUlBXp3PDN8Dhl","tlshash":"84329840eae4f855a613139da70bbbc4f10815aa30201f97a76c1d88f95e47be6b3d73","first_seen":"2023-05-03T10:33:12Z","last_seen":"2026-07-22T17:23:02.658701Z","times_seen":1046,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"","requested_by":"","date":"2025-03-26T06:53:09.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krar29.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 21 Mar 2025 19:39:04 GMT","end":"Thu, 19 Jun 2025 20:37:46 GMT"},"fingerprint":{"sha1":"74:CA:C3:7B:DB:0D:6C:34:B2:DC:2F:8C:10:2D:15:21:9E:76:A1:82","sha256":"AA:C7:90:58:A0:16:FA:03:46:54:FE:73:E2:F5:54:CF:91:48:E1:94:E6:53:2A:D9:18:26:D5:E5:F3:B9:79:A7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: krar29.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkr2.expert; tor_scheme_id=1743604038; tor_port=9147; session_id=80ad4e99cd4b1c38368c1b871a07fa16; session_id_e=48f46b53dddc85d4975ce78cfe3cd52d; connecting_hash_lite_version=1742971989; connecting_hash=848955ae4736cc9f70e40df3a28a17e6; onion_server_id=4\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\ndate: Wed, 26 Mar 2025 06:53:09 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nset-cookie: proxy_cf_session_id=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; domain=.krar29.cc\nsession_temp_active=1; expires=Wed, 26 Mar 2025 08:23:09 GMT; Max-Age=5400; path=/; domain=.krar29.cc\r\nlocation: /\r\ncf-cache-status: DYNAMIC\r\npriority: u=1,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=ibG1UIZqE2qXUiLi4KsAyLDAVksbn6hVNlywCF4spwDIHpSTRbTt3jqM2konoa8rrfcN1QyCH32PCrxGmV9O94YhjtxZ6zoRKtQXcdypmI9ddTlNcWzk4N0sClk%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9264bab7edac1bfe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=5276\u0026min_rtt=2346\u0026rtt_var=5291\u0026sent=20\u0026recv=12\u0026lost=0\u0026retrans=0\u0026sent_bytes=8656\u0026recv_bytes=2380\u0026delivery_rate=11962\u0026cwnd=12000\u0026unsent_bytes=0\u0026cid=8fa4dc6ee7701aa9\u0026ts=418\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":null,"data":{"size":14155,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T07:24:32.824991Z","times_seen":17471071,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"krar29.cc/cloudflare_captcha_frame.php","fqdn":"krar29.cc","domain":"krar29.cc","tld":"cc"},"ip":{"addr":"172.67.210.49","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"","requested_by":"https://krar29.cc/","date":"2025-03-26T06:53:09.850Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krar29.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 21 Mar 2025 19:39:04 GMT","end":"Thu, 19 Jun 2025 20:37:46 GMT"},"fingerprint":{"sha1":"74:CA:C3:7B:DB:0D:6C:34:B2:DC:2F:8C:10:2D:15:21:9E:76:A1:82","sha256":"AA:C7:90:58:A0:16:FA:03:46:54:FE:73:E2:F5:54:CF:91:48:E1:94:E6:53:2A:D9:18:26:D5:E5:F3:B9:79:A7"}}},"request":{"raw":"GET /cloudflare_captcha_frame.php HTTP/1.1\r\nHost: krar29.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krar29.cc/\r\nCookie: http_refererq2=https%3A%2F%2Fkr2.expert; tor_scheme_id=1743604038; tor_port=9147; session_id=80ad4e99cd4b1c38368c1b871a07fa16; session_id_e=48f46b53dddc85d4975ce78cfe3cd52d; connecting_hash_lite_version=1742971989; connecting_hash=848955ae4736cc9f70e40df3a28a17e6; onion_server_id=4; session_temp_active=1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 26 Mar 2025 06:53:09 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=GZS5LH0YVAsD0skcaD%2BNGzni7huSMXkVRRveXYfHffKvsgMadKH4aPH6ZaGvln28umkd0uLGTI9tglXNBRv2ghBhSzR51uRrr6yeFL%2BKfYXD1vy5oaOAlOhQXPI%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9264bab88e301bfe-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=5534\u0026min_rtt=1363\u0026rtt_var=5449\u0026sent=33\u0026recv=17\u0026lost=0\u0026retrans=0\u0026sent_bytes=17217\u0026recv_bytes=4068\u0026delivery_rate=5463402\u0026cwnd=12000\u0026unsent_bytes=0\u0026cid=8fa4dc6ee7701aa9\u0026ts=517\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":23040,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T07:24:32.824991Z","times_seen":17471071,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2025-03-26","alert":"Sinkholed","trigger":"krar29.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}