{"report_id":"b46eab03-fa89-4ab9-a3d6-86b94e3ebac8","version":6,"status":"done","tags":[],"date":"2026-01-01T22:57:13Z","url":{"schema":"http","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"title":"Candid Teens – Page 6 – XCandid","dom":{"size":44,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"73956d6ebea072659493bd6a2b58c593","sha1":"729b2f4da55d3b13b793a00fa20bc8ec10c63ed0","sha256":"7b8dc4dc541347fb74e4933dd718adb981e124bae2cded37d903791df90aafb3","sha512":"bac2a7efaaf047493b9f0d095fc259a63b44c9b6312684b01b99d709920138f7cb268a4513a6f10444c3ec14bf1f2347005dd95b00939fc1cc259a0a0dc7b4a6","ssdeep":"","tlshash":"109004fdd4d1100d5c7035d00cc113d10c14437430114f00ddc1747cd405115dc031d4","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-05T22:57:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":2,"urlquery":0,"analyzer":3}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-01T22:56:52Z","timestamp":1767308212,"ip_dst":{"addr":"162.159.207.0","port":3478,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.27","port":32934,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Session Traversal Utilities for NAT (STUN Binding Request)","source":"{\"timestamp\":\"2026-01-01T22:56:52.365864+0000\",\"flow_id\":382896262386984,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.27\",\"src_port\":32934,\"dest_ip\":\"162.159.207.0\",\"dest_port\":3478,\"proto\":\"UDP\",\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016149,\"rev\":3,\"signature\":\"ET INFO Session Traversal Utilities for NAT (STUN Binding Request)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2013_01_04\"],\"deployment\":[\"alert_only\",\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_04_24\"]}},\"app_proto\":\"failed\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":0,\"bytes_toserver\":62,\"bytes_toclient\":0,\"start\":\"2026-01-01T22:56:52.365864+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-01T22:56:52Z","timestamp":1767308212,"ip_dst":{"addr":"172.18.0.27","port":32934,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"162.159.207.0","port":3478,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Session Traversal Utilities for NAT (STUN Binding Response)","source":"{\"timestamp\":\"2026-01-01T22:56:52.366505+0000\",\"flow_id\":382896262386984,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"162.159.207.0\",\"src_port\":3478,\"dest_ip\":\"172.18.0.27\",\"dest_port\":32934,\"proto\":\"UDP\",\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2016150,\"rev\":3,\"signature\":\"ET INFO Session Traversal Utilities for NAT (STUN Binding Response)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2013_01_04\"],\"deployment\":[\"alert_only\",\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_04_24\"]}},\"app_proto\":\"failed\",\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":62,\"bytes_toclient\":74,\"start\":\"2026-01-01T22:56:52.365864+0000\"}}"}],"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"xcandid.vip","ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-10-27","domain_rank":0,"first_seen":"2025-11-02T17:42:00.850308Z","last_seen":"2025-12-28T02:39:42.989645Z","alert_count":291,"request_count":97,"received_data":2424649,"sent_data":48281,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Plupload","description":"Plupload is a JavaScript API for dealing with file uploads.","website":"https://plupload.com","common_platform_enumeration":"cpe:2.3:a:plupload:plupload:*:*:*:*:*:*:*:*","icon":"Plupload.svg","categories":["JavaScript libraries"]},{"name":"Timeago","description":"Timeago is a jQuery plugin that automatically updates fuzzy timestamps.","website":"https://timeago.yarp.com","common_platform_enumeration":"","icon":"Timeago.svg","categories":["JavaScript libraries"]},{"name":"Enquire.js","description":"enquire.js is a lightweight, pure JavaScript library for responding to CSS media queries.","website":"https://wicky.nillia.ms/enquire.js/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Underscore.js","description":"Underscore.js is a JavaScript library which provides utility functions for common programming tasks. It is comparable to features provided by Prototype.js and the Ruby language, but opts for a functional programming design instead of extending object prototypes.","website":"https://underscorejs.org","common_platform_enumeration":"","icon":"Underscore.js.png","categories":["JavaScript libraries"]},{"name":"Simple Analytics","description":"Simple Analytics is a privacy-friendly Google Analytics alternative.","website":"https://simpleanalytics.com","common_platform_enumeration":"","icon":"Simple Analytics.svg","categories":["Analytics"]},{"name":"Backbone.js","description":"BackboneJS is a JavaScript library that allows to develop and structure the client side applications that run in a web browser.","website":"https://backbonejs.org","common_platform_enumeration":"cpe:2.3:a:backbone_project:backbone:*:*:*:*:*:*:*:*","icon":"Backbone.js.png","categories":["JavaScript frameworks"]},{"name":"Moxie","description":"Pollyfills for XHR2 and File API","website":"https://github.com/moxiecode/moxie","common_platform_enumeration":"","icon":"","categories":["Widgets","Accessibility"]},{"name":"BuddyPress","description":"BuddyPress is designed to allow schools, companies, sports teams, or any other niche community to start their own social network or communication tool.","website":"https://buddypress.org","common_platform_enumeration":"","icon":"BuddyPress.svg","categories":["WordPress plugins"]},{"name":"W3 Total Cache","description":"W3 Total Cache (W3TC) improves the SEO and increases website performance and reducing load times by leveraging features like content delivery network (CDN) integration and the latest best practices.","website":"https://www.w3-edge.com/wordpress-plugins/w3-total-cache","common_platform_enumeration":"","icon":"W3 Total Cache.png","categories":["Caching","WordPress plugins"]},{"name":"jQuery Migrate","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"EWWW Image Optimizer","description":"EWWW Image Optimizer is an image optimisation WordPress plugin designed to improve the performance of your website.","website":"https://github.com/nosilver4u/ewww-image-optimizer","common_platform_enumeration":"","icon":"EWWW Image Optimizer.png","categories":["WordPress plugins","Performance"]},{"name":"imagesLoaded","description":"jQuery plugin for seeing if the images are loaded.","website":"https://imagesloaded.desandro.com/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"timeago","description":"Timeago is a jQuery plugin that makes it easy to support automatically updating fuzzy timestamps.","website":"https://timeago.yarp.com/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"LazySizes unveilhooks plugin","description":"LazySizes unveilhooks plugin extends lazySizes to lazyload scripts/widgets, background images, styles and video/audio elements.","website":"https://github.com/aFarkas/lazysizes/tree/gh-pages/plugins/unveilhooks","common_platform_enumeration":"","icon":"default.svg","categories":["JavaScript libraries","Performance"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Magnific Popup","description":"Magnific Popup is a responsive lightbox \u0026 dialog script with focus on performance and providing best experience for user with any device.","website":"https://dimsemenov.com/plugins/magnific-popup/","common_platform_enumeration":"","icon":"Magnific Popup.png","categories":["JavaScript libraries"]}]},{"fqdn":"qwiupo5vesol.n4.adsco.re","ip":{"addr":"38.132.109.126","port":443,"asn":9009,"as":"M247 Europe SRL","country":"United States","country_code":"US"},"domain_registered":"2017-02-14","domain_rank":0,"first_seen":"2026-01-01T22:57:15.397404Z","last_seen":"2026-01-01T22:57:15.397404Z","alert_count":0,"request_count":1,"received_data":463,"sent_data":434,"comment":"","tags":null,"fingerprints":null},{"fqdn":"qwiupo5vesol.s4.adsco.re","ip":{"addr":"185.200.116.60","port":443,"asn":9009,"as":"M247 Europe SRL","country":"Singapore","country_code":"SG"},"domain_registered":"2017-02-14","domain_rank":0,"first_seen":"2026-01-01T22:57:15.392601Z","last_seen":"2026-01-01T22:57:15.392601Z","alert_count":0,"request_count":1,"received_data":463,"sent_data":434,"comment":"","tags":null,"fingerprints":null},{"fqdn":"qwiupo5vesol.l4.adsco.re","ip":{"addr":"185.200.118.62","port":443,"asn":9009,"as":"M247 Europe SRL","country":"United Kingdom","country_code":"GB"},"domain_registered":"2017-02-14","domain_rank":0,"first_seen":"2026-01-01T22:57:15.386273Z","last_seen":"2026-01-01T22:57:15.386273Z","alert_count":0,"request_count":1,"received_data":463,"sent_data":434,"comment":"","tags":null,"fingerprints":null},{"fqdn":"pagead2.googlesyndication.com","ip":{"addr":"142.250.178.66","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2003-01-21","domain_rank":610,"first_seen":"2012-05-21T07:15:40Z","last_seen":"2025-12-29T03:13:24.758626Z","alert_count":0,"request_count":1,"received_data":164121,"sent_data":437,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.blockadsnot.com","ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"domain_registered":"2020-04-18","domain_rank":502145,"first_seen":"2020-04-18T18:59:38Z","last_seen":"2026-01-01T20:13:42.517545Z","alert_count":0,"request_count":1,"received_data":42483,"sent_data":454,"comment":"","tags":null,"fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2025-12-28T22:17:10.032556Z","alert_count":0,"request_count":1,"received_data":38386,"sent_data":560,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"blockadsnot.com","ip":{"addr":"208.95.112.254","port":443,"asn":53334,"as":"TUT-AS","country":"United States","country_code":"US"},"domain_registered":"2020-04-18","domain_rank":54363,"first_seen":"2020-04-28T15:35:52Z","last_seen":"2025-12-31T02:49:23.271369Z","alert_count":0,"request_count":1,"received_data":257,"sent_data":1749,"comment":"","tags":null,"fingerprints":null},{"fqdn":"6.adsco.re","ip":{"addr":"104.16.84.77","port":2087,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-02-14","domain_rank":91627,"first_seen":"2018-01-15T04:15:29Z","last_seen":"2025-12-26T14:57:44.996495Z","alert_count":0,"request_count":2,"received_data":1179,"sent_data":845,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"4.adsco.re","ip":{"addr":"162.252.214.5","port":443,"asn":53334,"as":"TUT-AS","country":"United States","country_code":"US"},"domain_registered":"2017-02-14","domain_rank":95532,"first_seen":"2021-01-04T16:47:52Z","last_seen":"2025-12-26T13:16:34.094069Z","alert_count":0,"request_count":2,"received_data":1048,"sent_data":845,"comment":"","tags":null,"fingerprints":null},{"fqdn":"adsco.re","ip":{"addr":"162.252.214.5","port":443,"asn":53334,"as":"TUT-AS","country":"United States","country_code":"US"},"domain_registered":"2017-02-14","domain_rank":3069,"first_seen":"2017-04-03T03:11:30Z","last_seen":"2025-12-31T07:41:43.098962Z","alert_count":0,"request_count":1,"received_data":1787,"sent_data":442,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.74.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2025-12-28T22:14:05.525046Z","alert_count":0,"request_count":4,"received_data":142492,"sent_data":2139,"comment":"","tags":null,"fingerprints":null},{"fqdn":"scripts.simpleanalyticscdn.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2019-03-31","domain_rank":364344,"first_seen":"2020-01-29T19:11:47Z","last_seen":"2026-01-01T11:24:50.676508Z","alert_count":0,"request_count":1,"received_data":8464,"sent_data":424,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"8ab14970b51b80c88c1221a8837fd5e8","sha1":"8e24da58859b058daeb11ec958bda22393692028","sha256":"12b298c6b1e1b9a99756e84752f85e95eaa77224018b82337a547efa40d75353","sha512":"cea8b33b6409e2500fec8f9eb7892aec3bdf960676814cbdc6cc7fec0b605e40a21b9ed9d738ed88c96f51fbc8f417aca2abfbf8d05e8803e5df952777f493bd","ssdeep":"","tlshash":"0ba022330c220b0333808ae30a022e2222a0aa38bc202800b80200c08000033bc80000","size":60,"data":"","first_seen":"2025-11-02T17:42:24.389092Z","last_seen":"2026-03-26T02:35:10.587873Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/ajax-search.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"346dfc33d02645d41fb1b3e0eccf1e28","sha1":"e12b9884e047f6b4d077f58be7a40859c1965ac9","sha256":"1c045fd18778d6cb007565f471c7d6f442aef231cd65359b0fbcef666b432155","sha512":"439e4a25d402234082c06f3020d9346d872ede53f9f053b41eaefb6356c4c4a5b206f7c36dcf73d944cbdb5b39e0a1df4afe2dfa197f85e495e1e6e571f1217c","ssdeep":"","tlshash":"d641591f68b35c6146b7353f6fefa4c6692420636808da053c8c76c44fcc9689775bb9","size":2070,"data":"","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-07T06:08:43.049874Z","times_seen":482,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"79e362235e366729632e60d6d35f8904","sha1":"69df1a1691b05442e11e2bc5825fc6297b977a92","sha256":"da82a56eb8524f5d12a2afcf2c5d0cb6184f26995167212a0ccb3bc2ba0def36","sha512":"94ca14ccb12238f547249a07134689257dd97639be34d7f466f52741df7176be982d88c5d294dd42a534a32d908533b5eaae33a13cb47ce0cf065d3098d9383d","ssdeep":"","tlshash":"fe60000000000c30000303000c30c3cc3c3f000030033030030c00000c00c003300c00","size":15,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-04-11T11:24:40.103376Z","times_seen":23591,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/jquery.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-04-11T12:56:35.15669Z","times_seen":703029,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"ab3b4884408bb0261d6b56a7d288fe80","sha1":"b0f370141ada9b591302b575434c255db51ae151","sha256":"e5a13721b456c9e090f80944728fc91767f5ae01b01f59160e73ff2c7cacc587","sha512":"e57cb5cdac6519a8a24e85d5d91f2c6492e282308a94d369619e9455cef8f22a2a6abd62023647fbfa0228b6d3e12da22c280d691cd351608aada9c284ca3a66","ssdeep":"","tlshash":"6c80008ea0803232a2fa02038a822200a2af38ea88008820000a0200288030f232ac8a","size":26,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-06T11:55:01.519336Z","times_seen":23027,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"c809887dc51fb5a7e73a3a98c3dd661c","sha1":"7d7574d4dcf1e06e2230379897c5df681ba603de","sha256":"1138f8c1bb11f4a5f7d8354b8c8a642ef94c9c741d76a7f476bac6473b7de085","sha512":"3a5e6abed1f1fa40c5d7d13b98d4e90d180f5913a673f10db23f40b1fe68a70de8e780c2633bb6f37745ce4aaf81707844817fa84baaa2b764a322831c298e7a","ssdeep":"","tlshash":"9b8000f00283008b08308f03230b3300b030200c30c032cf3038003c3002383bc030c0","size":32,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-03-06T11:55:01.494055Z","times_seen":17899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/jquery.waypoints/jquery.waypoints.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"43b1aa1ea2d73e79e9d45980c7920446","sha1":"1bef149aedeafff7a797e799cfba168bed0d6dc6","sha256":"9c7bd3dadf6edc19d3b8876a8e2b0b0ae6b54f403d7e987ec82b041128cfdd35","sha512":"a32d0d5ca42ddadaf3c4ca3a2570d8bc372a3494503e72f9e80043a0f742fafb083899d4f8e2ee73740fdd32409ec34a5d45d5a62b79c5160a4e28a3de8bfd42","ssdeep":"192:5BwzxsMCm1dJDl6hj8P6PEGnvfiZaLkYluY4pLyUJWZPeGz+nrFr:5BQoIJDlC8CPZnvrLkYluYTUuPeGzs","tlshash":"52026189750534221bdf90fad91f474ab3375828a80680bdb4c8d4ed28f252d676bf7a","size":8833,"data":"","first_seen":"2023-03-07T01:10:49Z","last_seen":"2026-04-11T11:53:21.923398Z","times_seen":6182,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/dist/hooks.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c6fddbb6be69793478de26fc245b2acf","sha1":"a136ebf5054fdc19729b3592005fe0fefec4bb4c","sha256":"9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3","sha512":"8a766304caa9c888cfcab64eabab906905965e7fbcfc4f79c74ab122b892456abad215d0883df17023a16a18ba15a6a4b3d0fa5345cab7173d778f725b827c33","ssdeep":"96:vmK40IdSs6c7DE/3sc/YrEBnUBPwKxbqe/Ds91sBYt1Em4kCofWQRemN:OK40IdS/cHg3NZBnUJbqe/DeGYtu7kC6","tlshash":"b4a161c47482b870a2237457e0bb1485757eabb5743990c5a24dd8a02db3dcfe0a7a3e","size":4776,"data":"","first_seen":"2024-11-13T05:08:51.627546Z","last_seen":"2026-04-11T12:50:47.448115Z","times_seen":211392,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/matchmedia/matchmedia.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"89f369588d629240d6a8d4f8788490c8","sha1":"fb014487044fe7f608fa3e19e868ed5f9c41aa00","sha256":"76b8c213b84808d8f2986bfa38e79e3f2d1a94f065e517a143999b198abd8bd6","sha512":"3b56e247349c10375e3bca06b1471ede80af199f9148d88a4b2cd488a8a25bf70773c998c5a744562f01dcc27ec116483b38816d345a06b81233834dd5798d30","ssdeep":"","tlshash":"2f31103e586a6016691369bad3afb0887d17853b1318f801bcaf47701fa2e564174ff4","size":1700,"data":"","first_seen":"2023-03-07T01:11:51Z","last_seen":"2026-04-09T22:09:23.028638Z","times_seen":1383,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b16d744c317516134b744c706334e3aa","sha1":"d1f91592a886e8b606ec9f586c516a639ab9aaba","sha256":"b2b1d04459b8f5c3874fb4af874be7a209bc930ef9a6a11b06ed52b9e2b39484","sha512":"09f16a541bd7ae2eafdb8bad1e9ebde87f443290edfed010f07d8f3f04e9800b69646eba7002a83e130f512ba8e49ecb62916694dd23988f3a63afbb17b966a7","ssdeep":"","tlshash":"c0f020ba3cc94438c3b712692bb39245703d253f340ead11f54c18a23f9896208ab91c","size":572,"data":"","first_seen":"2025-12-28T02:39:54.878854Z","last_seen":"2026-03-26T02:35:10.589223Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress/bp-activity/js/mentions.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f8ca0594199448b342e8f947903570b0","sha1":"01b801d1728f75df0f3cef84db8a9c10c75bd840","sha256":"06a13f10bb4c8c4bd9525472d9cd98338e77a9090bb8aef8b60c10dea5a09f5d","sha512":"c70b9907601285add0742c0c365dc495bb5d076941a7e67b0678b81fbad245a20d27955a26cd6a73653bcace2d0ee1b384b05af3ef144aac15b5a14ca50b50d4","ssdeep":"","tlshash":"a45141c478946012263330e596a7230a71b5a868b1038888f2f64cf97d78dde75b7efd","size":2653,"data":"","first_seen":"2023-03-09T17:28:58Z","last_seen":"2026-04-06T00:01:23.23597Z","times_seen":100,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c3d8cc0c95c5df14729e2479822a4376","sha1":"b25d917d35b92cc0eca35172ac759a07858a69be","sha256":"388499c46813de9d064c55ba9e0158aa7da73bebb8874cbdb561c953bd6e20fc","sha512":"6da683cb2cfb5a19e76151ee7d850bb6132374888ec9cb4cd299e65a11464efb61e2cf1546a3dcaa08e09abbc8079d84e16d757b0863c0582e2cba076b045bf7","ssdeep":"","tlshash":"0911616e3811a59a72d67d74507efc16247142da9b2474997cafc3c0867188b2c12eec","size":997,"data":"","first_seen":"2025-12-28T02:39:54.886496Z","last_seen":"2026-01-11T12:32:33.895651Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/wp67-mediaelement-init.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"52cd112eac1cfa8d64086c17dbdc35ac","sha1":"26263dd7b72ac4649194eef3dd01bf57a33ccc38","sha256":"54dcb9a11edf1cad34ece55088561a39f3b9fe5a7ffb166406bcd82d36774117","sha512":"b978268cfd89a7702f73bdb01595e02d8953ad648af4424168858aaddb9b46c8d52b00528a6e1b4838e6044b17ed7767191dc33068b4bcf33cc63dffcedb2fad","ssdeep":"","tlshash":"9ae068182c946631343b421a153b27bcf1361e391289c472bc20392f4bb8da02245c14","size":378,"data":"","first_seen":"2025-11-02T17:42:24.26243Z","last_seen":"2026-03-31T06:48:54.159103Z","times_seen":44,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5ef7476cd398d1bd582c8c86474a5d1a","sha1":"ed2e02b305d6d73cce433715e915de1aac3e2e9d","sha256":"fd7e04c1bc0f1b1af40414a0e11aebf2b9e88dfbcba0247cbf5caef066cfede6","sha512":"bc1d7a6fb2117af0a6b3b7e16b2cab2abeb0ab5487a3106227755198302752f7512c2059e5b588f9a4b3dcb0ec828462057cac70149ff77ad0f9b4561a9f9558","ssdeep":"","tlshash":"93f020aa3c898838c3b712693bf391583039752f740ead11f55c28623f90c6108ab91c","size":572,"data":"","first_seen":"2025-12-28T02:39:54.892341Z","last_seen":"2026-03-26T02:35:10.605671Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"fb440b8133f21c3e5d3e39624e7bda94","sha1":"1b46d8568f9bd8a2be944d6a61924a21ec0b6e4f","sha256":"a5e2bc908c3bd3196d273564d073484f9905d13817490eca5aa249e701139cdc","sha512":"f874692932aab2be754d763a3998c5cd3c654a5bcd78c5d839fe0ba506f9a9e563d3cecba0ca71a6b0db35ff94943f6fa8bb0292f10c1aeb7df2704ea6d85fbf","ssdeep":"","tlshash":"047000000000000820200802220322083822223002cc0002220a083022ea00b80282a0","size":20,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-04-11T11:24:40.121642Z","times_seen":24291,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/archive-filters.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d8818f7914dca2c830369f2dee913996","sha1":"f62b5b02f448ed41b22631b1a47ed72c6822aab5","sha256":"a8e74586981d9c560c80df04ea96f44ec6a28f816b3fa74d32d762f676580ce3","sha512":"be265d0158876970913d2d472fc8bb1dc53ef4679287fb29f97a187b72e276bf89908b40a1df3082f80fc4cb154c29dc2c3aeee8556f409537b34d5d7cf15169","ssdeep":"","tlshash":"48f0a70a78eb1c5210b7317aaa2f94c4157a10a315878a913d6d7bd04f5ea3e8217918","size":517,"data":"","first_seen":"2023-03-07T14:31:58Z","last_seen":"2026-04-01T14:34:26.15764Z","times_seen":21,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/enquire/enquire.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c22ea088390ceeb51ae5da21901b9df4","sha1":"2cb0ed3c356a9a2f41cf3b7c95e702c1856f5819","sha256":"324dbc3f38a9f0a20763e0c0d817aadea2b441e2b872b81c69f453857da67489","sha512":"96424868be720225136a477689b78c3fb214c8e4ca05820d70346a7c9dd72c6625a599b7d932590eb2f0996c50275028d387c68f0e6dc5c9caf37bdf3185e9d0","ssdeep":"","tlshash":"97410fddba99720162a364f2541f558f5673a1b7f00c409cf1a4dae5ed78a0d8a23f38","size":2254,"data":"","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-11T13:01:23.907864Z","times_seen":1150,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/isotope/isotope.pkgd.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2afcff647ed260006faa71c8e779e8d4","sha1":"c4e5994f24ee8c8d2cf2d6602f0b56b9096a2e98","sha256":"081ae9baaacc857c1c2cb51de6dbd0e1eb811c2761ef01a50df373f2f6eefe22","sha512":"66ad813b1ca1be74455eed3e584ea88e964b394da3767a9baccd61995746cf27826b50e03375f943803f22cf710352246d478377bef9e5d34d23f3f349fd8f7b","ssdeep":"768:LAyxsGKyc1gfflZVP4eAnmc6FumKSshD6cD6GLQfq9SvDz2A1Fxt:rxVKDSfJP4Nnmc6FuCshD6cD6xS9ODzV","tlshash":"f3f2d84f73403925468bf166926f160fb137a56c6a4790acba6ad8db1c79c0d6033fbc","size":35445,"data":"","first_seen":"2023-03-07T01:03:01Z","last_seen":"2026-04-11T12:26:53.489022Z","times_seen":18397,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"e969e6981adb7ab1cb174994a5c8c627","sha1":"5f534a259a6f3754d1d392028fd4cbb344fb6563","sha256":"5cb18f9c0eebf644c0bc27e5224177984121b4c4a3f8189861a6d797a15a2e7a","sha512":"10bbe815bb6e4ade10d00a42a82dd10b668e95e275161cb0a637b2ea95785f8f7fc72b31bb48ac9c1dfad03d811912c0683941a3c09357525f164915d5b033cf","ssdeep":"","tlshash":"a380000a88a8a0222a30a0228c020200202e822080ee208083f2032020c283c022b802","size":30,"data":"","first_seen":"2024-02-12T20:00:22Z","last_seen":"2026-03-06T11:55:01.514986Z","times_seen":20053,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"6043a0b1ebb36c505a9191b20e11815f","sha1":"6f9cda2539774241dca5f5df2e40b2e83139768e","sha256":"354d474759535f5f0bb63dc6c5ea17455fb3d281aeb3cd6d44c2f3f594c5dec3","sha512":"5a55931f152716ef8803227e0518befc7ec9fdbc66f16aab57824511c7f3a94bfd9b93b4417d6f759d04c517f3d242eec582b49a8d92be6079b88e10a27fb9bb","ssdeep":"","tlshash":"517000a20c0ba0020c228b02838222002020028a288830c220a088203222e0b3028080","size":24,"data":"","first_seen":"2024-05-15T22:21:35Z","last_seen":"2026-03-06T11:55:01.515568Z","times_seen":14363,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/lazy-load/assets/js/lazysizes/lazysizes.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"53b55154b4fa6fd1756393bb418173b2","sha1":"d441c7986de20fc171c4cf489974246ec3234bc9","sha256":"ff7f41fb46f8e9ecafe2c34d443535baec1dcf56cea4701d82e3e387fee68353","sha512":"de778af44eb1212fce14f19ee930a9706cf4955ba9683f061e1c78fb4026dd8525f53b192608e008183469605421411866b35be1764495b3dd5d8e7178e0328b","ssdeep":"192:sydOA8+vVJ2JmVvhaWu4sWAMfb3k4HKmVdVLRcoaqzaQOy:sy02dJ2JAhvunnMfb3bHKcdVjaqzaQOy","tlshash":"80e194ff76a67077a99378b4512f210f91327173be168825953ac4c22b3ce991137e2e","size":7380,"data":"","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-10T06:56:50.455383Z","times_seen":174,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/snax-collections-js-extra","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c2fdc1329f3fd483a9a4cfa25b59f30","sha1":"629d7353571ea0568a574963d82238bd34d38232","sha256":"3aaa818e1f9028ae1c5c560c346ad2c25758866e82cb1033272b5f0ac946f8fa","sha512":"e344a8591b39d12f7c4f2c73939a36c5241dffe8bbd17955d2d279d90d9456717b5163170c9ce0894b622f89eb6b06434226c60feaace965eaed47dd9c1a4fe7","ssdeep":"","tlshash":"d7518b1bd0ab1bb222c73ef664d962d324e05250d635ac0478afd1808d781f395a214f","size":2863,"data":"","first_seen":"2026-01-01T22:57:26.590148Z","last_seen":"2026-01-01T22:57:26.590148Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/collections.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a00fd6dd5efd53a26e2371f5bb53d6f2","sha1":"602b11ca1782aad596d9932809d021e397bdef59","sha256":"5f0989a9002df46b705fb45e14d611df0d8ecc6f6ad2f6587bfe88c1adb0ed60","sha512":"c58632da8c048b85e5874f90630166ead20d82c7a0c905e475134bb53ae4f303430f0f6a9c264155c63e391855e92f56e77eace6fb6916cf6da84d0b69a1fa18","ssdeep":"192:dsAwfcmlfYzoJt1aCBPFImljFd8qftRlCf6fXfCBf9bf9fbRx9lDw9AvR2bnazaQ:dsAUlCu15FIyjFdhtRlaSPUJBFpDw9Ep","tlshash":"60121f4d350077b601eb713654ef459b2873a9b2f1854d4025bba6aacf7ca8d6033b2f","size":9602,"data":"","first_seen":"2023-03-07T13:00:40Z","last_seen":"2026-04-10T06:56:50.456531Z","times_seen":159,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.blockadsnot.com/rjs-data-angular.min.css","fqdn":"www.blockadsnot.com","domain":"blockadsnot.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e5ac10efd7669d6cf2a25aababbbb92","sha1":"ce16eb16ba26f7329b7f9555c2f2b161801ab019","sha256":"86a20cd9c310bdf5a2472058631a09d88df34ad1ed1c7db7a58d9c19a48f3992","sha512":"529d93e45218fc678674025202feeede78715b15339f070570d5342b72b7943ad8881f5723b91f257cb254fe285863ebbe4c0347f98e2c239f2bbe1e3a517a09","ssdeep":"768:bt9rqAYKK2ZzFQ9JsQU+YDngZGihfzmMzhYrTsAysncCWcf5k5sigCtwCntlqorf:bbtZzFQ9JsTgZvfzmMzhYrTscpeZl","tlshash":"c3132aaab286282601e741b9503eb316b23305167912d458fcb9cdf96e3ddc6117b7fc","size":41934,"data":"","first_seen":"2026-01-01T22:57:26.571518Z","last_seen":"2026-01-01T22:57:26.571518Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"8b5e8699c1b76c14c38283a27772a3e0","sha1":"8e39b41dbcb6877e9b189351a2c90908abdc7754","sha256":"cfab5312f1cfff1e8162225ab27453306ff627f512bcf18225c0a305ca093e1c","sha512":"66ffa0031cc22b4eec8867f36dcf3d887b021a11ea74f51c2a2eff1ec4cf9eeb44c4e1d5a6c197f29d66546c5f42ef283c54261f6157687237e4dabe1715523d","ssdeep":"","tlshash":"cb700000000228a200fe230e8e82230822282223a28820c820220a2820003232380880","size":25,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-03-06T11:55:01.508546Z","times_seen":22393,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/lazy-load/assets/js/lazysizes/plugins/unveilhooks/ls.unveilhooks.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"728be2cf7dd0e1fb913065f11f8a113c","sha1":"328fd3e7478d57b7930bdfc5bd2e44d1e845fad7","sha256":"80107f11f8fef70c5d2d2ff48293c1fddc0a7f904b00412d121d717bf454e14b","sha512":"10795e6ae880e77685f37862fbf60d4a7ee0af3be2250c4f37afb46c675a33e4ba1f2e1c8d704954919c51ad71037b50446b44bbef54a2444aeb34ab122aa8f5","ssdeep":"","tlshash":"9131617f322468337c6608f1905f550276a2f1732e099e118ae7dae4d63aece2c35618","size":1649,"data":"","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-10T06:56:50.431335Z","times_seen":276,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/jquery-migrate.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13577,"data":"","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-04-11T12:56:35.146326Z","times_seen":654492,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/isotope.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"866cd58cdf83ed14591975680d1ddd86","sha1":"f0fe46a1be19384c096af214788bd0899bb8cf7f","sha256":"b3e753b9b9059add4690320991fbe7a21cf8233c92ba60e17498179919484436","sha512":"e48f822812586117e259a37c96def74f24a1cc64bc56488f0de5f7a5e814dbc9580882a9f948738a798dfec8d44833cccc5ed7bf76ed897a63534ae9cd8d3a6d","ssdeep":"","tlshash":"d341a34d38b33e3010bb707a0fff50d8a03a5463a185da107d6d37858f6e1551573a9d","size":1949,"data":"","first_seen":"2023-03-11T09:50:42Z","last_seen":"2026-04-01T14:34:26.187688Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/jquery.magnific-popup/jquery.magnific-popup.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ba6cf724c8bb1cf5b084e79ff230626e","sha1":"f455c5f153f872e52265f87a644ff89fe14a6fb6","sha256":"3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4","sha512":"22c361e44dde632dedaff2625f6631e2fb02ba3b6487097b48baa09f02cd81fd381ebb7d053f525e52e56655b1f8e2b89ddcc0a002e1b0c35c0a6920823641d7","ssdeep":"384:lPhVPXQ2G2XAQyqVxRQ5giCCMLtA15h5/F6l8aZwHwztLCpmst:lPBIt8I5h5t1qkOLCMst","tlshash":"bd921894f2b2b21383a735b8686f70093a729952ed06c855a55d94d87efcec89037f3c","size":20216,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-04-11T12:58:05.547604Z","times_seen":55489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/mace-gallery-js-extra","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"7cbee98219b2aafe525e1486c4699067","sha1":"1d5667a4461efdf802704a1cb9986c35229f0eef","sha256":"2f7107b15cc61439a68682080b8d23dd33456a430d2801b5c34877a53a9fd785","sha512":"33785692efcad1675997d5aeeae31b94d8cae5a30055add6e8967b00e3d0e3d0ef0e4b19f567be9f129b608eeb51eeedb99d5f69d59b6b9a7ddc34c451211ee4","ssdeep":"24:RoNIJaiyeQibl7RrUmqgr/GfdL+aDCmHDEKIXD2drz:R59ctgLue+z","tlshash":"0491a268d3acc211d50b5378ed71e62e9497b905f91b9db0ac7f3ab9d25c64084c4f0e","size":4311,"data":"","first_seen":"2026-01-01T22:57:26.592324Z","last_seen":"2026-01-01T22:57:26.592324Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/matchmedia/matchmedia.addlistener.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6f47448212550bd3157c4265e3ebf085","sha1":"5949f358ba1f69bdf5442cd0c88b86934d254e6b","sha256":"4492a4f252febe84a00d7f8246e50e43475a11d7192a279aab3c189cd3721456","sha512":"981959794b1f50b6f5dc345848d068e013913a6bd17312956a9ecef4881e54c499f1ccd9929feb42e91673bf22ee5551f202d20abb4b1d5beb092f7ee1856356","ssdeep":"","tlshash":"fb51e12d16aa103e34d3e3372f9f22596a6b926315089400bf1de3c42fa5d5d52bc7e6","size":2816,"data":"","first_seen":"2023-03-07T01:11:51Z","last_seen":"2026-04-09T22:09:23.067695Z","times_seen":1127,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"476b43130f4da0758e51a26ea93e733d","sha1":"5eac9c53e9cc1410e58f6f0bdc85528acab30736","sha256":"b19d05a8d492320ab4db4d74ea0e9e90374bed47a18e805f8018ebb00af0c23c","sha512":"d7b6af5bbc8185dfa58fccd8be30e14c79aed4aba53d8824cc066465690837c5f2d173bc3bb78eda33f9ae91ac0434fbb63d4d4c906e1874cc614ecf72ac4291","ssdeep":"","tlshash":"547000088202202a003828028282a220223ca82080028020000a020228002032ba08c8","size":22,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-06T11:55:01.506782Z","times_seen":22784,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"7545d1da7159ca66338b4c84b69f8ae4","sha1":"0858800340ee5b8c413a1aabc50fb28d0bdf89db","sha256":"7510742fba4d25113b6124987e97cba40776bc5030a6a3678974dc8ba075bf81","sha512":"dbd944acd2868ed6eb1de313c0efe7590f715129f7ca5a9ae5a3dfb9de0035612a248441d9e6c4c1812d8ec4b3de7cd2a5973c4c71887361a2276de1d73fab94","ssdeep":"","tlshash":"af8000088820202a20be0a0e02a3e232220e3022a0020220000f0280380020bb302880","size":26,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-06T11:55:01.488245Z","times_seen":22614,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"879c12264b74d969b0314e9a9cd1f17d","sha1":"714a5d759f4d1b7d41f8c5526451aef114b33d41","sha256":"28be88d787b6e773eaf5d0818a6c62446ce628dd8ec0659c6f78410588838337","sha512":"3547b27de7764e655bc8749fd5c1166599da57d2a76057e66923476fda692917a9e537a934374c77f361359b9fe94d739bc037044bbcf2648feb43f7ff9f1c7f","ssdeep":"","tlshash":"f7700008e0a03032203a020a228222202a0c2020800000a0080a328028882832380880","size":22,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-03-06T11:55:01.507418Z","times_seen":21973,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"41310478a380eaf7e07dbad9b4f81a97","sha1":"1714b6ef86e90b5b23e2aaa1e7728ed9c59f4d34","sha256":"848e5342d9196c0f64861ab926a3c5aecce9294750febbd22e5d8df859bdb144","sha512":"7b93f330547524ce01b8f888a8d56c19cd4432fbee43db16aab33fc1aecd77243762c5e7dd5ce767e38c0fdf9d58bc629caf106d77689c1ef90ebeb09406580e","ssdeep":"","tlshash":"d37000000000000b203c00020a023a003003003000880800820808302ae800b802c0a0","size":23,"data":"","first_seen":"2024-02-12T20:00:21Z","last_seen":"2026-03-06T11:55:01.500018Z","times_seen":19951,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/rtmedia.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8e2e149eb4f36d6d4094855d3619b8c","sha1":"e215f744534e895633effb63c16ce359d6ed197e","sha256":"10a4048a0fbf352096b38f940ffc7fad31c91795808ce6e27de597174a647ff3","sha512":"97fcb4e0c48109e488debcda4ef270f1a5507ac902f64fb2dba36c2f159a589039d1727d24b00ffb3e28f71ba4ad5342b58853d0fd3848aeafbf4b9fa3ae8b6e","ssdeep":"384:4IgorPnrVo8ER4z6YB9rm2jkJqMj8mjiwidqKgMqnI1UY7YwQHZy3pBz9zI9L+/M:4IgjL8WdoqjMqn7Y8TSpQJ+qie","tlshash":"29d29314b71493fac1bf70adf4bf67373067ec23b29144643c57646859a8a882253f9e","size":28392,"data":"","first_seen":"2025-09-15T15:38:38.820255Z","last_seen":"2026-03-31T06:48:54.151248Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"d720eef71edef78b948a643d5712ec07","sha1":"ea5eb334bd6ddb0f04abafb700dc2ecb30070c76","sha256":"2daa1a91b2430e9867296c9cb26d1483785954a9bdd66f79b2c754bab7092cae","sha512":"63368ff1fef849df7f849af23bc2f24698893bd3d58300282427a76665b2d5c94f097d409f93173ad9c36944b4fffc2e37fa03a91f81e4e04f3737f9b73d2d6f","ssdeep":"","tlshash":"5f6000c00000c00c0000ccc3c00300c030000030c0cc3c0003003c3300cf00ccc00033","size":15,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-03-06T11:55:01.51255Z","times_seen":24260,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/back-to-top.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d674481513d4b30efad67303812f94f9","sha1":"f44bc8e490088e3d56137f2d0cbcf7eb3bf52921","sha256":"b044d89f7a88e52da5ba2345438abc81c7fdf33eefbdb8e458bd5ce102bbba7c","sha512":"8fab81650da62bb0f122c30af525f3a97b58883e7a632204942bd231dc7fdaf854bd7ae46d99a1c964224195b59afe25b8f839340dc415669be3daa8a1446b5e","ssdeep":"","tlshash":"e231489a64f1105155aff1376baf475834387007a586ce60bb0cebc9af8503a9f17bac","size":1493,"data":"","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-07T06:08:42.996541Z","times_seen":495,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"61d9031f2b0da3ac81b6732b6d1ecf83","sha1":"515d4db3d1120a7160d1bc7d93d57f7fbdea1fc4","sha256":"436179ef4964c80a03e62015696ba10c5ae70602c6538d07f50b75f35bd72a27","sha512":"3b6ddafdb73b34756f57d92b3db048d03ac38dd2f96be7d4ba695835470b8ce460e2d6059a84e64f3bc2d5237b6151aad2a649f76ab43a81447182684b5741de","ssdeep":"","tlshash":"b58000b02020a830088e020cb030c3cc3e32000230033000a00c028c0830ec00228f88","size":36,"data":"","first_seen":"2023-03-07T01:03:03Z","last_seen":"2026-03-06T11:55:01.504781Z","times_seen":18663,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/rtmedia-backbone-js-extra","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"6f42cf99f9d232d33c34a19a477522ab","sha1":"39b172bae80646c28ed5209a704e682b55194d39","sha256":"74c26497762dd1025b54c08ded90ea4100c138a1176b137d240233fde6214d5d","sha512":"39aef04874467bcc9a29c09b656b9bcbca4cca00ce9fc2a0808cd7df33529ab5736cea175ec15727a33a45e71884045490758ede6548b4d1b4c38a425d15beb1","ssdeep":"96:lQMupzVWZoZUHBOq7v0C7upoTz6BFE0Ptl7upZGk:lJZxicz6lQGk","tlshash":"28d14232cf5dee2b070f62bf0d6e1c87a58805a3e68a6c45be8ec4d8d5747525087f29","size":6603,"data":"","first_seen":"2026-01-01T22:57:26.597933Z","last_seen":"2026-01-01T22:57:26.597933Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/ui/menu.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"284953f0e0a570aa06d6b527c45a55bb","sha1":"c4b8089261f001829f0d6e522928f6d912db7d1f","sha256":"41788f27f61aab4174275eb5fbbbcaffde0f4f0f07e6900592affad38e09b154","sha512":"81d15d80bbf4f8703e644157d74f8f44eea10e13553947437f14e9e448084d3b9a704cf87dbe0cc99d228a39820ce122a226973fa543da3c84ff70a8f504c51a","ssdeep":"192:sr91gNsoBeuLLE2mBrnYgfGGFTsPdQlJh1NmgKzH:srkjMunE7x/3sPd469","tlshash":"5422758831863a72349ba3d8291f60da6236649c9909555c70385fddee3df9023f37be","size":10199,"data":"","first_seen":"2024-07-17T06:42:32Z","last_seen":"2026-04-11T12:29:01.530451Z","times_seen":13541,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"fe99bbf2987d52a27e4d042d61264b5f","sha1":"96bb68de49d3a4146142cce3f02de1ccbf8d0bf6","sha256":"cfe90e4da6c1841088b25b3582dc78b887f3239cdfde633ff426703c6ed538f5","sha512":"9dd74689d8b3460b4da7557d2797047f31cfa1b8522959d152c08f1f48989897e15f026d9b254a7ef61b99b9b18fc002054f29a12a2e30554a68d7815c53f3dd","ssdeep":"","tlshash":"d570000a20a02022082a000082022200288c0082a80800380a008b003c008032222382","size":22,"data":"","first_seen":"2025-03-02T21:04:17.177505Z","last_seen":"2026-03-06T11:55:01.511158Z","times_seen":8483,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/snax-front-js-extra","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"e09965abf41137573023755e551b7181","sha1":"9ac2abd5803a9ac4fa8d0e9ff61755d689d4c614","sha256":"b4b66650a0faa4b142d9e7183f3ab0c0836277aece005a62d94085d181c355c0","sha512":"7d346638303e98f915495ea3b1dc6eead328e08425a8e5fb83eb16250761036971ddb10e49eb8ac58ef9e6605e5a6f1e3698fa6fc76f1121229f838f38897173","ssdeep":"","tlshash":"08811f1bc04c89725e1399f1ac38410fa5d83a18f406c978cdbc5f280a606a2f87d30e","size":3825,"data":"","first_seen":"2026-01-01T22:57:26.600293Z","last_seen":"2026-01-01T22:57:26.600293Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/vendors/magnific-popup.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"25b9d9349c4b333a0219e6d7b8a7a4ef","sha1":"41a606fdee797aa9bd43da637cb082b35da136b3","sha256":"cbd6b4b5c894bc8c0d3686bab85d559bc85e5cba069cdbab211c5c5057017c16","sha512":"f3f328cd7bb06bb415974e7d71b870be1601c2525e6a8b0131e396950fdb54bcc03eee62fb8e0f0f9c310b4a076936e4f566f014eebd0b30ed512b39b0d3821b","ssdeep":"1536:muv3AJEGnbo/murRcIrrbB8ApdQ2Dx1RO:mtznbwlR+2PRO","tlshash":"d92330d4f39d2157823632589d5e20dc2a7ce032d9128cafbc9e616824d897d83b9f3d","size":49542,"data":"","first_seen":"2025-02-22T09:08:38.876583Z","last_seen":"2026-03-31T06:48:54.119927Z","times_seen":63,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/jquery.timeago/jquery.timeago.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"80c1ddcdf84ae2b0d3a833fc079a0981","sha1":"a44488a43f08ec4068c62a2cae036527788112c8","sha256":"c8a2ce0ff737cb50745bcd2b534fa03c462d897895dadb9af2d46e37db45c2f2","sha512":"f788717725b0a705d7f3703b52c4f9ddec3f094d426d954f7a45643aa782a23d67ef59a227afb62a9645663c9a50d599dd8099a809b8034d77efc62ff598af89","ssdeep":"192:m8PNFHy4TqNEOhOBeJp20R73yPDijiQG8ciQIvY:Z1h9TFBehR2","tlshash":"12e171083ae62010a9a371b94baf8248b335d507644dee1175ccca902f2dc7d61faefd","size":7239,"data":"","first_seen":"2023-03-07T12:03:53Z","last_seen":"2026-04-10T06:56:50.470646Z","times_seen":590,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"032a0b987f8e2bd0f56563703153a19f","sha1":"4b3294fa5bbcd8c186e176e1fe600d742ad73b85","sha256":"f5581dd6262ad4f7ef338c976a24f2e861004d4360d9d316899e781b7c8c714e","sha512":"58fddccf62b15c9b49ed28e220529397a56de6280235699b351b776b9aa06faa0263373c403c140aadcb6f0c37e7eea0e3387c311b30582ccd45aef4410a06fe","ssdeep":"","tlshash":"75f0e2382510af313ac975bdb4872bc4ab760331a03c60601b6f4916a960ac986b0bdf","size":493,"data":"","first_seen":"2023-03-07T12:03:53Z","last_seen":"2026-04-10T11:51:05.865595Z","times_seen":785,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/ewww-image-optimizer/includes/lazysizes.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c318a761be370148448e70835907bce6","sha1":"04ddb20e0f1c9251b14fe09a8961c8df89e0f09f","sha256":"bc74614fa92f608c5a30942335391813a24d7614b05cca4c22649d9de4e09e4b","sha512":"9c5c3e3e82a005125732164f28fc49de2f9adbf880b84473416c14c2038b4eaea196f6bd2cc8f04a49b57cc775ccd7e46ee1510f12c9b2cfebe09d9ad6e4f956","ssdeep":"384:rQfPSEtTi+iguVWOHlDPSxV/Lqb88FXNlf2CsnmzV/GAeOvPC4N836qoDVTaf3Vr:rIbtTi+iguIOHBq/Lqb88Plf2TnCV/GH","tlshash":"d772e8ee320975b3a95720f1555f620bb2327437ad079820aa39d8e19d38cd66337e6c","size":17049,"data":"","first_seen":"2025-12-04T20:55:38.388983Z","last_seen":"2026-04-11T13:38:16.360165Z","times_seen":1480,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"bdc6234a33432c503640ad2f62105dbf","sha1":"2e733c2d4f1953a7ca2231208e8e31edc399ab19","sha256":"61e43d202b6cd0ebf29ac8014115fcb890eb5593c4160b9ae285206ca911bce6","sha512":"ff6da6a9cfa04e9c0e4c8c038b70ff6461de31cf3020ffa062fb50d6507ffb72d431652f7a8eaf7fab316b387a16a0ba5923cb568450f6e5a3eb7c232a3793b6","ssdeep":"","tlshash":"bd70008e020000a0cab220a80a022300b0202c0008022200a0a00008202ee038288080","size":21,"data":"","first_seen":"2023-03-07T01:03:03Z","last_seen":"2026-04-11T11:24:40.112761Z","times_seen":20567,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"7a837a4ba8ea13b8193945adf0261e19","sha1":"61428cd720ebc0f01c4c017204c313193c22c101","sha256":"28d9693460ce57dd4e01742e50a1baa10cbed3fa6c20c2a69f02424f80fb9a2e","sha512":"abe0e46d98027527a7d2567c4feaece7ad3c1ec94eed8fea59b9eec596cdd4fa39e7776e9dbc4dd6fe777d9b09300d45ba2a49fc9479e0acbdea92ebf5ef940f","ssdeep":"","tlshash":"516000000003c03300300300030f33000030003000030000000c00303003c03c0030c3","size":14,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-04-11T11:24:40.109593Z","times_seen":23240,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"blockadsnot.com/rzdaiabazqmaqoqzn?HTsbYknl=BQOCAAAAAAAACZUAAoEv6C5u0HLYbCxaFs9PRYSMfzjsFnnLcVUBCo5bbYJtiHrIHJesueuwNKMA29L8H5kbYt73HsHPrnk3SXqau6jg3jcQEpAsDCdK1fRujKg603joFbNEXv83o0wIo9aEWulHV2ol6qQ67p2bkYGrBLlhpUjSJ-IsXD6WmP7FjYpt9g9vg1lTbAj58Nromjk7zs93no80pdGfrfTkoWix77rXtgk6AF16OjSqE3CIbDO-0HnB9wM9BEPfCAWf9e1fVL10CtqjIFEPWe9KFOgaRLMUREi_12odUuV2bl07x9ckd6le8_8ALamfMRV0vQtlvrAcFvxy9Sjc-yRaIujWUQhViynUQLiod-a9AGqHh_vxFJBuGEIV9bjrZxLxXfL_hW27OfLvUVvrgnrrh5I-HgkLiI91lhUKo5UZqX5Dr_tdfD47KLwMUXVXeE0zkIakh_WTQflCaKa0UgaheCERJR8B3LwpWN4llKU2dX9GAxTzHZpNtpKVrCJo_vhuIOLchkUowMYo6RJAgpgWF0pcmV--f29iObDTOC0Qsb0U5zveOhYRprrXyhYyCYXztY03-wQD0WKW6ZaX4tsqlbeTfenpoTZ3hElpaQyTpToj8Lg3WX1rBAvem0V8Iu7RzaIWnA7klRDXC4L-xo6knzn-MZTLfaDR212AJV5z8Z2OqefiBYj99LQrEUYtlbvjg7XynPG6FF7qEV2p6TkCTgXMlooaRgPnsTXgSGCSGCt1f1nURuBDSTNOpIhk8YA7eLrGwbI7m6A4Ps9j12uPCaY0P7bSr8xa0iqGl1k4JDbXRxsfGDvv8kInaifPdFLJcFHHhqkdmX1b-ecHGnNsQGQFyt9KkOE37ODytAiv74co4VLnYdmhaO_YImFP229VUIitCnR7Y-uOeyzel1I3LhRMgdhJyYg42Rqo73i0K0vRtYtTf8YLty9JqyE7JV8hbZeBu5uXDe1auTQMPTSnf8NRtPmkeX4uOQg9_TE61oGPuZc72wKbGHrGTEIHELd0rjFDipY1ngLXLAXy1gv8nUEw5nrWS8acSaQoE7T7_6wO4sTv2FpWrfw6_AFb3ZKLsVgSru3D_ENfqZdt60TY8SqrMbsclnNBQQryvnrQvUx1RVOhE_qhXKpME6hqHRY2iXtR5k6Fk_9xEMELrzleAveTpJacJ8VbCQVTLkR2fTN2ff6-\u0026YRtMXzLF=4\u0026DxYBXbSi=5249889\u0026YxKwWZRJ=\u0026oPhSZsKg=3:1,3:1,0\u0026JDXgBMRy=\u0026oVOHeYEh=\u0026SeZogvYM=1280,1024,1,1280,1024,0","fqdn":"blockadsnot.com","domain":"blockadsnot.com","tld":"com"},"ip":{"addr":"208.95.112.254","port":443,"asn":53334,"as":"TUT-AS","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5f0a25e4d3522d56d48ce7bc3e518fb","sha1":"86794caff58f7fee6e684c2ba7195f970a8d6f4c","sha256":"9d781128a8ece413b003d5612b8398bf9340ef7f5b751d12bd125ba523d3ceb5","sha512":"a3a81801f516a4eb11f00d6f56dab0ed4b8a79219e6b4f5436993479f09dae08f14cffbab3327ff66fb39201d8eba1153ae7114f7705a01cc6f0edf840ef1616","ssdeep":"","tlshash":"789002801814116115d1500b8d5159d01259b1a4540801324446ca502dc7883a415774","size":44,"data":"","first_seen":"2023-03-07T01:17:45Z","last_seen":"2026-04-11T13:01:57.376548Z","times_seen":23126,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/rtmedia-main-js-extra","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"c67c6c7be10dfa003015f4ce7ebd3f29","sha1":"cb65cfa21db80fc54350f7c3e2d61800de1b7f64","sha256":"21fccc4caff8432b4e32086248b92690a97c611a14823e766af2b3b884edfe5b","sha512":"3ace7485d604624cc4faa9c11c50d20b6151b2fd6951c86a510d1a24e9d617331f7f842f5e9c56c176d1519dd3b8b5739d8e5a46ccfe564a0a7db525483f2731","ssdeep":"96:8me2PJVuYbXQnhZMcEBJ2TXM4L2bwFp3WXm+dXBYqHG:8meCZLQnhZfoj4L2MFKmCBYqm","tlshash":"70b1022ac72d5e37c15f93bb69ce669b2ac80df7c1001f16ffc98294055da0aa642f4c","size":5492,"data":"","first_seen":"2026-01-01T22:57:26.607515Z","last_seen":"2026-01-01T22:57:26.607515Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b948195f3f89c132bfae0ac00c2947d9","sha1":"856bd1f3a5f76d2de98b8eef1cd8feb487bc2337","sha256":"82a53e6d2a515daa1c7a937a04837bb0341caaeb22438129b6eae96afcbe3629","sha512":"a099ab63a0c4d47603abf545247741910535a9f65808cd120891f356d52857bcee598bd7fe2cc6c93223d0da1d2d4dd16fa65fc9fbbcdd0f760339f5d1dc31aa","ssdeep":"","tlshash":"3bf09b2f205f6e744c53a9d7555a14e0a7257063c4469b713c1dc407df54d852d797c4","size":524,"data":"","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-10T06:56:50.489774Z","times_seen":114,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/rtMedia.backbone.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"389ca7dfe616b632c54afd6d523564e9","sha1":"84dc8867a3c9643f17265e778fd3cd18a2df46f7","sha256":"a00ee426f2a6cf75871b48c20e9f50b72b76b6f32a3e067d22d21c9966b01914","sha512":"a401d086e2d391efef35e706eef64567dbef5f0def306305ca7ededb7bb7e1e8e7edda27a3fca749185e38fed064e1e4d2597c6ba96413b6b47db0be589522cb","ssdeep":"1536:09+77WUSX47/OK/uOVqxad4HR7iVXNVCCtPSeapVTv6:iG7+GNVx","tlshash":"bfc396199af25296917b707cafef25123160cd172108de143d8c96f8af98e7092e3f9d","size":119766,"data":"","first_seen":"2025-11-02T17:42:24.375234Z","last_seen":"2026-03-31T06:48:54.094593Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/global.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8b5cca173e2d12b1d577e1ce80202e07","sha1":"8cf07aa4aaf5e4affefb8a202110a8811da669f2","sha256":"f6abddbe5d6b87ebdfc3ef94d51cb72b139804c2ad38ee3ed1aeb591012b5076","sha512":"27580f84aff88c237e05785183e23dc84fb004e2ab06d1d97d70cd6e47a93e44818d1437e8a54b1207b56361f52c7773ec33101baa4180ba1bd4e33d070658be","ssdeep":"768:7sRhAFkI0t6urttwi2A+L1eCgkYf3+jiHKeF3EvN5uT6EG+fhsBtxmim43:7sWkII+ngkiOjiK0uKe3X3","tlshash":"b9235d1a79f32d21443bb07a4bef60c4b26944279149ce143c9d73885fcc56866aafee","size":47419,"data":"","first_seen":"2023-03-07T13:00:40Z","last_seen":"2026-04-07T06:08:43.025377Z","times_seen":412,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/lib/media-element/wp-mediaelement.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"bbc4f3add6171c484f437bb1ffdc916d","sha1":"2797d844c7f75f612ae9f650421951f593d00ac4","sha256":"884dcde59ba613bfe275159bdc6cf440aaaeaaf6073c7970bbab83d312cb90df","sha512":"8cf261a87ed3fe44b75812194240b06bc4c247dff059e718582d22ae4e3b4e3142e682bb0d1c0bc3a923bb1a06671a037ea3466df635f0c1716033399b0039cc","ssdeep":"","tlshash":"ea01c09d3d8036a69c7b4025e03f171870f6cd27818d2e32ea64d4771e74c5082b6e4c","size":733,"data":"","first_seen":"2023-03-07T12:07:29Z","last_seen":"2026-04-06T00:01:23.081388Z","times_seen":137,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d551965ba94faf467372a6b2d9332de","sha1":"30e15591c3000c5af63bc6bde8a9e64e865f1f02","sha256":"963bf1e5c4150ba17c085f83e38961d51319b31c28f62e0d70ab4a29e4f2776b","sha512":"6e8a563b2b8e1a46e850365b2ebe1a4e4c957a37e29e25f5d04cfbc533c31977573e3dcdfd6efbcb6da6693dd916e76f1487ec86775c46668a5ed11607c88187","ssdeep":"","tlshash":"a4f0e52f245a6e754c93a997564614e09a217063c445cb71382cc003df50d852d79688","size":538,"data":"","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-07T06:08:43.076645Z","times_seen":110,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"67b2371a222c2dc94f01b8579fff4f4d","sha1":"0b0a5e2d11790de282055efe8b8cfd6f4378bbfd","sha256":"dfafe4f2e08c006ec277e8042267c6237512a1a93bfcf57657420d4becc0a97b","sha512":"06a32863a820cca2b2f4460c10c4dc3583687648c909c5f67c746e727ecd4ea6301db1273b40dacdaf397a585ff257eb8c3e226fc023e95d3bda257e02505dfb","ssdeep":"","tlshash":"d4700002880200a8302bc808a3022300200080802882000008888002b0000230808088","size":20,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-03-06T11:55:01.495091Z","times_seen":20840,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/jquery.placeholder/placeholders.jquery.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a174a677ef7798a1adbda44b740996f5","sha1":"1a3587ed5f71778c68adfb80bf3e4b2419ff2b97","sha256":"aabc30ee10c2b23a718fe443f43b051563fa5c58aa4b48cb64155a424e451468","sha512":"649a4305d36d63c5c092111b1698cf35ea4fe117e230b5b2b4c92349b284c89ce41353d2dcb73666d6a02262a450042329a035c22874153ee1358381a2cad31b","ssdeep":"96:h6LJvsVYMQHqEodWadgRA7C3rMpZtgPrUGvERRjPMv3:hJYMQHRFadg/3GzavERhPMv3","tlshash":"6db1957e324677b31da714e8f8abdc967870a3f6b10b4c60d064e492393cce956b6d48","size":5461,"data":"","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-10T07:04:34.919996Z","times_seen":742,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"3234476287fffcf4eff3d9f9ff02bdd0","sha1":"734f1a503922d20150dccf4c654ce05efbffbef5","sha256":"295226e5d1295828d6913185be83a0c709e51d4effb355c5ea88fa03bfd14834","sha512":"db014e41c08e358ddc21d772b55df585bef0b8ab6d5d283d19b69240aebc03235a36985479dc216ad63df4b12869a97ee49990e4bb9c376ae9e6d195bc3b140e","ssdeep":"384:9dho7iFsHuwvLv/gfAWoVS48u05Nd27i0oCbytycF7W1HBkm31IOUohQNI8o8goV:zhAuwvb/gom48u05f+1oCbytysyBFWOE","tlshash":"84924a7aae463f4bcb75050e87fe0acb0e0c6f826191514ecf0765aa0a68f9394f056d","size":21121,"data":"","first_seen":"2026-01-01T22:57:26.612184Z","last_seen":"2026-01-01T22:57:26.612184Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress/bp-core/js/vendor/jquery.caret.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a423c4df6060f8ecf83d4471cc110131","sha1":"71304baae7622a2cad5df690d603659d91b634ec","sha256":"7a0a2f2f1e71dd7d86c3a2474d12beb7ce5415e968b1e9c1a1cd92b226532d1f","sha512":"fb41069a7af757cdea5a706f0ab999baac1d4d23eadfe357d1bf19a7c6e30ca9cf735e93249dad5585cc76067b420d94dcbf5a8cd994e8802c0854900ba07341","ssdeep":"96:PHuU2eUD4Vdq6R9v71b2+YSuMYwpqYheq0PQqb7y9JrXU5A11RTBNZ2c:fuuvnuhpsqbezr1Nx","tlshash":"a6c165b6b1407422d347b16aa1db0608d1366c5ca647425cba9cd8f2bc7554b6233fba","size":5863,"data":"","first_seen":"2023-03-09T17:28:58Z","last_seen":"2026-04-06T00:01:23.295589Z","times_seen":101,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/stickyfill/stickyfill.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"593e9b79f6e7ce55f18e215cee71c97b","sha1":"05c1dd24e4e71352f7ec69cbeec0dfe8dea721eb","sha256":"77bf60e84e126d1609cc0a302c3953dc25ae054aaee3514d04a4726d4f2609fe","sha512":"384baf3b44411049ac1fa9508b8cb9d19f82ab561864915df6f8d0029eca30652ca1b8055efcfe35aafbf0f7604881d29c8047d14df13c9a88cb7610b833871c","ssdeep":"192:uc6dWtkuaoqt94VK6YVIwgQSzK7OUlvH/CkUmbROm5ujZ2woogtOXnPrf:uCSuaV0VRzGOUlHam135lTorf","tlshash":"b9d183453770353281a3eb27617fa60732725498d9a3d099b02cccecae7cdc911bb978","size":6291,"data":"","first_seen":"2023-03-07T12:03:53Z","last_seen":"2026-04-10T07:04:34.933252Z","times_seen":654,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/rtmedia-upload-terms-main-js-extra","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"9dcab96a3e72e76d3bc0c35dfcc5bc88","sha1":"769747236866fc4e0354239acb1cf2a5c1ac2ab7","sha256":"b955a70de02f2b6b2bfde24dc01d14401823b5464a4010879c91aaefbd836760","sha512":"34634059ec6186310071e145f5d4e1b248f64796dd64c99aa26ba8c1676f167e48832b53ef9bb977b6bdea2765324018ebc83949bc99eff6015795abde5af5f3","ssdeep":"","tlshash":"3f51a710c0802bf9469dc43c72e37c1332c96851ca301c3b7a88809d7eb3415d263746","size":2611,"data":"","first_seen":"2026-01-01T22:57:26.6144Z","last_seen":"2026-01-01T22:57:26.6144Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/dist/i18n.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a8127c1a87bb4f99edbeec7c37311dcd","sha1":"9997a1745f48bdd233dbe9bd8164daa53eba105b","sha256":"f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc","sha512":"aa10ddc5b29905c60a058faed3f5f195f7577ceac46489e02461b5135732194daa3aef4aa473127bf8c753312e02074cfdac8d0f8f0cc8aa544c7f8e02bebd08","ssdeep":"192:s6zoFrnW4iaX3LzDk1jpJLB2hlq717+3uClD2tFtJ7bykd+SHS+F:s6Udn3LzoJphH8uClD2tFtJ7byTwtF","tlshash":"8612d8ac30deb021239a11e1586fb101f13aaf6532d99ce0da81d9e57db19c960b3ff5","size":9141,"data":"","first_seen":"2024-04-03T08:25:07Z","last_seen":"2026-04-11T12:50:47.362261Z","times_seen":238551,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"9aa3dc35f8ba994aa0f04a42c4da5062","sha1":"a65df79b7b70e8b8d22a2db929f6598428a827e0","sha256":"89e4c05e12e12f5bdf85a4fb89bad572dd85256091add09fdb9c6e42e703e2bb","sha512":"72ec1d5aaa34463f798b2d2c5976a6221f70e51ea2afff582319f4c8b7e31f4a67ef2a2d39427b4d1cc89ca66c4d4374db662c1137380ce0aad2acfcdbed4d6c","ssdeep":"","tlshash":"ec7000080000a0308808a002882ca3803c20a820b022a008080823080000a020008e0e","size":24,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-04-08T23:13:02.903713Z","times_seen":23252,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"6a88d4bd5bd93656328a2f38b4378d0b","sha1":"d2afdc9b1693f0cf62ab6e88bbcf4e20fb62844e","sha256":"3b1758c84d9df642c22e7c547795bd40ff0a9610795e44c90109fa7f9b8016ab","sha512":"c64eb8517871a1b996d76fd0d9982a9726515a003cebbbdf1639067607e2f7697c97f79fc176802c7e560f325e3f39f40c9edecb49e7c1626b95ca0cb8349424","ssdeep":"","tlshash":"687000380a2000000230202200020002008282a0c0a2a8c0222a820002020200282002","size":21,"data":"","first_seen":"2023-03-07T12:58:03Z","last_seen":"2026-03-06T11:55:01.48721Z","times_seen":8444,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"ef9e29d830b47e493c51972bb3af3ef6","sha1":"95d6255c5e100dce97da5619be073c8dbf4f00c0","sha256":"fc5a1ffc9513896711ec2c788490995715c8d32ccda8c4e2c68a9bd8cb214e77","sha512":"af408037587ea95e4db5c0412d582ea898d2fb5084e5917048698bc482dd7c3e8854d87fcf3adf508fd8cceef746eab017029aba07aa934184675a6e6c88f0b9","ssdeep":"","tlshash":"a270000000002830080208002020ca8e2a22208022033a00800a000000208802088b0a","size":19,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-06T11:55:01.482014Z","times_seen":19081,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/dist/a11y.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d60d16abc088d80092cef147505a08e4","sha1":"681fbfeb2a611e0db7620dfc72af70a76aa67a7a","sha256":"cf1aa9163953fb477fe5cf452229042578738fa9e600c6ef64c47e4635ba78c2","sha512":"57100e48a4a04b95910cf5f2967883d8d259b2b68c82f0eaa12bbde4d6ddfbe7710cd741db8e727172cc0bb27b8825afd8a72c2a34412f242b951f6ed47b60fa","ssdeep":"","tlshash":"2f4131723450767294bf66f79c3d93c6bf358a303a47e0549e0caea93239c9a21357a1","size":2358,"data":"","first_seen":"2024-11-13T06:33:24.842079Z","last_seen":"2026-04-11T11:13:43.775983Z","times_seen":37825,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"javascriptURL","is_inline":false,"md5":"68934a3e9455fa72420237eb05902327","sha1":"7cb6efb98ba5972a9b5090dc2e517fe14d12cb04","sha256":"fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa","sha512":"719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d","ssdeep":"","tlshash":"aa3000000000000c000000000000000000000000000000000000000030000000000000","size":5,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-04-11T13:01:57.440274Z","times_seen":67522,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"11cc3621e45b2f0b945ccf3c32be2d99","sha1":"65369460879076ce3d2ca049392097e9c15b8149","sha256":"8eab171b0d256cf386d222b71fbf5380f2051b67452dbd83f41401a6216a789c","sha512":"e8af12a7397f87b88e2b71577fbb9be3be97b309345786db07de0c882ef2203a6d2b98a7f74c4f5b065e3d67cdb2c54f23ff7694c9ccc83e22ee93e950e60715","ssdeep":"","tlshash":"8bb009b69262c0b9c4469c9eb13ad6e7397a12143813b327901d49205522e5e2b008a0","size":108,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-06T11:55:01.509046Z","times_seen":20073,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/eio-lazy-load-js-before","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"df2a54b55d5398f8b4d4147d5133ea50","sha1":"bd481ce1edc41bb5cb0479427cd8b6cd88318ab0","sha256":"29314647cce010a3beec3cd6786a8e12ecad86434b45ae9a6a907d3ff8183943","sha512":"b6ab1de699a6306d9d881e754107f9548fad1b184544a3ebe9717faf02192ec42c1c8755c9a4ff72f6cf8b2999479cb37ea938bffcd7843d8cbcb616fc75acc0","ssdeep":"","tlshash":"4e51c081c0f6e7c9c1704c761d0e1282ddc3c0bdce001518c0065001473004193c1a0a","size":2454,"data":"","first_seen":"2026-01-01T22:57:26.619432Z","last_seen":"2026-01-01T22:57:26.619432Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/rtMedia.activity.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ce9cdeb4f10040db7cb613cf45c3ab61","sha1":"b446a76736c511c312f603ecf78518a5c394e82c","sha256":"c363181e68b5b45b6737fa393081226e8c36db5e8416590e5cccdc02f8fbeb10","sha512":"f9469cae2979020ca5cd87b6e2b401b037c0ad6d0e8c8c516a7b7f3330d7e9a0943acd5d5bbfebbf5ba087a3f7b36faa389e4ca04f6804eeddf417f08c87b694","ssdeep":"","tlshash":"2df05c5ca072a41545ef7268950be04de220c05312814ea13c8c82bc4f733286761f1f","size":483,"data":"","first_seen":"2024-05-21T06:58:08Z","last_seen":"2026-03-26T02:35:10.540367Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/gallery/js/gallery.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4629222b871dc338c67e02d7089f0f5a","sha1":"51cd9b024ac7b73ebd96ddee52617e2debdefea4","sha256":"143955879d55a60dc7ecb3bedf93773f4559db893a1748a18ed7878a67ca2670","sha512":"dc28cb95d56c0a36298ef70e54195d8460a7829e25db270f81e7143f46df6942b9fed5ba7938fee0ebd8a9d1928e5fb2c0d01f3d9a1c1a3739b67aec4c178d62","ssdeep":"192:qbhUM+Rb4jWRHfHPHiH5Hc89HfHn9HIkSIZWlQT0qaiAU7WiCaCvYAWGOHRqjn1O:qbmbSYHfHPHiH5HcUHfHn9HDZMQT+UzJ","tlshash":"8342dc2c38f711b5a237731debffa47829bb7517a00acf60385c61805fd069056aa7ac","size":12283,"data":"","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-10T06:56:50.422936Z","times_seen":130,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"e018c77e67a96b7f5440da3c7397e35a","sha1":"a090b0a7035556c7f71070fe10c2e37fa15584c5","sha256":"5c5bb18e544cb67f765d8a6d2c774838d3ae95df9b62f25660c64554a7302d8e","sha512":"cfaad7c410b0f14c2c849855f859a973177c6bdeb27ce9e3dfbbb38169a4abd0f66252213aa1885751c54d1ae761fd68af739081e9b7d6875f084c2240874062","ssdeep":"","tlshash":"0a6000c000030030000300303030c3cc3c30003030333000000c3c3f0000f00c003f0c","size":17,"data":"","first_seen":"2023-03-07T01:03:03Z","last_seen":"2026-04-11T08:13:30.250293Z","times_seen":21353,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"dca14c896efeb4b80c68c457aea67f39","sha1":"2488a552655a41fbd3f3165ea5b1999f46f25738","sha256":"998158f6df4183edd82539e6dc971d32f50bc7ee075f64d4abc46d3011a9da27","sha512":"56d0ea635f1a8dd9f7bfed6a8e087ec4d8e38bf65eaee1e1262740fc7ce80cf1b45ea861f0d5949b69ecc650427ccc8879f1b7c9af78933ba26d0aa9f704033b","ssdeep":"","tlshash":"ac8000b02a02b830888c220eb030c3c83c30000030033800a22c00cc08b0ec02208e8a","size":37,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-03-06T11:55:01.497655Z","times_seen":18393,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/ui/autocomplete.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6a53e18a345b37d4f72262a071684e79","sha1":"7269f0f9a41ca95df23387e1c4dad415f0228979","sha256":"3ab937ae57ef4a48601774b6a0cc701482a5c8bc126fcb677db4842b3a3c0003","sha512":"7f1b7ba5ebafb6e1cb9791ce8a0ad6eec1a743e6b15ad3e2d05f38ecf9a7f3437e41f398d3a91fcfbd294073cae25c4e4f6b5fc96526828071a0fc5ee0327b78","ssdeep":"192:7r2AeY1jWBoYfgZn+gSEmaAGCkHjpXCNd882E9cNS/JWmx:7r2AeSWBoYfon+gSDkrH1XCNd882E9ce","tlshash":"8102845f365a6a4156efa078616f324b623a20aa5801815cf47c9fcfad3ce1432b7d7c","size":8536,"data":"","first_seen":"2024-07-17T06:42:32Z","last_seen":"2026-04-11T12:29:01.5714Z","times_seen":12401,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/jquery.timeago/locales/jquery.timeago.en.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"09ce1b88cf9cdc1bc8377780ef0fe0a5","sha1":"a07f6a4fdc9b39d5652449015ff018b51b6e1d92","sha256":"0284d42b43b431163138ad07c2e26fee046b82609761b503949c054fe67cf38a","sha512":"ee3c01c999630794cc8df9275869dcb4dc91a9a8f0a0c5f28d903e1e210cfc08877112e0b0e2159fa9af01113dc2800d5399921109265b95b9af2992c9270345","ssdeep":"","tlshash":"1df0a78dc944560047b58a5c61b306856364d177d0e17dba53c5ac017b4d65f10b67ee","size":455,"data":"","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-10T06:56:50.389502Z","times_seen":856,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/picturefill/picturefill.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d3325bc1d59dae5aedda1c5ead0cd1d6","sha1":"f4b1fea0baec4ab9b6bff45bdea81d8883357e35","sha256":"d603b6e5c404d28a9f1c12bb0b57d8c9967836a8f53cce046a2ab3fd1f3b2f52","sha512":"3b90e2cf6024a8a58aecbc38b7c0671c5ff8ec22cc3e2187f674f803a53afad647080abe8e3ddd03f36091cd4b2b71e6ad386d8c87a6c3932d32b1f0b15f2d4e","ssdeep":"192:h1Xr6SGagHW0rIEtQDvhI3t4An5C5Pr+EfWL:hFr6SGDbJ56Pr+Efi","tlshash":"eff1d7be7a6931779a9334b0a83f611bf03399a6750884e0d451c0ad7cb8e95903ff9c","size":7707,"data":"","first_seen":"2023-03-07T12:03:53Z","last_seen":"2026-04-10T12:19:32.676845Z","times_seen":1138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/rtm-upload-terms.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"52254914e69f6584192189d0eb662df8","sha1":"fabbc78c7993a6c33d317c7d09a4c1f59ceac9e8","sha256":"13b8da48a4163bcfa456df36ae3ba554585dc28f79ebc844e9d377ddd8d10db0","sha512":"e4dba73fd572241f92c735c809e74bb560bd521d960753557c3ca5f7e464de400f7773b7f9a3db218092b95ca3ca16e24451c12c2af70e5a88a3f049968e6f25","ssdeep":"96:ijOAiUcaXav/KRNPwcDnSnDWz0kjXsKpUQy3FVFjpe0N5:ijOAlXa3k1DSDHkjXsKZyVFp","tlshash":"ffa19c58f31497ee91bfe04cb1f74a137051ac232d69143a7a0340edae6bb91a163f1b","size":4800,"data":"","first_seen":"2025-11-26T12:06:49.268588Z","last_seen":"2026-03-26T02:35:10.453952Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress/bp-core/js/vendor/jquery.atwho.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8fb1aecbc162c50b1aff7df861d12eb","sha1":"528038c8f6b12fb90cfda56682242c3636a2e921","sha256":"7b071a50bc10973296a71cacd0867be8143267fa197a7525d44a7fd97a4fb3e7","sha512":"1de2209bd7aa8b4242a23f25f312c554a2502dcc4620fcc41a930eb5267bfe3b8ca4e93fb85643455f8a255344b25e28662c7474bf42f2be931dc9211ea0ad4d","ssdeep":"384:yhirS9rIq4bXLkNt4jmallCBqIbPXAc2D9aY+pNd:TL2L9vAc2j+3d","tlshash":"cc92a59575a57022536162bc6227060ba33e695df50a81bcb6bcdcea7cfc848313bf74","size":19713,"data":"","first_seen":"2023-03-09T17:28:58Z","last_seen":"2026-03-31T06:48:54.160577Z","times_seen":98,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"fe0e0843d4bceff47d5fb4f35f6d67c8","sha1":"f0cb2840eacb7130cb001466b78da701fd444237","sha256":"efa322284ba2148979b08f411b9c6123b26965aee6002bcfc529d0ea4b4bf2d6","sha512":"b32173607eadb210d9131b65019c8b83887695dca7cc4e3c41928a17b4547594258bbf41e3d45512442beba07e75dbca9847fc5ee735fde5897b425531fdc7a3","ssdeep":"384:9hWXZXyH9ViqVOT74EDCapSv3XppSBlt+vtm61OFq2HGUlvEI2CFHcn2noRwLJBQ:mQ9ART7TCUC3XPCIwpHGUSI2CFHBnYIo","tlshash":"da621a6773401231759e62de2c7ec7482a38c0177d07c8aeba7d44f4fb2a69895a7f84","size":15331,"data":"","first_seen":"2026-01-01T22:57:26.622308Z","last_seen":"2026-01-01T22:57:26.622308Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"c510d5a3d97cb2f599576a56b2703434","sha1":"9bc8f27eddd88f1e3f879b2dceb86f92486dc1e3","sha256":"b4a3a83fe09d48db0c0b4416fefb19af5f9e069c12d2af8793a18f159574bb79","sha512":"7adf4f6f79a04ef4aa41503ef199d996dfe027863d5493881f4689e595cc9ce27a4451f1be2617108f3716d2c26bea30fe4ef4c7c4922d4896cf3f7f94e50467","ssdeep":"","tlshash":"7d60002002002820002002000a02a20a2002020c82020200000a8000220208300802c0","size":17,"data":"","first_seen":"2023-03-07T01:03:03Z","last_seen":"2026-03-14T05:03:29.639095Z","times_seen":18159,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"c.adsco.re/","fqdn":"c.adsco.re","domain":"adsco.re","tld":"re"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"8589e02dbee1766faa16fdec85c3953e","sha1":"a022cf96e8f879ed01df368182eb8323068ab5e5","sha256":"e9388aa7428bb6771330e2c83b3a3f85c70f0af4c2355f2f025820d78e02473d","sha512":"8af924f18817027d681d1b27bb727673649161d9768101c655fc7217c342b26f676df27756617ae2e8eb1316032bca43754251c3154b5d8615e8b2f7fb82d4c8","ssdeep":"1536:EEm+g9hlv/YdNmloaYnRQ+tgseEtcE9PiKm7C2:EEm+g9tlodnDeEu+iz7C2","tlshash":"2c63197a7160b03941f120f9657f2b05b1f94ae0294a9091a379d2e03c79eebd33fb59","size":72207,"data":"","first_seen":"2025-12-31T19:36:50.389695Z","last_seen":"2026-01-13T19:58:28.521236Z","times_seen":268,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/front.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"34ca13e3a63dddf1e5d1a97517208244","sha1":"737944e89da0e3ca97b8043b2d6046b6d07ea904","sha256":"679d29a2b30887a43b4fc02bbbb25ae87baa3783c55080a44474ae8ed8a2655a","sha512":"2dccbdce63ca96b5d5be903ba485ff5ee6c6f8bca8897865e8ae6fc75059da6a20634b01366e98b4f4590787229ef9e25ad8225a629b509b3f1d40701acacc79","ssdeep":"","tlshash":"df112b8d19f92d130127347dca8fa1d47953c877125d3e48794c72299f9c9768266b4c","size":1000,"data":"","first_seen":"2026-01-01T22:57:26.629383Z","last_seen":"2026-01-11T12:32:33.918152Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/ui/core.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"da215ae12b95b3aeeb2047667016c7f8","sha1":"480a7087aa74b5b47c47f05a11670e823a3ae4c0","sha256":"699210a5ed06e497b4730ec83bb65ac4c2269ae4a0ee8af3f24aae7ee5b66b76","sha512":"d256ddc828c06f7b84f7df706a4481928a186ea6d3e1358254a1ec02f403d72d2f3aecd682a93aad61b8f236f17dbcf7e6ca100f78c30a348682bf8ee125d8ff","ssdeep":"384:G/rsrDr8LVyraS3dtrqorqr8hrpCip8fuxNhlGX0CiS9rH/OrLrErJ29FkFvd:iS33ZdvK47kv","tlshash":"06a2d94eb246380586f7a2a5402f521fb132e25cb105c8ddf468d8da3c7eea95173f79","size":21464,"data":"","first_seen":"2025-04-15T23:53:17.313193Z","last_seen":"2026-04-11T12:56:35.108808Z","times_seen":224987,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"aaf72876f0d5e8a677a383fd45bf938b","sha1":"d8b2ca3c238c933223f4a6313c5c0561f99e0c1c","sha256":"15eb7e222abfc64660d0f94c04053839498df20ea9ac9a13a201701a56ce3bf6","sha512":"c6bec20224539a5319a753a794c7521e7063e76b3d41bac8d7f0159880eaf3ed07c3fc1b0eb4ec285f1970f270f4b0ab68890d5a0ed01e3b1542102ad707f6d7","ssdeep":"","tlshash":"207000080820000820200802220322283822323022cc0002220a083022ea00b80282e2","size":24,"data":"","first_seen":"2023-03-07T01:03:03Z","last_seen":"2026-03-06T11:55:01.498128Z","times_seen":23956,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"b7d8a1a33a77fcd0328d3c709c5a9eb3","sha1":"e8ea90d66488aae87f231079141b02b04cc26f05","sha256":"3f06772f212125287a824492bf133d5fc6ef851b8478c081406f650716869cde","sha512":"b92d0879e95318270c892770db71380d6f66efbeb8e4c9a8155e82b09e66a0a90844a4d0e38ede9b6bd536d8926ab4359e3bcc5266594f04136fa66295bbc9c1","ssdeep":"","tlshash":"f37000082080000200200002020222003202203080c82002a2000a3020ea08b8020080","size":20,"data":"","first_seen":"2023-03-07T16:36:56Z","last_seen":"2026-03-06T11:55:01.489296Z","times_seen":4296,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"d5757abfc2dfe2efd4bb1409941cf087","sha1":"a3eb249ef753951d22faa61f87302479aff27023","sha256":"bc9c06f981e7daa0478c449324d4010cdbc3c83c9a95879b99a0b531f5cabb87","sha512":"a21d0aae842d3e854147d43d706f8a72afeb8a045e8c020c6a3f0e61a0c91066b86163539ba9a2827f0a61d53b120a90b5c1ba65875e334a87ceca32b06c0117","ssdeep":"","tlshash":"188000ae80a800202230282a020222a02203e002c882008000ab0300208002b0280c80","size":27,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-14T08:01:01.793934Z","times_seen":19591,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"c24107ca675c86ce400f00f60737bf91","sha1":"915db7d3426c409da4f1c6d58c38d9dfd6ad39be","sha256":"3688d7e88d248ea850c456f0233738d10695a410a3dec97785ca7422c3f562c1","sha512":"0b10c8522a9d3b4cd1b5d63918ca7888bf837bd48c2c456c38e20e215a0c5e1cc38e5248658c54021b1d2337a68dc1f61b17adfbda678078d0d4a8cb4fc56e40","ssdeep":"","tlshash":"2870002002002830880200022020cb8c2a200280280230008208000800208002808a0a","size":20,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-06T11:55:01.491972Z","times_seen":18883,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/wp-i18n-js-after","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"103212f10ad2cb707c537810b8cf22ca","sha1":"3a21c21823b0e6cd5177bb749a19f3dbbcd56654","sha256":"f40d84ff77fa390a03e12d089044ef6b099564f5188ae6773213a72bbfc6aad1","sha512":"25a49d201b1dfdee7d4864fab93231853f779087ef4bca8bf16b6f21a00262277ee6030f1d34600cd54e1745cc9ece11aff820af70f0585b8afbe36cda0db28f","ssdeep":"","tlshash":"c5512b86f0973c80418b97705a63bd024581208bc17e880424d9ca206b724c0f4c231f","size":2499,"data":"","first_seen":"2026-01-01T22:57:26.635659Z","last_seen":"2026-03-21T05:56:39.766133Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"7145e6d4dd187b573a13f0240103f6f0","sha1":"f8e7ff7fd488f675f418011ef8ecca4a822933b5","sha256":"02665a4c106fc96e71ef5a17511cf353ec3f5cccb82ec9fce719b23967728897","sha512":"8fb980002683780ece97cb8cc6679fb9c8c97f543b927fe1efbf4073887176b68be02fd0ffbbc4bec0ebce401d04132fe4d1ab1edab9d006be9493f77bcfc736","ssdeep":"","tlshash":"0d700020000082000b2000032f83b280300a033000c8000002028f32a8e802fc020080","size":25,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-06T11:55:01.482966Z","times_seen":21540,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/lazy-load/assets/js/youtube.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5f0c2881b18809265062c50de00ee80","sha1":"34816fd75e6f8745811a6ccdcbf86227c900e78c","sha256":"8cc5d1bf80f7a4a5acc05ae067f695460f9f12614e8814c1856f49d4c4e7d883","sha512":"2b8fc8c6357b55b2d2a08abc571b39696ea5f5dd51e3081494fe4c97c61edbcb66d1390d8feff685cd810865f5595a1a71db8bede0e0b0c302f395b65cf4e08e","ssdeep":"","tlshash":"3e41995d79bb2180693b38ce9fef50802095902b2040cfb4bc9d86857fea21995647ee","size":2045,"data":"","first_seen":"2023-03-07T13:00:40Z","last_seen":"2026-04-10T06:56:50.474081Z","times_seen":116,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"scripts.simpleanalyticscdn.com/latest.js","fqdn":"scripts.simpleanalyticscdn.com","domain":"simpleanalyticscdn.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"aa6014215f23cb3f6cb4902be02d081a","sha1":"44ba2453c2e980ba84602006b4b912736cfd913c","sha256":"a965bdafdcbdf6a1bc0a04fb81ee6d5fb86e1fde7a2da4e8998ab3bcf467bdb4","sha512":"483e8e0a4575808ab0c1262718d85a0b2b9d8bd76d7808ed19050cff3c13690191fe6afb1c9e93576fb153630b413aeffe9fd56bb169d66f97d7fcea1c311917","ssdeep":"96:afayldLqaMRuO24q4cVWQ4BPdTJJ6/j4YE9KQeL6lRS+LwNYzCZu2vQmaDN:abctc45PPQj4YE9uWA+Y1Zu2vQmaZ","tlshash":"4df10adcb2a1707397d3307281afd20ea33b779b398bc4555d1899d4ac7494a4027f2c","size":7515,"data":"","first_seen":"2023-05-06T11:43:24Z","last_seen":"2026-04-11T11:32:57.410375Z","times_seen":1463,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/lib/touchswipe/jquery.touchSwipe.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a5a52e18911e6582e6309ed252b109b4","sha1":"563931c2311e579e33ea6a55c547b499746bf63a","sha256":"0c6ef976b32b0f9158ce1211ed5d75bc3197e5a1802a70749e186fba11b78498","sha512":"9195a4d5c1d4f9d654cc65586720f9c9cf02162e5be8093e1af90a069f9acc11cf68c8ec0f7c8010ada711811cd30dc67b6a826b67ea6690a08646044b058842","ssdeep":"192:CPdvQkDXw6P7AVLLuXOEQPiDOcu8vcixiJaeSg+RyPNWgdukfRZfEsBJtMv/G1Hs:C1ZDXw6P79XOEQv8UitjgTdukfrB/tMF","tlshash":"812242c17751b167bded7275929f1202b56e4ca70a0ac8b4e062e9d4be300789277fcd","size":10802,"data":"","first_seen":"2023-03-07T13:02:15Z","last_seen":"2026-04-10T03:56:27.85485Z","times_seen":637,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"be6b25353280fac3960e70c9dcb6804f","sha1":"46c69609a3bb697e60644b18dc85d780c44804ea","sha256":"38be2b1c1c886666cd4ac85d71bb8b65e51d95c7c5f40b0c575f7d196a0442cd","sha512":"cfb553df29882616e097d28e643208df6aae0e005e63b7e7d9310a731135e9e33407ec268f12699208db7dd4fe2e8ba8a49de900e8b0a1a4bd83bd522f2ee953","ssdeep":"","tlshash":"10700008e08020a308380002028223222a0c282080822020002b0280288228baa88a80","size":24,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-06T11:55:01.486771Z","times_seen":22174,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/plupload/moxie.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"01c5f1d20468b96a0eabbabb62d31f28","sha1":"d3f86b773a13d670e2f300dcb0d9a2d3b7d690af","sha256":"418c78089b8f4d2842b22a02eceda281056200977443b014cb7c553c0c4f37c9","sha512":"7724c45e0d944dce52acd806de62d5f67712c63cd378bf9c188c263e4ba099d3265f146dc64dfc7c5c14855eeac56208426a8e695ce90f9d1bce0994c167ddcc","ssdeep":"1536:O7J9ZfKM+gLhmy3Vqw/FArp/l3hrmQrLpbYqx12V/QK9IPMb9C:O77my3Vq0KrZl3hr/Yh9IPMJC","tlshash":"e28319d8bac174171ba2707aa67f2504a2378a5490058060f9e4d9e5bcf5b4f933bfbc","size":87394,"data":"","first_seen":"2023-04-02T21:14:45Z","last_seen":"2026-04-11T10:06:11.936043Z","times_seen":5144,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/plupload/plupload.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"111b8979f6f57c288948fd651584ceea","sha1":"83be728367a86428425ff186b9226ebc3000f554","sha256":"b0069bc7672025c216451d39e7bfd4d74776acd2d44f48a3edb9aa8f37fa6b7f","sha512":"417f95bdfcd3a82da8bc608e7982c4bf0295adc22006708ef7936b8b48aecc2277748462261d47c12a85327c5550ee7275db4f5ac157b44cd4f4049552ed691f","ssdeep":"384:abats/jkgkMzNioIt1VQxRYRZ7/4B/TvyUh:a2WjkUgtHr49","tlshash":"9d62e79e3995788d3b2bb076a19f05026132c43a04638030f5b9e2e25cb455e97bfefc","size":15605,"data":"","first_seen":"2023-04-02T21:14:45Z","last_seen":"2026-04-11T10:06:11.976712Z","times_seen":5161,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/backbone.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5b5c2ebb1043a2089f38b2471b881395","sha1":"bab51f7bf5f98e554f4b7a445664344f810f4d79","sha256":"a69b2b7f72b1b54c21af59b45da481c18dac7d98b0971c8688503dd0ca75b364","sha512":"e2a52b399fcf1f2e45410a3d60f5c16a62a8674723e439acaa15dad5c2a3bb5f77a2706bbe43aabf22ee4c23cd76193214aaf9f29b79a86a3b5b552e356e2b7a","ssdeep":"384:P+wdhm6Smn9N8Tc1WsP8b/GXlPDFXYEk0NTo/bYybx9ZP0AyCEolSdO6zCBk:oraRuZW6ywq","tlshash":"74b2b7e9739269624aba70b0453f1207e23b59893409815cf6bcd4d7bc7c98d607bf78","size":24301,"data":"","first_seen":"2025-04-17T08:01:27.169384Z","last_seen":"2026-04-11T12:26:53.600349Z","times_seen":8997,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-04-11T12:56:48.283324Z","times_seen":299489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/bimber-global-js-extra","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"c886479036131fc762fcf3241db3c61f","sha1":"927b1a60869d5bf6497b4ff041ca5f59bab34d96","sha256":"1db961722199f4779b8b2bfa1a0904f44279b39f8833dd2719606255ef4204ec","sha512":"d0a08b665bf0eeea6e626ab6f597ac8c9f316eb175fa03cb7011fb928e218711aab2d0ae85d2f07be8d11b502c19fb5bd5e05aa0637da07d817fff2953a809e3","ssdeep":"","tlshash":"43510506d4d94c9003a3ecf06ecb7c65d0fc0331c4d54a4d6ddcd485056850ea587c5b","size":2870,"data":"","first_seen":"2026-01-01T22:57:26.639249Z","last_seen":"2026-01-01T22:57:26.639249Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/underscore.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"dadb3f410026822807858737cbc7b64c","sha1":"477bafdb06d8dc0c22ada8d30067b5a0af2d79b4","sha256":"2f61c0b3d5a147bae06a4f6fd7d90031ddf39cba37e17926999b2645ac746a14","sha512":"1f6cfaf7978f2bd30503abaed49c193625e9a204ce359806449558d0caf09cae7dd10d2156e25f61b8f49efc3b7420b1332a480990da94f5a2ea3d30c262e8bf","ssdeep":"384:u2Rq5yjN1V02mEHrJDzWpl0bMpOt3PPD71ijeE9OWj:LqIbV0sHGl0dD71Uj","tlshash":"288281c83ac2f05aa76330b5406f508bf23a3ea16cada840c265e4f8bd7445d9137d6d","size":18905,"data":"","first_seen":"2025-04-01T10:25:57.91067Z","last_seen":"2026-04-11T13:00:12.172595Z","times_seen":92877,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"d9f9b0f82813d813afe0d450e9fab4d6","sha1":"cb6ce93dd97adc3649f697ff49681f5aaf8b1671","sha256":"d204422e9d49293ab422bfabae9607635876cb30f77215f133603bac691f6f4b","sha512":"849997b396eb218b8bbc788eeb34ec3eb9ab4c809a07ac707a57a5e13baabb69d2c52795403d032f007276109c7f4476daa8255550fa236873e1eb9ba6dba3ba","ssdeep":"","tlshash":"706000c20008802002c200028820a2802832008a20022000c00800000000a0c0222808","size":17,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-04-08T23:13:02.900214Z","times_seen":23635,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/lib/media-element/mediaelement-and-player.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cf5048eb309f9bf7144adf34d15196c4","sha1":"5a33b1cd4564701d762f57bd82c9f7a6484230b4","sha256":"0466734b731acb2709928a14d088981cb6ac5f0866c90236325a7f803ed80e56","sha512":"95fb690dab3e1ae3d2bd68b35ec31e17fbd5c25c3812f78e2349fc19c21312af491dc32732c0409b49c56a74576c746eeb6c81157734504c948e2a1a2b549b73","ssdeep":"3072:Li1bQPZ/PdI5FZx599ct6K2M/m2tATI1paT+BCq2hwV3EnWonWud2sw1A5vM9Lj+:LQ2tDeYdBG","tlshash":"0df31749714473b286c720ee643f1b1e71378e69d409d050a936fafa1eb4f8a502bfb5","size":158159,"data":"","first_seen":"2023-03-07T13:49:30Z","last_seen":"2026-04-10T18:25:17.431559Z","times_seen":218,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/vendors/emoji-picker.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"df49c64afd4fff79dc46d85eec027d1d","sha1":"a67eaa44b7f592838601ba1709ea3be27f32d4e8","sha256":"8f04c1d478a1110f1ad48b5029dc9f36266aac5ad377b9befefba8cf5df0fd39","sha512":"dd30ea5ddca57d4fbc695b438915efa25135a31589ba61d8e7454b7acec300b1022dfa7d20d357f4c34a5f2336a98bc01514fb414ae553a7ccab00eda3b9b634","ssdeep":"96:tNh1up2Tqdm2MY3952gmnVKttxYccFLCegU6S8tGXcheeyBEyd00Y8ztpK:/hqc290gxYNpC7dggMSrp8rK","tlshash":"95429002f68177b771ebb2d2df864d0d751d5d42a091193b23244cb383d42b46aabafe","size":12934,"data":"","first_seen":"2023-10-15T12:53:01Z","last_seen":"2026-03-31T06:48:54.06444Z","times_seen":111,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress/bp-templates/bp-nouveau/js/buddypress-nouveau.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"478c9268668f2fc74431e2fa0edbaacc","sha1":"5fff7a50630a33a45beec89e1cba38d5104c7579","sha256":"e1ba36cc187879e0eb80edcdad7328c46a871c959234ea1f1c42452f1cbe2751","sha512":"67882f7bdf97d0da20b9d32b605175596eeeb5816779c05acf7317adf4184f070403aa99e2ceb2123b5aed71d85a2a42ec16868d25f18f5a77f18c25eccecf76","ssdeep":"384:Cq30tChWRU86X1ao8BP5rPyl/qqJBJj0dvURE5m7aWE5ZnX9U4RotLPJe7OTwY78:Cy0tCb1a/te/qqJBRat5xNAtbI7BvaNo","tlshash":"d7c273c4fb8dd88941763164a81f54ccf23c9472a5049835bddcfef83b88869aa74f66","size":26655,"data":"","first_seen":"2024-12-20T20:43:59.991328Z","last_seen":"2026-03-26T02:35:10.518266Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"df0f0e3e7f31f2501d7e19833ccb4ddc","sha1":"e551bfcbdd3a7c41875f1a974ad1914604b5969f","sha256":"511e9d231c9360fcb7670f7cbaffb35bf8180f124fc080ebbfa5962d4c8bb089","sha512":"57497c56a50a2a0ed0cd9862fdaf381fbf969bd3048dff24dee46f2dc10139cccfcc4b275d7d74cd3d8f036ada1eabe54d05c4773e80ba797748aeff6c855898","ssdeep":"","tlshash":"b98000f8002300c302300f032b0b3302b033000c3accb0ebba3080303802303f8020c0","size":33,"data":"","first_seen":"2023-03-07T01:03:04Z","last_seen":"2026-03-06T11:55:01.513113Z","times_seen":18131,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"3bfa64ddba60d15bd5a0d56285b9df77","sha1":"0c4171347316053766c9aba3b0b2f4b7d29d1181","sha256":"9f59b656ea8a7f6cca96b61c25c4e5eb12959908a62eb3263e4d586961f8a56d","sha512":"dca21bc50d3484e8f82a7dcba77fe66c22f9fb5a9d5ccf6226c3333645af9ccf1beb09a48bd69c57bd18c67722edd0bfce1faccb86b17e1f11f4f5bb0df10f43","ssdeep":"","tlshash":"43c0808140f6e7c9d1744d765d1e5281ddc7c0bd8e045558c0555505573544153c594a","size":170,"data":"","first_seen":"2025-12-03T10:54:57.182261Z","last_seen":"2026-04-11T07:59:07.692805Z","times_seen":142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"a97ae6bd4dc972c26de801f868a79d5c","sha1":"cf1a46aa575a9718f8d4154813a7892317e7f8bf","sha256":"51c1083130407a8772738aa2380eb5a583240a47d98f2204b124c06fd11aabd5","sha512":"f16b7e511db0f35f83e9380c46a6173de1ca6aebbcf4aec1be6efd8d0cb669fc9a07c4e7702149f0421425109c35a9cd041347677ccaed445c978296502e78a8","ssdeep":"","tlshash":"51600003030c0000c00000030c003000fc333c0c3c0c30000c0030000000f033cccf3c","size":17,"data":"","first_seen":"2023-03-07T01:03:05Z","last_seen":"2026-04-11T11:24:40.107867Z","times_seen":20799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/modernizr/modernizr-custom.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"be867eb3c95205f143aecc1fff7d4df6","sha1":"31c16e5fdb15452c67a8044798f6380be681888d","sha256":"2e66ce2eadd79bca0080194f87dbf2f1d01bbf996241615de43d94dfc7eb1d0d","sha512":"5b88db46f2f8ae0ba5339aa2a5d2dd25c3ae9bbbab5763e5de90d2cde9c3ab7e9867040bd787a327349f8fdf6223449cde292f558ce40168c88e3afa627b6759","ssdeep":"192:R4T/2BQ5b4NW1RM2HbUF4Sjy9kAuBnkSOVBB:GT/2BQ5bKh2HbUFTFAuBnkSOVn","tlshash":"0ce1c5c971a3b17a839b2167507f520ef8780e189e198414f069e8bdfd74de4537be28","size":7024,"data":"","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-10T07:04:34.759494Z","times_seen":613,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/dist/dom-ready.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e4bc17cc45ca91ab0f09dea134975c51","sha1":"3c03312717fb495c051d02a3d27ec0d8abc2557d","sha256":"5a43a22e48f94b7a45a9a9b1a107f197213b73307fdfa2e6b2daadab264f94d2","sha512":"f8e537a2168b94875bb7ddb9a20037c5bc79831c8b4e726f224f8d7c723c5c4b4512551697cf7bfb6ce4b5f8365dc1c027107ffe3435ea27c686f5ae96d921e7","ssdeep":"","tlshash":"bbf0d4705445edf071bc80e6442d53c1b5219039372270f14b8cdcb569e0f96127ede7","size":457,"data":"","first_seen":"2024-04-03T10:12:48Z","last_seen":"2026-04-11T12:50:14.366136Z","times_seen":84033,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/imagesloaded.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6823120876c9afc8929418c9a6f8e343","sha1":"90b0adb37d70ffec5f9189c36bb0027c310c9502","sha256":"b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1","sha512":"63d84226815c831245754adb30040ee72dcf218d01f991a5619675374bbe3b706e3721d32f5120d9d27e500813e8214244992b3875b3a7e7e4bc7ded5201183a","ssdeep":"96:PwSrH5hrG6Qpw1rIN2Bkqsu6B89w1y+7Y3qv5StcXyuC0r4oYeTnf49uVhWWTfju:PwSrq6Qpw1rI2k1u6i9woa3hSSCP9+XC","tlshash":"00b1318db7737563125aa0f2b31b430ab3b6509ea128419d765cecf39cb490a1973fb0","size":5520,"data":"","first_seen":"2023-11-08T01:34:44Z","last_seen":"2026-04-11T13:00:12.164663Z","times_seen":151193,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress/bp-templates/bp-nouveau/js/buddypress-nouveau.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.198Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress/bp-templates/bp-nouveau/js/buddypress-nouveau.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 25 Sep 2025 03:29:54 GMT\r\nvary: Accept-Encoding\r\netag: \"68d4b732-681f\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 1180010\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PbnDBYHTJFAWMvrYZsivSNADLq3xljGuIEI4IecMXIHpMNaaQPc00qIfoHcQMRiuzTiJwT0CgSGi1XExa%2FMjF5l5fZcSoV%2FjTgwn\"}]}\r\ncf-ray: 9b759cb85ed04c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26655,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"478c9268668f2fc74431e2fa0edbaacc","sha1":"5fff7a50630a33a45beec89e1cba38d5104c7579","sha256":"e1ba36cc187879e0eb80edcdad7328c46a871c959234ea1f1c42452f1cbe2751","sha512":"67882f7bdf97d0da20b9d32b605175596eeeb5816779c05acf7317adf4184f070403aa99e2ceb2123b5aed71d85a2a42ec16868d25f18f5a77f18c25eccecf76","ssdeep":"384:Cq30tChWRU86X1ao8BP5rPyl/qqJBJj0dvURE5m7aWE5ZnX9U4RotLPJe7OTwY78:Cy0tCb1a/te/qqJBRat5xNAtbI7BvaNo","tlshash":"d7c273c4fb8dd88941763164a81f54ccf23c9472a5049835bddcfef83b88869aa74f66","first_seen":"2024-12-20T20:43:59.991328Z","last_seen":"2026-03-26T02:35:10.518266Z","times_seen":19,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Hot-Teen-Clit-Through-Leggings-Cameltoe-364x390.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Hot-Teen-Clit-Through-Leggings-Cameltoe-364x390.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 27961\r\nlast-modified: Sat, 19 Jul 2025 11:57:28 GMT\r\nvary: Accept-Encoding\r\netag: \"687b8828-6d39\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 76277\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bkl3ygsTWpiJaG3HixKYqoQJL3xaPM6o08FYcmhLUnHBtso2o53xXUhMKGtGeYkQgGTivfrLenfFXhKCZ4SaP80zTz5LiFVK%2Baxk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbf9d4d4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27961,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 240x240, segment length 16, baseline, precision 8, 364x390, components 3","md5":"f3ed1e44b308dcceab62d3d4eaad5583","sha1":"3f1f4df462b23261a60bcefb47cfbdcc016e62e4","sha256":"686c1b1197d26eac200fb03c5257a4eff20c214361a39f6dd9bc777290917798","sha512":"a1826dfdeb3c9420feae2feac0e98eb38d3966d3bda0eb9410f7364273776cfd4c55ab5275cf2161e929634540a613ff4d3c582ca556b614d9a9b949f7c633a8","ssdeep":"768:wbnIzkYZF/c9YV3AEx6iuITfSPkJedpZhTsDI8xxJ:wbnQTnkKV6iVfSbdpfctd","tlshash":"e5c2e1baf05334f4faf93d8516486d24b9c1b9d8fe9d3ea8a4da538411336e76490c06","first_seen":"2026-01-01T22:57:26.464702Z","last_seen":"2026-01-01T22:57:26.464702Z","times_seen":1,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6.adsco.re:2087/","fqdn":"6.adsco.re","domain":"adsco.re","tld":"re"},"ip":{"addr":"104.16.84.77","port":2087,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.519Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.adsco.re","organization":"Adscore Technologies DMCC"},"issuer":{"commonName":"Sectigo Public Server Authentication CA OV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 15 Sep 2025 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"EC:13:B4:EC:A8:B2:CD:2E:12:E1:84:0E:E5:64:5D:88:D5:CA:3A:59","sha256":"C9:35:54:5E:EF:18:4E:21:62:7D:1D:23:55:D2:B9:CC:68:48:01:7B:AC:A5:8B:D9:3D:71:85:DC:07:17:02:2F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 6.adsco.re:2087\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 45\r\ncf-ray: 9b759cc22cbc8be6-OSL\r\naccess-control-allow-origin: https://xcandid.vip\r\ncache-control: private, max-age=300, immutable, stale-if-error=300, stale-while-revalidate=300\r\naccess-control-allow-headers: Content-Type\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-expose-headers: *\r\naccess-control-max-age: 2592000\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":2087\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"5b41cb22f84f645a103acc7bfbf084ff","sha1":"bac3967b26d5ec4a0d09a580714e8219796816bd","sha256":"709f0a0dfab9f9e074f4a4a348dcb09150838284d21e75cfb9e5ceaeeb2054bc","sha512":"772066ed1119519a19884fc94de2c9f2cc538b4528d9e2651a89b93d65bd4000b18297bfbdd8903b65146858935d33cac048c321dad2ea4f1f84ca6dd9b7d98f","ssdeep":"","tlshash":"7990041154441d34dc45470c4f0d0f0553dc5153df377374ddc50f0414531344141d00","first_seen":"2023-04-05T06:05:36Z","last_seen":"2026-03-30T19:07:46.969854Z","times_seen":25700,"resource_available":true,"data":null}},"time_used":86,"timings":{"blocked":24,"dns":0,"connect":6,"send":0,"wait":28,"receive":1,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/lazy-load/assets/css/youtube.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/media-ace/includes/lazy-load/assets/css/youtube.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Sat, 27 Apr 2024 18:28:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"662d43d5-3fb\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020433\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6hCPAd6wIY32qd6BbDYQsF0ljE6EzqnyiW%2BkM2p2swZ40798Df0ay16KLrCyRzvwHAqxYJ2FDbshS6RrKyxMaYWBMZHVl%2BYB%2BFx5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb78e794c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1019,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1019), with no line terminators","md5":"6df8144762a38e0e1854c890d10f14a8","sha1":"1099e22e83db5b5ef2dccbd1795efda06260c1ad","sha256":"91f8456df712188504db6297b5a7e05225cf9466910e68c754a138ba79060546","sha512":"e4e10632a89d30ed7bfa6480390244f1cd62808307a7d5290c360a92c6e2e27b4237acbeb3200d46c89e770625fc891548077ac533200e533e8dbc0d5fc8aa59","ssdeep":"","tlshash":"1711ab3589323085614a728274c1fe58376b6ad137629fb6811d42317dfb967042ab63","first_seen":"2023-04-13T05:49:11Z","last_seen":"2026-04-10T06:56:50.439847Z","times_seen":92,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/jquery.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.040Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 29 Aug 2023 02:44:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64ed5b88-15601\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XO0Khq%2F0nQG99oWm%2BaVELG%2BblgWvLkPRMEFhgisfqStuEJeCy%2FVcFCcZfZqrZMs3bE9ea%2FqZma0AxSA%2FzrI7njXZl1i8TWzGN660\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7de8f4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87553,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-04-11T12:56:35.15669Z","times_seen":703029,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/jquery.magnific-popup/jquery.magnific-popup.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/snax/assets/js/jquery.magnific-popup/jquery.magnific-popup.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Jan 2025 11:50:27 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677fb803-4ef8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X%2Fu2Qj6SIiQ5TFPfhkg6QeqY5eHke7ZtwUk4rjMh7WJwoOyXqgDDjECR3zi4kFavBieCgCCk%2BTvvVWwR6ah9JL%2F8KCO%2FHXnQ3pCP\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb81ead4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20216,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20087)","md5":"ba6cf724c8bb1cf5b084e79ff230626e","sha1":"f455c5f153f872e52265f87a644ff89fe14a6fb6","sha256":"3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4","sha512":"22c361e44dde632dedaff2625f6631e2fb02ba3b6487097b48baa09f02cd81fd381ebb7d053f525e52e56655b1f8e2b89ddcc0a002e1b0c35c0a6920823641d7","ssdeep":"384:lPhVPXQ2G2XAQyqVxRQ5giCCMLtA15h5/F6l8aZwHwztLCpmst:lPBIt8I5h5t1qkOLCMst","tlshash":"bd921894f2b2b21383a735b8686f70093a729952ed06c855a55d94d87efcec89037f3c","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-04-11T12:58:05.547604Z","times_seen":55489,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Lulu-Shorts-Teen-Creepshot-Bubble-Ass-364x530.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Lulu-Shorts-Teen-Creepshot-Bubble-Ass-364x530.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 20143\r\nlast-modified: Thu, 17 Jul 2025 08:11:17 GMT\r\nvary: Accept-Encoding\r\netag: \"6878b025-4eaf\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=256XZFoOf%2FC9b8XxGO0NO1oFNYa7uli%2FHpzYYIaOgTEI5a4bstQu%2FM0lidympy8w02bAiwn8%2BOHkzhYXL2azyUa569FLlino%2BC3w\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc03d7a4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20143,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 240x240, segment length 16, baseline, precision 8, 364x530, components 3","md5":"632128e3f52f72caa4f97e3f3870419f","sha1":"fc41e538db95bf7908dc437366bd87e30e8730dc","sha256":"a130d74a34cdbee7d48a35a707787130acb37fb3d5d3f1b243ae325b3a8b82f2","sha512":"c646cf6b40b8544ff23b6b814c5cea16218f9b9814899772093eaa1d8cdfdb1b365dddf88d0120992ba9ba0c317348d1ddbf13b9e7708ca0f5099f2025966f08","ssdeep":"384:jYdDNRvBof6+E9AikGLn6XuYiHdpRMYOGMjt8Ta9UlNCqYmheZV8i:jYdRJBa6+UPL1YiHdp5g+/eUhSVT","tlshash":"d992d00b47eae0cddda80ebddcaeb67c4908a3d2cf8399fd05bb89048145dd667059c8","first_seen":"2026-01-01T22:57:26.469279Z","last_seen":"2026-01-01T22:57:26.469279Z","times_seen":1,"resource_available":false,"data":null}},"time_used":604,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":456,"receive":148,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Blue-Leggings-Teen-Duo-Awesome-Asses-364x210.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.246Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Blue-Leggings-Teen-Duo-Awesome-Asses-364x210.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 17581\r\nlast-modified: Thu, 17 Jul 2025 08:10:04 GMT\r\nvary: Accept-Encoding\r\netag: \"6878afdc-44ad\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zc%2B%2BO9Ez%2FJjy9%2BOeT7N6c1H7Ouy%2BnHMcdV9Cl0%2Bd%2BAnJHe1e1yFjHr64tCWPwxvgvvm8w7GyV0D4WZ049K%2FPRDYN355rRz5sl0aG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc03d7b4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17581,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x210, components 3","md5":"a257e059fa783f6394ae43f95ed41206","sha1":"6636a909b0911a2a34ce901ed8c483c5c6d6d8d9","sha256":"835953c9c3f40f02ef6dd8222aad11566ff51133fbc2a28ede9bf207a29790a7","sha512":"b257dc0fff2c949b4f7d7a363f791db1e1241e0473a9c597f6bd1ec08c0207b7239a920778c3eb60bfea8feecc0afc48d1bc68c2f1fd342ac6b2e4d7c41e8a78","ssdeep":"384:jh+7XZxU6m/gS3cwuiS7IES0fGnK0XA+9UkHUehWoLwDilRTdQZnp4Q:jh+DPUVgNRzIES0+NwJehWt8ZdQZnv","tlshash":"5c82c086cde46098cd582d3c01ae3d3d67fe00eec7ab484669b7c6aed485dfc7224684","first_seen":"2026-01-01T22:57:26.470857Z","last_seen":"2026-01-01T22:57:26.470857Z","times_seen":1,"resource_available":false,"data":null}},"time_used":604,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":456,"receive":148,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/ui/menu.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/jquery/ui/menu.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 17 Jul 2024 03:30:19 GMT\r\nvary: Accept-Encoding\r\netag: \"66973acb-27d7\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 1181293\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=whAgXCQKGhVDzooCGBQVrCKTrltL%2FkfIlBlqurFESGmW1BzJO5%2BqjsGExznHA5CurSC%2BWJGgJ3PJFkI55u4PR8YTVNdQpdr%2BUbe3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb83ebf4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10199,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10020)","md5":"284953f0e0a570aa06d6b527c45a55bb","sha1":"c4b8089261f001829f0d6e522928f6d912db7d1f","sha256":"41788f27f61aab4174275eb5fbbbcaffde0f4f0f07e6900592affad38e09b154","sha512":"81d15d80bbf4f8703e644157d74f8f44eea10e13553947437f14e9e448084d3b9a704cf87dbe0cc99d228a39820ce122a226973fa543da3c84ff70a8f504c51a","ssdeep":"192:sr91gNsoBeuLLE2mBrnYgfGGFTsPdQlJh1NmgKzH:srkjMunE7x/3sPd469","tlshash":"5422758831863a72349ba3d8291f60da6236649c9909555c70385fddee3df9023f37be","first_seen":"2024-07-17T06:42:32Z","last_seen":"2026-04-11T12:29:01.530451Z","times_seen":13541,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/rtm-upload-terms.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/app/assets/js/rtm-upload-terms.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-12c0\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020439\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AFFTO%2BzK7XW4f7chHZh6Rw0qp7SzkyqjIWjTJotAhgILyyUjSta6lV8Wck7iK1BNUo8mWbnoZ8jsFz3OL3GpDJHKvK6n7465JltF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb86ed44c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4800,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4800), with no line terminators","md5":"52254914e69f6584192189d0eb662df8","sha1":"fabbc78c7993a6c33d317c7d09a4c1f59ceac9e8","sha256":"13b8da48a4163bcfa456df36ae3ba554585dc28f79ebc844e9d377ddd8d10db0","sha512":"e4dba73fd572241f92c735c809e74bb560bd521d960753557c3ca5f7e464de400f7773b7f9a3db218092b95ca3ca16e24451c12c2af70e5a88a3f049968e6f25","ssdeep":"96:ijOAiUcaXav/KRNPwcDnSnDWz0kjXsKpUQy3FVFjpe0N5:ijOAlXa3k1DSDHkjXsKZyVFp","tlshash":"ffa19c58f31497ee91bfe04cb1f74a137051ac232d69143a7a0340edae6bb91a163f1b","first_seen":"2025-11-26T12:06:49.268588Z","last_seen":"2026-03-26T02:35:10.453952Z","times_seen":19,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/archive-filters.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/archive-filters.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-205\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3016286\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RC8l4q79HwmF%2Fm8eSqu%2FjPD8%2FKKwx3WbBG5GXSh38U2a5imdju6dB8mO9N%2FhqeJLVEQ0ZyTCMudK9L8vKm9YfDtzBQI%2FA%2BY3Kd%2B8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb86ed24c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":517,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"d8818f7914dca2c830369f2dee913996","sha1":"f62b5b02f448ed41b22631b1a47ed72c6822aab5","sha256":"a8e74586981d9c560c80df04ea96f44ec6a28f816b3fa74d32d762f676580ce3","sha512":"be265d0158876970913d2d472fc8bb1dc53ef4679287fb29f97a187b72e276bf89908b40a1df3082f80fc4cb154c29dc2c3aeee8556f409537b34d5d7cf15169","ssdeep":"","tlshash":"48f0a70a78eb1c5210b7317aaa2f94c4157a10a315878a913d6d7bd04f5ea3e8217918","first_seen":"2023-03-07T14:31:58Z","last_seen":"2026-04-01T14:34:26.15764Z","times_seen":21,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Pink-lulu-Wedgie-VPL-Teen-364x289.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.248Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Pink-lulu-Wedgie-VPL-Teen-364x289.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 20354\r\nlast-modified: Tue, 15 Jul 2025 08:34:31 GMT\r\nvary: Accept-Encoding\r\netag: \"68761297-4f82\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S8OEXJ7l6MXZvtZxo4t%2FYRE5viECOLoQ1zGBUq8fymoswL7Ha7GXS2TZVlhOml8VsMGjrp7zWdurkG9VqEwjlz0v0xmw4BORPsMy\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc03d7d4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20354,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x289, components 3","md5":"88c27310e7bd72535625576e52f10a4a","sha1":"822a5c2045717818809280914657c033bef53302","sha256":"10d4ec0b520a1076e8a13549973885fad6617de06f04e9dc38dc51abbcf4faef","sha512":"2c950202ccd100f7fc3f168dcd82cf28d25329793798520736cf441bf3748ebc50fb28fa62ea1b9e452b634e6571cf5d825070f793eca5a0af5ec5a95c9cbbf3","ssdeep":"384:ykHHjRnH+DkA8+/kW/JmI0IqMuM5NsS7AZl3Z1u/7r5XDSSR9AJH+4:yoQ4QN/CVfM5R0b3Xu/pDSyA","tlshash":"4d92df081fdaeab5d62a3e38a4215a25ec0a530d4935c63b1434dc43f4f54fbbb652cb","first_seen":"2026-01-01T22:57:26.474769Z","last_seen":"2026-01-01T22:57:26.474769Z","times_seen":1,"resource_available":false,"data":null}},"time_used":618,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":455,"receive":163,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress/bp-activity/css/mentions.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress/bp-activity/css/mentions.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Thu, 25 Sep 2025 03:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d4b732-4ef\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020437\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K1ss3O%2FbFadQwgFO9NAomjhlJgCS%2FEP6wcj2TJtN8REavsHFclyPnq1knpKP4tzQKin%2F%2BHRR%2B%2B3PKx02UypdqRPYMhQr%2FM%2B%2FSYrM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb78e764c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1263,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1263), with no line terminators","md5":"fa68d093a2bb266b5640a0dbf21ceafb","sha1":"44401575bc0eb36e85acb8e7e2367ede03eb8bfd","sha256":"3a7bb0aae93710c3c02fa8a8817c4d9890ddb9a34ca4068c766a1a3665144783","sha512":"5e53b2a46708ca3be4ee54c412ef715d65f1c7263e8ed7b439e3b0938d03a662ab43131f97d8ca462338accbce071c644c558b469fce05fe6c029fbef3148c4b","ssdeep":"","tlshash":"fe21bb717d86201df427d061ae61298f3046162ff1134edddf6032bac4c669e0422746","first_seen":"2023-08-10T11:17:26Z","last_seen":"2026-04-06T00:01:23.178584Z","times_seen":102,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/css/rtm-upload-terms.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/app/assets/css/rtm-upload-terms.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-13b\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020372\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=74Mnk%2BM3DSQBJEvSrB3Oc%2B1WS4aPlDjFwKOMMy0MH61%2Fe%2FCenvfe%2BJ0E4F30NTB6sYNT96Jr3B2hJTaiCMp4G0044H6XomQFkDZg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7de8c4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":315,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"20317f8bb70678ed57d9357052519197","sha1":"b1bb7b44e3a2c4b4916fbf3fb72a6807091fa446","sha256":"3cfb9de8807a935655a0375de35bac4c33b96c5dd700dcf274d40f8d79e65ffa","sha512":"61ed40522959dbd9231ae25335ae6f0b3da1672614c3fd017f71fa2358444ba82cd24383640ce21c03e73d07d974abcbd2f9fe6a259b8d556ad87bf24664d37a","ssdeep":"","tlshash":"85e0c200b466cb4cc41fc0088acb81ca10258d631864400dbc1e49eefebf0a8bc57f93","first_seen":"2024-09-28T08:03:44.860899Z","last_seen":"2026-03-31T06:48:54.171561Z","times_seen":88,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/css/snaxicon/fonts/snaxicon.woff","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.045Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/snax/css/snaxicon/fonts/snaxicon.woff HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: font/woff\r\ncontent-length: 12796\r\nlast-modified: Thu, 09 Jan 2025 11:50:27 GMT\r\nvary: Accept-Encoding\r\netag: \"677fb803-31fc\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 5310852\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2o4DDabxr68PXxzXllAa16RhVdhA2cdFiyRrTUvGqTized4hA00x%2FR48bc3fFFiP4AibzISpC%2Bk9iG9DUAgcQascomqfqpc7GZpD\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: 9b759cb7ee974c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12796,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 12796, version 1.0","md5":"85941a4fc5dd91e76500d657b8440f41","sha1":"6e1e27708c523c7f125754849a00aee95e15d4c6","sha256":"a7eb4dfaeb3a5b3370523b353c14853d801722a62325eb88ef60b3fd08f016f4","sha512":"60f6ea93ded76cd78e0200bab0166dd59f093bf95a21cc5e82d7382dae31dea089c4f4e91af5938852f847d575183dc5c23db49f672cf88155a55f79e1d2fd04","ssdeep":"384:gq4ZJEI2kX3fh9mK8IkbAyXUwm21GXm06:giIVHZ83eyXUuGXH6","tlshash":"6342b075cec84909eb7392e9b78f7a8276c2062c79069e43cd186ebb4a34331bf75504","first_seen":"2023-05-04T13:36:37Z","last_seen":"2026-04-10T06:56:50.452893Z","times_seen":216,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/rtMedia.backbone.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.088Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/app/assets/js/rtMedia.backbone.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-1d3d6\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020382\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QLXF04FiFMhsX4fTbhiQyH%2BpZEjC0B795ObG0EuCgeR7aJVzo4Iie5%2F5Gr08ISqG9Rgn%2FjyEvADca1l9UugdhAarmO1qmQqCfYNF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb80ea34c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":119766,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (301)","md5":"389ca7dfe616b632c54afd6d523564e9","sha1":"84dc8867a3c9643f17265e778fd3cd18a2df46f7","sha256":"a00ee426f2a6cf75871b48c20e9f50b72b76b6f32a3e067d22d21c9966b01914","sha512":"a401d086e2d391efef35e706eef64567dbef5f0def306305ca7ededb7bb7e1e8e7edda27a3fca749185e38fed064e1e4d2597c6ba96413b6b47db0be589522cb","ssdeep":"1536:09+77WUSX47/OK/uOVqxad4HR7iVXNVCCtPSeapVTv6:iG7+GNVx","tlshash":"bfc396199af25296917b707cafef25123160cd172108de143d8c96f8af98e7092e3f9d","first_seen":"2025-11-02T17:42:24.375234Z","last_seen":"2026-03-31T06:48:54.094593Z","times_seen":32,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/matchmedia/matchmedia.addlistener.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/matchmedia/matchmedia.addlistener.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-b00\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 5310852\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wCLV%2Fu7h0Duyo0Wy1Ww8CdDMxg5Y9%2BI3dRm%2FIDb2lufaTHri2SNm%2F7fIbKFkWGPJfWvITffoB4B6Oszz%2FlM8AzRTgc3XuBWGP93c\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb82eba4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2816,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"6f47448212550bd3157c4265e3ebf085","sha1":"5949f358ba1f69bdf5442cd0c88b86934d254e6b","sha256":"4492a4f252febe84a00d7f8246e50e43475a11d7192a279aab3c189cd3721456","sha512":"981959794b1f50b6f5dc345848d068e013913a6bd17312956a9ecef4881e54c499f1ccd9929feb42e91673bf22ee5551f202d20abb4b1d5beb092f7ee1856356","ssdeep":"","tlshash":"fb51e12d16aa103e34d3e3372f9f22596a6b926315089400bf1de3c42fa5d5d52bc7e6","first_seen":"2023-03-07T01:11:51Z","last_seen":"2026-04-09T22:09:23.067695Z","times_seen":1127,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/css/9.2.5/styles/original-2018/snax-extra-dark.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.996Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/css/9.2.5/styles/original-2018/snax-extra-dark.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Mon, 09 Jun 2025 15:19:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb6e-5f12\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020432\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mACT9cAblv58uBUcHEUrjx7mlWoD3lEQG4HPaSzU7Q3mrUrmWSTYtqDIHkd2MbBEHTNd7wBj7yzdNoZ%2Fj%2FnLLs1wv41eZKE%2Bt3Hp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7ae814c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24338,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (24338), with no line terminators","md5":"3e39be96e97b5b81da7d5a3f315f7557","sha1":"bbc3d7f99f9543ca13c616e33b287f38172d0348","sha256":"213de65b99c78ab412459d36705883a3429bd283a5438a42587d79b05133b651","sha512":"e85904e8ffd56d0e4caa36e339f07fc35c27bae9c24d9404f203b2c36001ac9b719d63e459d9165fccf9532960fa7a671221ec406cf96291ea04e0236603944b","ssdeep":"384:WMc78hjma1RqXw9WTs8NTCSDXAhpBKJtzy9DoSqdrZ29RttCLS9K77kv45EQdLrZ:Wx78hjma1RqXw9WTs8NTnQhpyo8ZMRto","tlshash":"84b21175fdf9172da387a331169262cf69168802f1d30fd5e92d6205cafaf9c25b2b04","first_seen":"2025-08-31T22:10:51.395923Z","last_seen":"2026-03-26T02:35:10.453042Z","times_seen":11,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/6/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-01T22:56:48.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /category/candid-teens/page/6/ HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nlink: \u003chttps://xcandid.vip/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://xcandid.vip/wp-json/wp/v2/categories/11\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\"\r\nlast-modified: Thu, 01 Jan 2026 02:02:06 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=51a9T5Dsyre71spROwWanboM6Ytw3CnYOVd0BPGA9VIPqdfajG9dwOg4MLMacT2bMCNrOcY4Dt0ibgSiA%2Ba%2FVIIcKdv1iQaOB8b3\"}]}\r\nvary: Accept-Encoding\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: no-referrer-when-downgrade\r\naccess-control-allow-origin: *\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9b759cb1ca8c723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plupload","description":"Plupload is a JavaScript API for dealing with file uploads.","website":"https://plupload.com","common_platform_enumeration":"cpe:2.3:a:plupload:plupload:*:*:*:*:*:*:*:*","icon":"Plupload.svg","categories":["JavaScript libraries"]},{"name":"Timeago","description":"Timeago is a jQuery plugin that automatically updates fuzzy timestamps.","website":"https://timeago.yarp.com","common_platform_enumeration":"","icon":"Timeago.svg","categories":["JavaScript libraries"]},{"name":"Enquire.js","description":"enquire.js is a lightweight, pure JavaScript library for responding to CSS media queries.","website":"https://wicky.nillia.ms/enquire.js/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Underscore.js","description":"Underscore.js is a JavaScript library which provides utility functions for common programming tasks. It is comparable to features provided by Prototype.js and the Ruby language, but opts for a functional programming design instead of extending object prototypes.","website":"https://underscorejs.org","common_platform_enumeration":"","icon":"Underscore.js.png","categories":["JavaScript libraries"]},{"name":"Simple Analytics","description":"Simple Analytics is a privacy-friendly Google Analytics alternative.","website":"https://simpleanalytics.com","common_platform_enumeration":"","icon":"Simple Analytics.svg","categories":["Analytics"]},{"name":"Backbone.js","description":"BackboneJS is a JavaScript library that allows to develop and structure the client side applications that run in a web browser.","website":"https://backbonejs.org","common_platform_enumeration":"cpe:2.3:a:backbone_project:backbone:*:*:*:*:*:*:*:*","icon":"Backbone.js.png","categories":["JavaScript frameworks"]},{"name":"Moxie","description":"Pollyfills for XHR2 and File API","website":"https://github.com/moxiecode/moxie","common_platform_enumeration":"","icon":"","categories":["Widgets","Accessibility"]},{"name":"BuddyPress","description":"BuddyPress is designed to allow schools, companies, sports teams, or any other niche community to start their own social network or communication tool.","website":"https://buddypress.org","common_platform_enumeration":"","icon":"BuddyPress.svg","categories":["WordPress plugins"]},{"name":"W3 Total Cache","description":"W3 Total Cache (W3TC) improves the SEO and increases website performance and reducing load times by leveraging features like content delivery network (CDN) integration and the latest best practices.","website":"https://www.w3-edge.com/wordpress-plugins/w3-total-cache","common_platform_enumeration":"","icon":"W3 Total Cache.png","categories":["Caching","WordPress plugins"]},{"name":"jQuery Migrate","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"EWWW Image Optimizer","description":"EWWW Image Optimizer is an image optimisation WordPress plugin designed to improve the performance of your website.","website":"https://github.com/nosilver4u/ewww-image-optimizer","common_platform_enumeration":"","icon":"EWWW Image Optimizer.png","categories":["WordPress plugins","Performance"]},{"name":"imagesLoaded","description":"jQuery plugin for seeing if the images are loaded.","website":"https://imagesloaded.desandro.com/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"timeago","description":"Timeago is a jQuery plugin that makes it easy to support automatically updating fuzzy timestamps.","website":"https://timeago.yarp.com/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"LazySizes unveilhooks plugin","description":"LazySizes unveilhooks plugin extends lazySizes to lazyload scripts/widgets, background images, styles and video/audio elements.","website":"https://github.com/aFarkas/lazysizes/tree/gh-pages/plugins/unveilhooks","common_platform_enumeration":"","icon":"default.svg","categories":["JavaScript libraries","Performance"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Magnific Popup","description":"Magnific Popup is a responsive lightbox \u0026 dialog script with focus on performance and providing best experience for user with any device.","website":"https://dimsemenov.com/plugins/magnific-popup/","common_platform_enumeration":"","icon":"Magnific Popup.png","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":230868,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (8832), with CRLF, LF line terminators","md5":"f9d721e054f6aea4b9f35529f411f4a9","sha1":"6333ebc6a11522b040a50fcb508876dae58bcc6a","sha256":"69618ea7db39353a3a9890d155c16226ca2416753e128abffd0374debbde96a3","sha512":"68246f6978248fa99dd4122d6f5dbcdcc87e2777a9477215968311b378fa8ee9e9ab74df31fb0bc091f7b9379f7a76e5afda394444488a2805bd91a078d05387","ssdeep":"3072:UuOdTI1F5/Hmk4U+Njxu4JZN2GfXnKEmyrbpwh7dXG/HiGwM26SPXZktoGeqSx5g:bT5hkPX","tlshash":"0734c6b7745d5a3a032b63c2055d7349a08bcd3aef836c80b6bf92dccba5e722853515","first_seen":"2026-01-01T22:57:26.48334Z","last_seen":"2026-01-01T22:57:26.48334Z","times_seen":1,"resource_available":false,"data":null}},"time_used":681,"timings":{"blocked":40,"dns":19,"connect":1,"send":0,"wait":600,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/plupload/moxie.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.036Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/plupload/moxie.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 03 Feb 2023 02:06:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"63dc6c28-15562\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0dTYzfv8T2nXLwmnQ%2FVHwLIJGO9FQpxosElTs6pDvWYBJXY52mFW5yoUkEgphvlDQ7I%2Fkm4q4R3rzkTlRxm4aj1wyS%2FhM8Hqge0r\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7de8d4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87394,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"01c5f1d20468b96a0eabbabb62d31f28","sha1":"d3f86b773a13d670e2f300dcb0d9a2d3b7d690af","sha256":"418c78089b8f4d2842b22a02eceda281056200977443b014cb7c553c0c4f37c9","sha512":"7724c45e0d944dce52acd806de62d5f67712c63cd378bf9c188c263e4ba099d3265f146dc64dfc7c5c14855eeac56208426a8e695ce90f9d1bce0994c167ddcc","ssdeep":"1536:O7J9ZfKM+gLhmy3Vqw/FArp/l3hrmQrLpbYqx12V/QK9IPMb9C:O77my3Vq0KrZl3hr/Yh9IPMJC","tlshash":"e28319d8bac174171ba2707aa67f2504a2378a5490058060f9e4d9e5bcf5b4f933bfbc","first_seen":"2023-04-02T21:14:45Z","last_seen":"2026-04-11T10:06:11.936043Z","times_seen":5144,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/lazy-load/assets/js/lazysizes/lazysizes.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/media-ace/includes/lazy-load/assets/js/lazysizes/lazysizes.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 27 Apr 2024 18:28:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"662d43d5-1cd4\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020432\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nUI5fexwUIm7HXopu%2FinH1TuYeDkyQ7k27ncIqUZ3JYFtXIDqX0qD15E3LDYONJOW%2BZ1FSziTENNugktpkjHgZRbKErGmndcjV%2FT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb81eaa4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7380,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (7380), with no line terminators","md5":"53b55154b4fa6fd1756393bb418173b2","sha1":"d441c7986de20fc171c4cf489974246ec3234bc9","sha256":"ff7f41fb46f8e9ecafe2c34d443535baec1dcf56cea4701d82e3e387fee68353","sha512":"de778af44eb1212fce14f19ee930a9706cf4955ba9683f061e1c78fb4026dd8525f53b192608e008183469605421411866b35be1764495b3dd5d8e7178e0328b","ssdeep":"192:sydOA8+vVJ2JmVvhaWu4sWAMfb3k4HKmVdVLRcoaqzaQOy:sy02dJ2JAhvunnMfb3bHKcdVjaqzaQOy","tlshash":"80e194ff76a67077a99378b4512f210f91327173be168825953ac4c22b3ce991137e2e","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-10T06:56:50.455383Z","times_seen":174,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/dist/dom-ready.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/dist/dom-ready.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 31 Jan 2024 22:29:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65bac9e4-1c9\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020388\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N0b0zSWts%2Be3vMMtUHNoBDrSsq1fyIg9uvE%2BYwHzJUoFewYzKA%2BvLLT62kR7r8MyixNrklx1zKxb70nwM0mD1ZY%2FiuoaK8K8ufa7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb83ec14c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":457,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (422)","md5":"e4bc17cc45ca91ab0f09dea134975c51","sha1":"3c03312717fb495c051d02a3d27ec0d8abc2557d","sha256":"5a43a22e48f94b7a45a9a9b1a107f197213b73307fdfa2e6b2daadab264f94d2","sha512":"f8e537a2168b94875bb7ddb9a20037c5bc79831c8b4e726f224f8d7c723c5c4b4512551697cf7bfb6ce4b5f8365dc1c027107ffe3435ea27c686f5ae96d921e7","ssdeep":"","tlshash":"bbf0d4705445edf071bc80e6442d53c1b5219039372270f14b8cdcb569e0f96127ede7","first_seen":"2024-04-03T10:12:48Z","last_seen":"2026-04-11T12:50:14.366136Z","times_seen":84033,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/dist/i18n.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/dist/i18n.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 16 Feb 2024 02:23:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65cec714-23b5\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020430\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JSmsUd3wLRnwBJSt3VHhrB1PYADjH9aKfSmobriqsRcve8chEpwv6eMtkRU5DmVSGgWHLs48zvoYgrFKKoSu85CpXFIhjteOO8XU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb83ec24c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9141,"size_decoded":0,"mime_type":"application/javascript","magic":"data","md5":"a8127c1a87bb4f99edbeec7c37311dcd","sha1":"9997a1745f48bdd233dbe9bd8164daa53eba105b","sha256":"f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc","sha512":"aa10ddc5b29905c60a058faed3f5f195f7577ceac46489e02461b5135732194daa3aef4aa473127bf8c753312e02074cfdac8d0f8f0cc8aa544c7f8e02bebd08","ssdeep":"192:s6zoFrnW4iaX3LzDk1jpJLB2hlq717+3uClD2tFtJ7bykd+SHS+F:s6Udn3LzoJphH8uClD2tFtJ7byTwtF","tlshash":"8612d8ac30deb021239a11e1586fb101f13aaf6532d99ce0da81d9e57db19c960b3ff5","first_seen":"2024-04-03T08:25:07Z","last_seen":"2026-04-11T12:50:47.362261Z","times_seen":238551,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/vendors/magnific-popup.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/app/assets/js/vendors/magnific-popup.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-c186\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FMShYOuLxTDeeLRaf5pPGwoJLRci5YG8McKxtSqtSwWW7JBKO1phP7m05JA07%2FOwPiAyvuw4ltR403LAX2HiuGHoxBJkPqb5Khiq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb85ecd4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49542,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"25b9d9349c4b333a0219e6d7b8a7a4ef","sha1":"41a606fdee797aa9bd43da637cb082b35da136b3","sha256":"cbd6b4b5c894bc8c0d3686bab85d559bc85e5cba069cdbab211c5c5057017c16","sha512":"f3f328cd7bb06bb415974e7d71b870be1601c2525e6a8b0131e396950fdb54bcc03eee62fb8e0f0f9c310b4a076936e4f566f014eebd0b30ed512b39b0d3821b","ssdeep":"1536:muv3AJEGnbo/murRcIrrbB8ApdQ2Dx1RO:mtznbwlR+2PRO","tlshash":"d92330d4f39d2157823632589d5e20dc2a7ce032d9128cafbc9e616824d897d83b9f3d","first_seen":"2025-02-22T09:08:38.876583Z","last_seen":"2026-03-31T06:48:54.119927Z","times_seen":63,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress/bp-activity/js/mentions.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.099Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress/bp-activity/js/mentions.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 25 Sep 2025 03:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d4b732-a5d\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QlTEHrKiWmIbP6daz2Ruh0gctSF0w4eXoe%2F5UbX%2Fb4%2BKrzQqM1RgVZONpMkjW4ziCz%2BJW0Udf8kqKa4l5vuXK22s6QshwNRqE7d7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb80ea64c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2653,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2653), with no line terminators","md5":"f8ca0594199448b342e8f947903570b0","sha1":"01b801d1728f75df0f3cef84db8a9c10c75bd840","sha256":"06a13f10bb4c8c4bd9525472d9cd98338e77a9090bb8aef8b60c10dea5a09f5d","sha512":"c70b9907601285add0742c0c365dc495bb5d076941a7e67b0678b81fbad245a20d27955a26cd6a73653bcace2d0ee1b384b05af3ef144aac15b5a14ca50b50d4","ssdeep":"","tlshash":"a45141c478946012263330e596a7230a71b5a868b1038888f2f64cf97d78dde75b7efd","first_seen":"2023-03-09T17:28:58Z","last_seen":"2026-04-06T00:01:23.23597Z","times_seen":100,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Red-Bikini-Teen-Goddess-Creepshot-364x288.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Red-Bikini-Teen-Goddess-Creepshot-364x288.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 29535\r\nlast-modified: Mon, 21 Jul 2025 09:01:50 GMT\r\nvary: Accept-Encoding\r\netag: \"687e01fe-735f\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 158852\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mX5fUU2DaEnbST4bnS3azpJbCQ8bsmfG8XB4IwSr2da8benTzAbRSDtr73hLulXaNHVyZo6rltuNQbankg17LHAeagtFPZgry%2Fkm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbf8d474c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29535,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 364x288, components 3","md5":"1d046c15edad4b0110233a5073280599","sha1":"cc2e4ce6cd6f57ecbe146d781b93217277107fe5","sha256":"1bd383831a6cd0af542c38ffc06f0c18becfbdf06db1d399ba084a29f78f303b","sha512":"2fbb6900112423e804549d4f2dc2fc0b5ed6bbbaedd27089d3d11bca7e46cf01d775e96e1a24e00cd85601d2aedd86274179ef96ef3bf4c0cfe4fccaabfc9d82","ssdeep":"768:XQeSR+utKJ6Xh6IMmc3EJ/DynYgRKPZ66:zyFo6XhMtxMx66","tlshash":"3fd2d1e4b1caefb7998af6994462cd6383c8a10b0d9d03e690e378f3d5f49730559124","first_seen":"2026-01-01T22:57:26.490421Z","last_seen":"2026-01-01T22:57:26.490421Z","times_seen":1,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Touch-My-Ass-364x604.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Touch-My-Ass-364x604.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 35476\r\nlast-modified: Mon, 21 Jul 2025 09:03:27 GMT\r\nvary: Accept-Encoding\r\netag: \"687e025f-8a94\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zzNU3obDDzIMoGTgk957elaaGj4Jrza0hiCDYZjtcpn1asUbVl5SMUskrO7gtIwehs4gNmFm%2BRz3ZwXtFFHwcDxSttaMW0rxCvfB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbf8d494c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35476,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 240x240, segment length 16, baseline, precision 8, 364x604, components 3","md5":"b4420424ee301bd3877c6dde631a6d64","sha1":"3196782cd54933a6cf7e076e4eb6783af7973c25","sha256":"67298b38d6d8b45052f8ea76eeaba39bb3dad97827c55f2b19c1d936a544a3f8","sha512":"a05cae0c481c13f5c6382ff3c299d6cc1f13f5df9ce727ad8179a3921a1c18aa26bd60a04f745d3256e5481a0cf83fb1f99189544d553d1193a19f8d4322f3c3","ssdeep":"768:CBpN0/XrLPw30efpA4ZFTSrFRsIdbjUkqLJTxzBY3R10m319BUFH:mNE3PwDftYRsSjUkqL7BY3vL3S","tlshash":"4ef2f1005890edc7f5bda76150d51e2ac8e93a9d26bdc6e3bade3eac1531844fd24e40","first_seen":"2026-01-01T22:57:26.492639Z","last_seen":"2026-01-01T22:57:26.492639Z","times_seen":1,"resource_available":false,"data":null}},"time_used":740,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":498,"receive":242,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"4.adsco.re/","fqdn":"4.adsco.re","domain":"adsco.re","tld":"re"},"ip":{"addr":"162.252.214.5","port":443,"asn":53334,"as":"TUT-AS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.514Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_RSA_WITH_AES_256_CBC_SHA","key_group_name":"none","signature_name":"none","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.adsco.re","organization":"Adscore Technologies DMCC"},"issuer":{"commonName":"Sectigo Public Server Authentication CA OV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 15 Sep 2025 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"EC:13:B4:EC:A8:B2:CD:2E:12:E1:84:0E:E5:64:5D:88:D5:CA:3A:59","sha256":"C9:35:54:5E:EF:18:4E:21:62:7D:1D:23:55:D2:B9:CC:68:48:01:7B:AC:A5:8B:D9:3D:71:85:DC:07:17:02:2F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 4.adsco.re\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 01 Jan 2026 22:56:51 GMT\r\nContent-Type: text/plain;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Methods: GET, HEAD, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\nAccess-Control-Allow-Origin: https://xcandid.vip\r\nAccess-Control-Expose-Headers: *\r\nAccess-Control-Max-Age: 2592000\r\nCache-Control: private, max-age=300, immutable, stale-if-error=300, stale-while-revalidate=300\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":45,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"5b41cb22f84f645a103acc7bfbf084ff","sha1":"bac3967b26d5ec4a0d09a580714e8219796816bd","sha256":"709f0a0dfab9f9e074f4a4a348dcb09150838284d21e75cfb9e5ceaeeb2054bc","sha512":"772066ed1119519a19884fc94de2c9f2cc538b4528d9e2651a89b93d65bd4000b18297bfbdd8903b65146858935d33cac048c321dad2ea4f1f84ca6dd9b7d98f","ssdeep":"","tlshash":"7990041154441d34dc45470c4f0d0f0553dc5153df377374ddc50f0414531344141d00","first_seen":"2023-04-05T06:05:36Z","last_seen":"2026-03-30T19:07:46.969854Z","times_seen":25700,"resource_available":true,"data":null}},"time_used":205,"timings":{"blocked":84,"dns":1,"connect":25,"send":0,"wait":27,"receive":1,"ssl":63},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/jquery.magnific-popup/magnific-popup.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/snax/assets/js/jquery.magnific-popup/magnific-popup.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Thu, 09 Jan 2025 11:50:27 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677fb803-1b27\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dX3aq7kw9g%2BLtErhk9V4bEiCTkkH0COzgv3BiURkFN87%2FmUX%2FdfPC4pm6DBz1yHnQ0nNpsf75auWTmXNMa2xDLE%2BettqkGihl70n\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb78e7b4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6951,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"30b593b71d7672658f89bfea0ab360c9","sha1":"d6963db6faa9294387bb3175813a61bc3f859437","sha256":"45d1f5f6cf913746c45dd697b1a8f3b719c02d8b3f678dc7fc2766d54e1aaf6e","sha512":"58440dbfd777facab21e3aea519a1b0e11404590e4a36c2959d7dca6fe3896cca9b12b8c3b490719ddcc43caebb019ff41adfd5688e985d53a08c92925498357","ssdeep":"192:hRQ4fS5bzRyIy++mcS3n2s96/LEpeXHFykgxe:Alx3pSFh","tlshash":"a5e11bd39fb22305e525e9a8a657a76973120013e70fcc6bbfd12448df8d7c942a3b85","first_seen":"2023-04-05T05:38:02Z","last_seen":"2026-04-11T12:53:00.497396Z","times_seen":21782,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/ui/autocomplete.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/jquery/ui/autocomplete.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 17 Jul 2024 03:30:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66973acb-2158\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PXr23y7e4qyV7u%2FdvC0TFd7KCZM0y2RDsS37RxtEQpwhXI9aKH9iovVTdbwrjrTHZtdN9cEpRPV7865HH1P53J8B6ChFBa5X%2BAQ1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb84ec44c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8536,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (8349)","md5":"6a53e18a345b37d4f72262a071684e79","sha1":"7269f0f9a41ca95df23387e1c4dad415f0228979","sha256":"3ab937ae57ef4a48601774b6a0cc701482a5c8bc126fcb677db4842b3a3c0003","sha512":"7f1b7ba5ebafb6e1cb9791ce8a0ad6eec1a743e6b15ad3e2d05f38ecf9a7f3437e41f398d3a91fcfbd294073cae25c4e4f6b5fc96526828071a0fc5ee0327b78","ssdeep":"192:7r2AeY1jWBoYfgZn+gSEmaAGCkHjpXCNd882E9cNS/JWmx:7r2AeSWBoYfon+gSDkrH1XCNd882E9ce","tlshash":"8102845f365a6a4156efa078616f324b623a20aa5801815cf47c9fcfad3ce1432b7d7c","first_seen":"2024-07-17T06:42:32Z","last_seen":"2026-04-11T12:29:01.5714Z","times_seen":12401,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/front.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.127Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/snax/assets/js/front.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Jan 2025 11:50:27 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677fb803-12dd3\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ud%2BmJIL%2FJ94z0UV9G00SojwwV%2B2MiQHDHQDaWObfxK%2FD6nYvzRzTrgQ%2BaL%2B5vhfmEEsIoIkS%2Ft4NMlno4dGbxpsu1BoOuBYyTnYk\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb82eb64c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":77267,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"983a8ff496cfa2812a494c01309e745c","sha1":"886e33cd9d84a51edbc2271ecd6d8dacbc6bda62","sha256":"9bf6fdc5d560b08cfe28b39afe13f4c3a946b3fc3f4fc02591552a5bf1443d42","sha512":"91d0c3dd0a8f2a8f50b55e1f1d4c7219d77440d0b4edbc02bfd6ef123dc1e29a708de7ba6873ec1fec28a1d52ff1eff9bd901a25cd7dba158e8f08c2ced211ae","ssdeep":"768:PvF+KE+FLedWqeIGV9/VlFA/wdnohtgYVlSsYXTjBr0bxRC/uF0nvf29U1S/bofW:PvFRvQSbvBu8azWMe5AsnS","tlshash":"c7735f0d74f72ca11a3b347f8bafa5c0656280532044ee193c5d73945feca689276bbe","first_seen":"2023-03-08T00:50:49Z","last_seen":"2026-04-10T06:56:50.423962Z","times_seen":103,"resource_available":true,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2024/04/output-onlinepngtools.png","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2024/04/output-onlinepngtools.png HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/png\r\ncontent-length: 4992\r\nlast-modified: Wed, 25 Dec 2024 11:05:19 GMT\r\nvary: Accept-Encoding\r\netag: \"676be6ef-1380\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 5310851\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=18agFX2eW3tFyiQ0q1RFdl%2FTn84k2pEJ1ORL%2F2SPWsdKqPjU0P5FjTw77Y%2FU1UBovtz2J34jMuCPWfBU%2BdOj7eOwlf7VmtlXE8iE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbf7d424c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4992,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 299 x 61, 8-bit colormap, non-interlaced","md5":"9c07760def3a96ad0a56b462c244e38b","sha1":"e2c6137390e09a5634bb8286a2cb19c4b08b9fcb","sha256":"d1797dd3985c583fd51a9039b23283d78927cae9ac531c697e752a74131147a5","sha512":"202ccb8ba12ffafe45d7d5e537f9c05a9eee24caabed50f3141ac26b4945167cbeaf66ab5095a726361019de2ebccc51756e6ad8f6c4fb2b0425fa24401ce86a","ssdeep":"96:47FS50ymesruCHXqyszeQyToFCIdiFnfNR9CSG5AOw:47FS50ya6l/8osFFnFGlaOw","tlshash":"0da16df11588199fd6a52ebc3988ddfc0028fb3df800874e3b1974d182276ac7ba8265","first_seen":"2025-06-25T06:21:17.776331Z","last_seen":"2026-03-26T02:35:10.530959Z","times_seen":12,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Tourist-Teen-In-White-Shorts-Cameltoe-364x278.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.154Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Tourist-Teen-In-White-Shorts-Cameltoe-364x278.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 30885\r\nlast-modified: Sat, 19 Jul 2025 11:57:57 GMT\r\nvary: Accept-Encoding\r\netag: \"687b8845-78a5\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 776672\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ATnBTxyspSCPQYxw8JnR8sQpJ5NKdjmYs8vgKOQtqbbgu7xcZU4jH1wl6wiTe1aqeDYhnfXsUfi%2BuAAWPf%2B5wdrViQHWoOqHvC4H\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbf8d4b4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30885,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x278, components 3","md5":"658b6a8388dfcfb7606921862dcad449","sha1":"fc393b6e8a2ea436c3aec14cba9ca5c309bf13da","sha256":"52efde0272ed60e631cd3880039640fdb78ca281c8d2ef5b5582ff5d0c4350d7","sha512":"50afaa729090347201745816fc08309f8e7ed5bcc57906158bcf0bd27d9fb111d7e4b1a17ac184b86e73c03ffb818463a00cc1cfaf0e8bc8cc3d3ead64f095ec","ssdeep":"768:y39IAc+uE9og6q/3EgZtJnTEMnsG3mFU1f2Y9T+s2l2:stc+lB/vJnQMnj3rOATb2l2","tlshash":"ecd2e17fa11619ecb3eb0a4463819d7f91ed1b628bb77bc437eb26a41701b5348613c0","first_seen":"2026-01-01T22:57:26.501804Z","last_seen":"2026-01-01T22:57:26.501804Z","times_seen":1,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Pink-Bikini-Teen-Goddess-Creepshot-364x258.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Pink-Bikini-Teen-Goddess-Creepshot-364x258.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 26982\r\nlast-modified: Fri, 18 Jul 2025 09:23:28 GMT\r\nvary: Accept-Encoding\r\netag: \"687a1290-6966\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 1218082\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wym5pKhVhhJdSlZLk1WlY3hr6adU4yY9kRCszKCRbPlI659VtBKTYOC7bPLLBZoc3RMcz0aNqK9n7A8oa3OgUP8lDy2HcFh5NMJA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbfad534c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26982,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x258, components 3","md5":"b5a50806aeccd442a7bdb5d5b4054588","sha1":"201a4713f2668374cd30cb64bd977a59bf8f8d9e","sha256":"2b9c959aad6dbbb807e419c02a064c359d3c0ddd9ac6b01800b901bbd999014b","sha512":"96c5bb155a55de270a62b5265590c01f39f3091cca573ee6de02e86aeb135fbdfe844fa342a6635bfaea3f46de3f052db3466197427ff3e27542a20b113205ca","ssdeep":"768:z2PIIcisxv30CqTmmizHcA87uCTJ2Uu6m:5DOCv7zHzkpEz","tlshash":"88c2f12601c1ae9a75783c72dfd39844fff8f7464e9c602469b008f268951b60a6fe93","first_seen":"2026-01-01T22:57:26.504121Z","last_seen":"2026-01-01T22:57:26.504121Z","times_seen":1,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/comment-ace/assets/css/form.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.994Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/comment-ace/assets/css/form.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Tue, 18 Feb 2025 09:12:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b44efc-16cd\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K8QepbyzJTdBUBtfREepsZRuRlI3zi8VO%2B4t1twOHAq8f4iOBqTwe%2B5AIk1W%2FQDUPxeccAMhulYuPji%2F0552LoO04uStJaEXi8rC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7ae824c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5837,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (5837), with no line terminators","md5":"48d6e2f5111fb09a2c35e8c73552eca4","sha1":"e77648a2b94a48c96b2e3b1f36e8f8f69613a9e0","sha256":"0b004a963f19689b21164d906d67b69310f39c7e97126c40705afb07f3283881","sha512":"0abea58538d7a69b554a3624a01f60d1faeb640d5ace723c946314cb706b59c430488ab8faf86fb838e74948b0116086fb19533a1246dc90df3520088f25f76c","ssdeep":"96:a45kDSg2fWLnX8C6ccutNFjFHFW8rdBy5t41rtbXYlKOKkjLA6IXQHimn/BAmbuZ:a45+V2fWLnX8JccutPzWDtibXwjLxIX/","tlshash":"3dc10c9941e82198612ff150adc6978a3128c716d3134cded7ee552887cffb21623b8e","first_seen":"2023-04-13T05:49:11Z","last_seen":"2026-04-10T06:56:50.469465Z","times_seen":52,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/css/9.2.5/styles/original-2018/all-dark.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/css/9.2.5/styles/original-2018/all-dark.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Mon, 09 Jun 2025 15:19:10 GMT\r\nvary: Accept-Encoding\r\netag: \"6846fb6e-33b90\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 2382329\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MYOYkPlNHBbYWS5m7TLqwwPrxM6tRF6caNw%2BSKB2LlKPzKXuZ3ogUgTH6ZrPSer5fEHEY6KGnKr6Mgj10EHkc5JuLmCD5cA2D3gt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb79e7e4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":211856,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"ee51b4f19d55f13a8db3074a2365b8a8","sha1":"10243ddf937006cf3cf8818ec6525c6e65ae2ad9","sha256":"aa5fdc1f8de25ec372a845bd3ab88b8bac8a68c73ce602d2a700f8cfb212fba0","sha512":"48c1448dbf42a43d6c61b263a6621f4fe042a724ee6844262434ece7c4b223f4c8403d51e7086124d7ee6f6cf77b56e3e9fdae565fe4574dd34a26b842095818","ssdeep":"1536:H9CaewranYOFKa8Buj7SsMuyOjvHfhplTWup2tYxj+/P1WVoRGML40OUa3/aP9zI:H1+xF/BCq7ylubDmv/EB","tlshash":"8b24c871adb1232ca06be3129ad172da3624c882e7434edafc575b15cbeb6c51133b4d","first_seen":"2025-08-31T22:10:51.523202Z","last_seen":"2026-04-07T06:08:43.032493Z","times_seen":12,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/matchmedia/matchmedia.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/matchmedia/matchmedia.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-6a4\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 5310852\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FpDN5w4BuZ2vjLvTBrL9ydoMAECCI6NWm%2BVdhw3NsSdL6AwWLYqKmfLG0Db%2Blf3%2FWJuPxf7ocx88oUu%2FD86C5MpxrmDJf1RgIVxN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb82eb94c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1700,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"89f369588d629240d6a8d4f8788490c8","sha1":"fb014487044fe7f608fa3e19e868ed5f9c41aa00","sha256":"76b8c213b84808d8f2986bfa38e79e3f2d1a94f065e517a143999b198abd8bd6","sha512":"3b56e247349c10375e3bca06b1471ede80af199f9148d88a4b2cd488a8a25bf70773c998c5a744562f01dcc27ec116483b38816d345a06b81233834dd5798d30","ssdeep":"","tlshash":"2f31103e586a6016691369bad3afb0887d17853b1318f801bcaf47701fa2e564174ff4","first_seen":"2023-03-07T01:11:51Z","last_seen":"2026-04-09T22:09:23.028638Z","times_seen":1383,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Cute-Track-Teen-Ass-VPL-364x372.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:52.387Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Cute-Track-Teen-Ass-VPL-364x372.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 22159\r\nlast-modified: Sun, 13 Jul 2025 16:17:01 GMT\r\nvary: Accept-Encoding\r\netag: \"6873dbfd-568f\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D82L1H1fGyRz7v5eo74RIrejAM9CFHoj8fA0HpwFiC0lvujA9sAvUYFcYSSJeiiPG7BzSBZAFZ1ZtGONfdtQrTQt68YJFJZe9rvr\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc76ea24c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22159,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x372, components 3","md5":"ec2981757f377939b50731e8712589e1","sha1":"64c7b879920995c7f8a192465fea51c26de79de6","sha256":"af3d6e0a1f6537e341141ec2116c06abbc0fa8744c1f9f81198415290473b9de","sha512":"5d467236288c4e112908c4ff688d8e98e12a40cf1452b5c168415e58f2d34b0e144d08a3ed81406ff6dac7a19e2f2a1ef84a84c46f81a4444d5841d21207a186","ssdeep":"384:rrgiLhfzs5HoKb2+uAfNMJBd2mMZwF8gvP2P4QEjkGfdEMNg3MqGAD4oOFDhhGgO:HBLdJhAF6zBMZwFjU4QEjkKECRAUJFDi","tlshash":"6ea2e05931085e11724d2fae4351bcbc22ef96e608e5d7fa8b28dce17b259f3e012585","first_seen":"2026-01-01T22:57:26.509Z","last_seen":"2026-01-01T22:57:26.509Z","times_seen":1,"resource_available":false,"data":null}},"time_used":616,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":453,"receive":163,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"adsco.re/p","fqdn":"adsco.re","domain":"adsco.re","tld":"re"},"ip":{"addr":"162.252.214.5","port":443,"asn":53334,"as":"TUT-AS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:52.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_RSA_WITH_AES_256_CBC_SHA","key_group_name":"none","signature_name":"none","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.adsco.re","organization":"Adscore Technologies DMCC"},"issuer":{"commonName":"Sectigo Public Server Authentication CA OV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 15 Sep 2025 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"EC:13:B4:EC:A8:B2:CD:2E:12:E1:84:0E:E5:64:5D:88:D5:CA:3A:59","sha256":"C9:35:54:5E:EF:18:4E:21:62:7D:1D:23:55:D2:B9:CC:68:48:01:7B:AC:A5:8B:D9:3D:71:85:DC:07:17:02:2F"}}},"request":{"raw":"POST /p HTTP/1.1\r\nHost: adsco.re\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Length: 3021\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 01 Jan 2026 22:56:52 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAS-P-1: OK lon123\r\nAS-P-2: OK\r\nAS-P-3: OK\r\nAccess-Control-Max-Age: 2592000\r\nCache-Control: no-transform\r\nAccept-CH: Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Full-Version, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Device-Memory, Downlink, ECT, RTT, Width, Viewport-Width, DPR\r\nAccess-Control-Allow-Origin: https://xcandid.vip\r\nAccess-Control-Allow-Credentials: true\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1212,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with very long lines (1212), with no line terminators","md5":"6b657f37f49ef014fdccd8bcc6458c78","sha1":"c3200faa9b2e98499eccc7879b0a5abcec3fdb82","sha256":"013d071274d8c73611997e74e8ad53fd45e4f62c342f807475ee0d5b5750e414","sha512":"0184050a55eebda0f618ce98db64229113a2a604cfaef446914e6f246499ea4114c73312a23f8356c0d49fae8e4cac412a0e2f4206a7d2ff1165cc120732e3ec","ssdeep":"","tlshash":"0521b725cc2d9e683750c946a7896a1f7ca4e0bf8e33da725f09a0354865845c2ba910","first_seen":"2026-01-01T22:57:26.511205Z","last_seen":"2026-01-01T22:57:26.511205Z","times_seen":1,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":87,"dns":1,"connect":27,"send":0,"wait":47,"receive":0,"ssl":56},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/css/9.2.5/styles/original-2018/mashshare-dark.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.011Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/css/9.2.5/styles/original-2018/mashshare-dark.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Mon, 09 Jun 2025 15:19:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb6e-1f8f\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020400\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AlktH6FhdvukBunAtC2%2BfekE1f2YG%2B0PHU5whOs7qmy2CR3CMZmwOR35pTKMtEA7AqkfLOFYG3v00IO6Pf747KyXcjZ0O0PEa8hu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7ae844c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8079,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (8079), with no line terminators","md5":"e8bb6780c07cc43e0c2dfc233bebbe52","sha1":"865cf4e7a093c6a821d504b4726ee0351561dd22","sha256":"62d47db79ccc666b7f8f75e98cd081ba8d79d2ac72317539a6460032f089462d","sha512":"355867ef1298854571313e718442ceb2df3e97c7b5569834af0fa9f0856ec276e8f6ef4fae8bfbceab85b45a467b54a81c9f2838184efed8e7ac74c3dbe17266","ssdeep":"96:whH0NZKOA+daAGmV0zAtDYKH7PmMKISZcF2COXrNVJBRxlqeNMC:whH0NZKl+dxGmV0c9nKSEnUy","tlshash":"47f142e56d1421cca2fbf70b7af33788305c898293c2da8ff14b6511cb9b08b253a509","first_seen":"2023-07-14T21:48:40Z","last_seen":"2026-04-07T06:08:43.011248Z","times_seen":13,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/dynamic-style-1759920604.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.992Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/dynamic-style-1759920604.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Wed, 08 Oct 2025 10:50:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68e641dc-393a\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 5310727\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OnatGJljbkibeSZ5Fk51ThnezMUaa%2FW7Y7CdjfCe2PiU2WHPBHnUldPYoRmk18orGupejX1s3FehlXP0cD3rdOlZcqeBR37Ht5uf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7ae804c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14650,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"d04bb03699ef5aaa9303bb13fce3288c","sha1":"9de8a90e5e7ef6f03c80f2a1b2bad7cb6093ecd7","sha256":"d4b249fe33d7c5639ca1909faa042b61ddc90360f1c579d002b60ca6bb294d45","sha512":"bfd0a3a2bb7b2d93a1fe237e40307b679f7323c414de6b8d9e4a6f63b783e7039afb1de72f937869a65438e3ddcb3f95d482bee1ac56a51ba01f929add911c0e","ssdeep":"384:olaU7klFft264EWlmuJ0dg2W4Tpb6DRVDll5P0arth5H+xujuO+aYlow/wFi4gWc:oaUYlFft264EWlmuJ0dg2W4Tpb6DRVDy","tlshash":"fd62f075f2bf8257e513129c2608f8db4b68bcc2ec519fa5f1bc9424a1c61e425eb7c1","first_seen":"2025-08-31T22:10:51.525166Z","last_seen":"2026-03-26T02:35:10.495074Z","times_seen":11,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress/bp-core/js/vendor/jquery.caret.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.090Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress/bp-core/js/vendor/jquery.caret.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 25 Sep 2025 03:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d4b732-16e7\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nH5m%2BQg82qtxSpGluu%2FGJ2kodYarqrbeR6uHnSvNiQx2Gm9QcpHWasVNxIPlDO4NYWPjy8uCNJUBXeF9Iek989%2F0AwNR%2B1FvN6Em\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb80ea44c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5863,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5863), with no line terminators","md5":"a423c4df6060f8ecf83d4471cc110131","sha1":"71304baae7622a2cad5df690d603659d91b634ec","sha256":"7a0a2f2f1e71dd7d86c3a2474d12beb7ce5415e968b1e9c1a1cd92b226532d1f","sha512":"fb41069a7af757cdea5a706f0ab999baac1d4d23eadfe357d1bf19a7c6e30ca9cf735e93249dad5585cc76067b420d94dcbf5a8cd994e8802c0854900ba07341","ssdeep":"96:PHuU2eUD4Vdq6R9v71b2+YSuMYwpqYheq0PQqb7y9JrXU5A11RTBNZ2c:fuuvnuhpsqbezr1Nx","tlshash":"a6c165b6b1407422d347b16aa1db0608d1366c5ca647425cba9cd8f2bc7554b6233fba","first_seen":"2023-03-09T17:28:58Z","last_seen":"2026-04-06T00:01:23.295589Z","times_seen":101,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/lazy-load/assets/js/youtube.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/media-ace/includes/lazy-load/assets/js/youtube.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 27 Apr 2024 18:28:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"662d43d5-7fd\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rckqpvux2pj1nH6Snza%2BUfnapwsKHIf9AeHBslbnrLkJsabVb7XzEg2%2BxULq%2FAbfC5bG%2B9DKmsenOv9fE4oZ4HO3lqr0T8kQ%2F4ky\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb80ea74c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2045,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"d5f0c2881b18809265062c50de00ee80","sha1":"34816fd75e6f8745811a6ccdcbf86227c900e78c","sha256":"8cc5d1bf80f7a4a5acc05ae067f695460f9f12614e8814c1856f49d4c4e7d883","sha512":"2b8fc8c6357b55b2d2a08abc571b39696ea5f5dd51e3081494fe4c97c61edbcb66d1390d8feff685cd810865f5595a1a71db8bede0e0b0c302f395b65cf4e08e","ssdeep":"","tlshash":"3e41995d79bb2180693b38ce9fef50802095902b2040cfb4bc9d86857fea21995647ee","first_seen":"2023-03-07T13:00:40Z","last_seen":"2026-04-10T06:56:50.474081Z","times_seen":116,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/back-to-top.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/back-to-top.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-5d5\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020439\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x0nFifXwwMEOv6uI3tHFlrXgj7uVVNwO929qRz6cQ5MWvEoHhwzUFXW%2BL6bk0k%2Fn52YzOVnzMAsHRo%2FfT8Luj%2Bfo3FL1AcHNPJ4x\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb86ed34c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1493,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"d674481513d4b30efad67303812f94f9","sha1":"f44bc8e490088e3d56137f2d0cbcf7eb3bf52921","sha256":"b044d89f7a88e52da5ba2345438abc81c7fdf33eefbdb8e458bd5ce102bbba7c","sha512":"8fab81650da62bb0f122c30af525f3a97b58883e7a632204942bd231dc7fdaf854bd7ae46d99a1c964224195b59afe25b8f839340dc415669be3daa8a1446b5e","ssdeep":"","tlshash":"e231489a64f1105155aff1376baf475834387007a586ce60bb0cebc9af8503a9f17bac","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-07T06:08:42.996541Z","times_seen":495,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/modernizr/modernizr-custom.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/modernizr/modernizr-custom.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-1b70\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020432\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YtSrN1oMmpyLOsd0Y1g2%2BgTKrc0%2Ftz8FUqEBK%2F8jwXucZ1qg6hy0z1njmKGSUV9WFu%2BsQiLJYKIy%2FuXRvoStGXb%2FXmoDakrlUR2k\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7de914c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7024,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (6889)","md5":"be867eb3c95205f143aecc1fff7d4df6","sha1":"31c16e5fdb15452c67a8044798f6380be681888d","sha256":"2e66ce2eadd79bca0080194f87dbf2f1d01bbf996241615de43d94dfc7eb1d0d","sha512":"5b88db46f2f8ae0ba5339aa2a5d2dd25c3ae9bbbab5763e5de90d2cde9c3ab7e9867040bd787a327349f8fdf6223449cde292f558ce40168c88e3afa627b6759","ssdeep":"192:R4T/2BQ5b4NW1RM2HbUF4Sjy9kAuBnkSOVBB:GT/2BQ5bKh2HbUFTFAuBnkSOVn","tlshash":"0ce1c5c971a3b17a839b2167507f520ef8780e189e198414f069e8bdfd74de4537be28","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-10T07:04:34.759494Z","times_seen":613,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/ewww-image-optimizer/includes/lazysizes.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.071Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/ewww-image-optimizer/includes/lazysizes.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 05 Dec 2025 11:46:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6932c61a-4299\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 1181292\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tB641k9ZSH%2F7EZYnYkoiWsxDI%2F1ka%2BeCcNfDElkStTAPyczeTOee90xLMJkpvtj%2FgHnQudRJu1wX6XrHwXro6gusAjeqgO0yNPOe\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7ee9a4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17049,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (17049), with no line terminators","md5":"c318a761be370148448e70835907bce6","sha1":"04ddb20e0f1c9251b14fe09a8961c8df89e0f09f","sha256":"bc74614fa92f608c5a30942335391813a24d7614b05cca4c22649d9de4e09e4b","sha512":"9c5c3e3e82a005125732164f28fc49de2f9adbf880b84473416c14c2038b4eaea196f6bd2cc8f04a49b57cc775ccd7e46ee1510f12c9b2cfebe09d9ad6e4f956","ssdeep":"384:rQfPSEtTi+iguVWOHlDPSxV/Lqb88FXNlf2CsnmzV/GAeOvPC4N836qoDVTaf3Vr:rIbtTi+iguIOHBq/Lqb88Plf2TnCV/GH","tlshash":"d772e8ee320975b3a95720f1555f620bb2327437ad079820aa39d8e19d38cd66337e6c","first_seen":"2025-12-04T20:55:38.388983Z","last_seen":"2026-04-11T13:38:16.360165Z","times_seen":1480,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/jquery.timeago/jquery.timeago.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/snax/assets/js/jquery.timeago/jquery.timeago.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Jan 2025 11:50:27 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677fb803-1c47\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020388\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0cuO81yj9XbDWrhK6yPavsO%2B2RA0E38%2BL%2BJmYscT1v4aM2QZfJecHeuWBgS6qvWZbVBCer6zx%2FIqS7j9d0XUeDRY9OItyMtZaVTm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb81eae4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7239,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"80c1ddcdf84ae2b0d3a833fc079a0981","sha1":"a44488a43f08ec4068c62a2cae036527788112c8","sha256":"c8a2ce0ff737cb50745bcd2b534fa03c462d897895dadb9af2d46e37db45c2f2","sha512":"f788717725b0a705d7f3703b52c4f9ddec3f094d426d954f7a45643aa782a23d67ef59a227afb62a9645663c9a50d599dd8099a809b8034d77efc62ff598af89","ssdeep":"192:m8PNFHy4TqNEOhOBeJp20R73yPDijiQG8ciQIvY:Z1h9TFBehR2","tlshash":"12e171083ae62010a9a371b94baf8248b335d507644dee1175ccca902f2dc7d61faefd","first_seen":"2023-03-07T12:03:53Z","last_seen":"2026-04-10T06:56:50.470646Z","times_seen":590,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/css/9.2.5/styles/original-2018/buddypress-dark.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/css/9.2.5/styles/original-2018/buddypress-dark.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Mon, 09 Jun 2025 15:19:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb6e-49f6\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c0YQBI92gSbuq1IEZO1tIfFA%2FhrN6J7PFbq%2BgoSwoFEwp%2BTmCQ88x3rYsfUu1NJH6wKjP0jYklb7Tr9opHiIawEljI%2FDDUOwxftm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7ae834c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18934,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (18934), with no line terminators","md5":"28736ab8449287149114cdef66519ad5","sha1":"7c868a3b3dd0b2382e61cb395d0e144e93f4fdee","sha256":"b3628e45986376030324a523bd062c370913e883921073d0752e4563a1e6dc5b","sha512":"0d8d0c7496204af9963b034137481094b12a4ed6bb65eb67d762170dee02e1d903cec98124ef8d8a6007dc232e2cc187f6bc78e8603857a58e85c7c8bc0b2e4c","ssdeep":"384:joERXCfCuCBCKCxC+CPcjx5+EdHgeLAND:kERX4jCfOxUcF5+EdHmND","tlshash":"c282a62281b8436cb917e135fec663e577248505f9539febfcd54a3087ca19d2a33a0a","first_seen":"2025-08-31T22:10:51.516175Z","last_seen":"2026-03-26T02:35:10.451269Z","times_seen":11,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/gallery/css/gallery.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/media-ace/includes/gallery/css/gallery.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Sat, 27 Apr 2024 18:28:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"662d43d5-3425\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020379\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wq4VKgmNfGF0NGrSBuqfTpbgZsLs4%2FeIdPMDWZgzfeubZEdSAVEoHjh87HnU7aPD%2FNYtOxdFk8k4%2FMWtiLSEBFyaB7FiPB0nvzXR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb78e7a4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13349,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (13349), with no line terminators","md5":"76bdeb8fe685ddb32df3c23e86937422","sha1":"a5fab74bf3df8fb0fef260db1a6aceafce3d700e","sha256":"65125c9094777f67a9ff4142953b40709a43718de763e7fd23e63fa18d53fa79","sha512":"5342cd0393cc5b9e1f9079194087beec24e6e86d5db8259807077a55900476860232a3c566a474460c3e8dd7056f3fdfb3ba8e201cb3faec5857548bc50bcb4b","ssdeep":"192:nC+kmQWVXg2mmmjmbz6yISMl/Fd+AuxcffoxZ:CfmjmmmjmbQg","tlshash":"1652fc7e753923087297d70cfbd1e7f916a9f50266030ffdb81a293197c688109b668e","first_seen":"2023-04-12T13:31:36Z","last_seen":"2026-04-10T06:56:50.400621Z","times_seen":132,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/lib/media-element/mediaelement-and-player.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.076Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/lib/media-element/mediaelement-and-player.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-269cf\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6zOEWetlz6y%2FBNj9Dw5BGs0DcnOwCOegax4KSVAOnO9fbedU7kTsdb%2BjnEN49Ot6iHNw2lMYD%2Be0IeDn76aef0t29jnbOoEsEGhy\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7fe9d4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":158159,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65266)","md5":"cf5048eb309f9bf7144adf34d15196c4","sha1":"5a33b1cd4564701d762f57bd82c9f7a6484230b4","sha256":"0466734b731acb2709928a14d088981cb6ac5f0866c90236325a7f803ed80e56","sha512":"95fb690dab3e1ae3d2bd68b35ec31e17fbd5c25c3812f78e2349fc19c21312af491dc32732c0409b49c56a74576c746eeb6c81157734504c948e2a1a2b549b73","ssdeep":"3072:Li1bQPZ/PdI5FZx599ct6K2M/m2tATI1paT+BCq2hwV3EnWonWud2sw1A5vM9Lj+:LQ2tDeYdBG","tlshash":"0df31749714473b286c720ee643f1b1e71378e69d409d050a936fafa1eb4f8a502bfb5","first_seen":"2023-03-07T13:49:30Z","last_seen":"2026-04-10T18:25:17.431559Z","times_seen":218,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress/bp-core/js/vendor/jquery.atwho.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.097Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress/bp-core/js/vendor/jquery.atwho.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 25 Sep 2025 03:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d4b732-4d01\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020431\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iY6tLW1mb6nmQ7Ju4gr2XB1Z3raKqThQnGQ74EfzQhckol%2Frudxt0fOR46%2F%2FUnw20M7fsXbGQkZvr4KDqi461JXI4GHwCEfxukka\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb80ea54c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19713,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (19712), with no line terminators","md5":"e8fb1aecbc162c50b1aff7df861d12eb","sha1":"528038c8f6b12fb90cfda56682242c3636a2e921","sha256":"7b071a50bc10973296a71cacd0867be8143267fa197a7525d44a7fd97a4fb3e7","sha512":"1de2209bd7aa8b4242a23f25f312c554a2502dcc4620fcc41a930eb5267bfe3b8ca4e93fb85643455f8a255344b25e28662c7474bf42f2be931dc9211ea0ad4d","ssdeep":"384:yhirS9rIq4bXLkNt4jmallCBqIbPXAc2D9aY+pNd:TL2L9vAc2j+3d","tlshash":"cc92a59575a57022536162bc6227060ba33e695df50a81bcb6bcdcea7cfc848313bf74","first_seen":"2023-03-09T17:28:58Z","last_seen":"2026-03-31T06:48:54.160577Z","times_seen":98,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/enquire/enquire.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/enquire/enquire.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-8ce\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020401\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kv7ETnpSAhv6nICzk8EiG7Hl4xXf17UqWER8U3pa2S1E%2FoBaSYtIu8TpU1OxoWGkQ9%2B5tvmIACRlsElQVu8lhEP5kJ21uqelxuhQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb83ebc4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2254,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2045)","md5":"c22ea088390ceeb51ae5da21901b9df4","sha1":"2cb0ed3c356a9a2f41cf3b7c95e702c1856f5819","sha256":"324dbc3f38a9f0a20763e0c0d817aadea2b441e2b872b81c69f453857da67489","sha512":"96424868be720225136a477689b78c3fb214c8e4ca05820d70346a7c9dd72c6625a599b7d932590eb2f0996c50275028d387c68f0e6dc5c9caf37bdf3185e9d0","ssdeep":"","tlshash":"97410fddba99720162a364f2541f558f5673a1b7f00c409cf1a4dae5ed78a0d8a23f38","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-11T13:01:23.907864Z","times_seen":1150,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/spartan/v22/l7gfbjR61M69yt8Z2QKtlA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/spartan/v22/l7gfbjR61M69yt8Z2QKtlA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 33008\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 27 Dec 2025 11:02:47 GMT\r\nexpires: Sun, 27 Dec 2026 11:02:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 474843\r\nlast-modified: Wed, 27 Aug 2025 20:22:20 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":33008,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 33008, version 1.0","md5":"1e5b736dd0cb2251c20c1473fb84c1de","sha1":"d902711ad5237cbb0698429e1a420aab6552862c","sha256":"0e6bde53280ffff74447f376a66cd051deacd0c2295aea8d6ab7488d3fea19db","sha512":"086de6017072405b7386953edb2554c953421d295219284a9d772c7e98fc352feee0a3b08682850d039e8223ba1fa70890c24855bad308c580c1bb345ee7f44c","ssdeep":"768:BCBcWHlwbUwozrG29tx55MZ5tAZ+EksDZ1qWlzpZMHVt:QCWFwb5sjXBYEksDZ4JVt","tlshash":"e5e2e08c91acc132bec87cad0c456b5dc3823fceb1a5e2e068e16656b4dd854d671b7c","first_seen":"2025-09-02T18:54:35.598097Z","last_seen":"2026-04-11T11:34:00.487739Z","times_seen":1041,"resource_available":false,"data":null}},"time_used":196,"timings":{"blocked":91,"dns":11,"connect":7,"send":0,"wait":8,"receive":8,"ssl":68},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/gallery/js/gallery.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/media-ace/includes/gallery/js/gallery.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 27 Apr 2024 18:28:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"662d43d5-2ffb\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020411\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qHYEWTfGf8tSE2lY6na0nauZ8xkQ0NNzJhprQbDPPuVQXsJB5J3HWUXdfeoX4lUFTd5UnXyhgIwzXAQTpIDAJX5lpdFs2MtMlRnm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb81eab4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12283,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"4629222b871dc338c67e02d7089f0f5a","sha1":"51cd9b024ac7b73ebd96ddee52617e2debdefea4","sha256":"143955879d55a60dc7ecb3bedf93773f4559db893a1748a18ed7878a67ca2670","sha512":"dc28cb95d56c0a36298ef70e54195d8460a7829e25db270f81e7143f46df6942b9fed5ba7938fee0ebd8a9d1928e5fb2c0d01f3d9a1c1a3739b67aec4c178d62","ssdeep":"192:qbhUM+Rb4jWRHfHPHiH5Hc89HfHn9HIkSIZWlQT0qaiAU7WiCaCvYAWGOHRqjn1O:qbmbSYHfHPHiH5HcUHfHn9HDZMQT+UzJ","tlshash":"8342dc2c38f711b5a237731debffa47829bb7517a00acf60385c61805fd069056aa7ac","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-10T06:56:50.422936Z","times_seen":130,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2024/04/output-onlinepngtools1.png","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.926Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2024/04/output-onlinepngtools1.png HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 1340\r\nlast-modified: Wed, 25 Dec 2024 11:05:27 GMT\r\nvary: Accept-Encoding\r\netag: \"676be6f7-53c\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 5310783\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tx924tNKvOiip0PeJrVNuKDM6T9zhA0TuHzx3TG51r0VaHLZYCZ7BGus8o8NG6LpJWDHt6HQqAkyi44Ho2nseoqJOmUXknUotYa7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: 9b759cbe4c684c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1340,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 49 x 58, 8-bit colormap, non-interlaced","md5":"a13f67d97c341361a87682b8a202b382","sha1":"f8be984dfce18204127db5c3e20d99adc617bb3e","sha256":"d02f81360bac4455432a5f8b638ffce40e3162c1cced26f2210986e8bdbbbcc1","sha512":"b7b02fa94729e7ef2c11d190e43afffde84e5561c87f540faf3d3ffeccb7580750b7a129257b86af1807eb4441a90a82bbee347d4d6f5c5474614d96f0fe41b2","ssdeep":"","tlshash":"6c21c8a7d505fd7cd5b8112f4ed7b9a5cf5a87cb0362d22100d707b0a9153342115f14","first_seen":"2025-06-25T06:21:17.72983Z","last_seen":"2026-03-26T02:35:10.549704Z","times_seen":12,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qwiupo5vesol.n4.adsco.re/","fqdn":"qwiupo5vesol.n4.adsco.re","domain":"adsco.re","tld":"re"},"ip":{"addr":"38.132.109.126","port":443,"asn":9009,"as":"M247 Europe SRL","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.521Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.n4.adsco.re","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Nov 2025 09:14:20 GMT","end":"Wed, 11 Feb 2026 09:14:19 GMT"},"fingerprint":{"sha1":"FB:34:12:01:B6:D1:B3:BD:9C:64:10:4B:29:6B:C7:44:FD:21:82:69","sha256":"D8:BD:52:A0:9E:11:2A:7E:51:D4:43:1D:9D:F7:F0:66:68:70:DF:0B:20:4A:38:60:4C:B5:37:82:2C:42:01:6B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: qwiupo5vesol.n4.adsco.re\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: text/html\r\ncontent-length: 0\r\nlast-modified: Fri, 16 Jun 2023 08:37:42 GMT\r\netag: \"648c1f56-0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-11T12:55:49.320816Z","times_seen":13621212,"resource_available":true,"data":null}},"time_used":881,"timings":{"blocked":392,"dns":121,"connect":88,"send":0,"wait":91,"receive":0,"ssl":183},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/jquery.timeago/locales/jquery.timeago.en.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.125Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/snax/assets/js/jquery.timeago/locales/jquery.timeago.en.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Jan 2025 11:50:27 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677fb803-1c7\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 5310852\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5s03wdS3jl5BuQ78MQ1D5wTsh6W4mmFkHBye%2BMdmYzt6EsBV2iUlJ0FD8oQSTps8f1q4vvbGAmIB%2Bl5diu7JYzH1l6HIXrbTFC4q\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb82eb54c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":455,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"09ce1b88cf9cdc1bc8377780ef0fe0a5","sha1":"a07f6a4fdc9b39d5652449015ff018b51b6e1d92","sha256":"0284d42b43b431163138ad07c2e26fee046b82609761b503949c054fe67cf38a","sha512":"ee3c01c999630794cc8df9275869dcb4dc91a9a8f0a0c5f28d903e1e210cfc08877112e0b0e2159fa9af01113dc2800d5399921109265b95b9af2992c9270345","ssdeep":"","tlshash":"1df0a78dc944560047b58a5c61b306856364d177d0e17dba53c5ac017b4d65f10b67ee","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-10T06:56:50.389502Z","times_seen":856,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/css/9.2.5/bimber/fonts/bimber.woff","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.642Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/css/9.2.5/bimber/fonts/bimber.woff HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:50 GMT\r\ncontent-type: font/woff\r\ncontent-length: 11696\r\nlast-modified: Mon, 09 Jun 2025 15:19:08 GMT\r\nvary: Accept-Encoding\r\netag: \"6846fb6c-2db0\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 5310851\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aamb7f5Ri4Nso8A7hrEUScuIM64gswg6cFImTdEhAi%2Buz5RFQ65nc1AE32qNvVZqQZj7CR29YJc8GWeZPLaHPodtg9RZ0ZaM6Y3U\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbc79a34c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11696,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 11696, version 1.0","md5":"c268415894d13138a0d0e2f9a841ca8d","sha1":"b1486baf298b4540d42c57e566d094050fc38ba8","sha256":"693e2dd1818182a4c4d6af23d18118646a0aa250a9001c2e468555dcf653b982","sha512":"df422a6ca9fd429db0558b9c4afd85e7760e5f1a2d3e9260d442eb1d6078cb5a1cac2533bebda784d9a81daae700c1b2250b43851b926ce1ee428813b6df834e","ssdeep":"192:y1zT8ZGutI6ZABIxjIaAQBzAcwOntOhRZuQpP+JVdxqCqUjLHG2EP2DneKcpE5eA:yJUlImABIxK4zA7gYhRkQ5o3kdaLgzpU","tlshash":"0a32c07c8feb66f9c627d6f57069b48cb7030504381896c019fcdcc03adea8e59a1a76","first_seen":"2023-04-13T12:27:46Z","last_seen":"2026-04-10T11:51:05.845469Z","times_seen":672,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Bubble-Booty-Teens-In-Bikini-364x400.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Bubble-Booty-Teens-In-Bikini-364x400.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 35976\r\nlast-modified: Mon, 21 Jul 2025 08:56:56 GMT\r\nvary: Accept-Encoding\r\netag: \"687e00d8-8c88\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EhFkXFwOpEpfhYi8Ta6EBX%2BkB8Je8Ap%2FgJgcIvxi4Lytyjt8c1flMuw8oEHgC2ak8RVA5gq2VWLUxZkVWGMBprnMf65DHVXeRDqj\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbf8d4a4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35976,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x400, components 3","md5":"06eaaf75c6b441e3bd9aa328aec787f1","sha1":"1bd67164d8957ff20dfdd6a1b35c53f328655cd3","sha256":"d8a3cd17197920b6453c65067c59e4a2c5b5a10367d772fc4ba6731806baff94","sha512":"33c04538c15672ea0c7161d833f030eac0e2d78ffa9eea329378fff8c46b6379a2f1e71bb9cd02aff4e0df3b227e66828cdcaad44f54c710b2291131cbcbcff5","ssdeep":"768:iK8lP7smOzWTv1miqutGfOJYr+81Ntdkrz5nb4GwU04BF:iTtshSTF8fPr+YvdSZb4j27","tlshash":"aaf2f162795b62d07c8c0ea4ad7396ba82ccb1653406a59d10e32d87747ba4d1b1c0fb","first_seen":"2026-01-01T22:57:26.532204Z","last_seen":"2026-01-01T22:57:26.532204Z","times_seen":1,"resource_available":false,"data":null}},"time_used":684,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":467,"receive":217,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Track-Teens-In-Spandex-Shorts-Compilation-364x245.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:52.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Track-Teens-In-Spandex-Shorts-Compilation-364x245.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 15604\r\nlast-modified: Fri, 11 Jul 2025 11:10:39 GMT\r\nvary: Accept-Encoding\r\netag: \"6870f12f-3cf4\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3j5cr9%2BTs8QZwnmwT4U%2BbYUEhr1qaLinwCtpdtrjToKGexHXEGpdqBhWXchnTTGjbwPdLkY9%2FMF9jJ77%2BefXnHIp5E6yorFftwXh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc76ea44c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15604,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 240x240, segment length 16, baseline, precision 8, 364x245, components 3","md5":"af519debd346fa94254345dddc0dd512","sha1":"177ed7d707523170bab1d7910d42a7b782849419","sha256":"b2f6e520bb64a331dbf5a0e2af2324b2daf68ce3f840f5e79f6392bb9617569d","sha512":"6fe3252af98d1395ca3aa6c00553b887c7be916f5a362474c5ab75ed2af72217faa63e5a0af94a347cbc953845118b7275e13875903bcc92ff413034ad4aca54","ssdeep":"384:m2ysQPC840cKn4EM+3/lal3VusB5K+glwN:mxq0cA953tsFBOfCN","tlshash":"3962c00ad06258b3985e2f7f4f2fd52936843d122254162315f7cb3ad3ba4f5866083f","first_seen":"2026-01-01T22:57:26.534742Z","last_seen":"2026-01-01T22:57:26.534742Z","times_seen":1,"resource_available":false,"data":null}},"time_used":596,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":451,"receive":145,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/css/rtmedia.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/app/assets/css/rtmedia.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-d547\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0q6ZkVNH3KhFWtwgwBLdEGk9z9ZaNMS62gqJ%2FaEUQApSuRUjg8b6Qdw0QyUMdd2UPjzoK%2FIoQWe01fO8hgzYVkvNNNyd63K54S%2BH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7be8b4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54599,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (54593)","md5":"ca626e74d952b8b7ea5b1b7c996f3b4f","sha1":"b6daa0d52c53cd685f79c2f0bded55c6f93c3348","sha256":"e4e185fe88805c596b83c3375b26acc1c9f759aaec96802dfd2a72bca57f4988","sha512":"03b103cbe63a496ad631cf227a237bfa28ec865af378b1974865fc14c3e796e1f50f70e6a465287046b50cca45e8150de2a06ea5535cfdcf13332a4017b0a847","ssdeep":"768:tbRcuZ0t3DgYPK/67XoFDixU38R0/MzkJSbnC9vB:hhyD8ixUsR0/MzkAbn6","tlshash":"2733a6324650232ce46fd53af55e67dd3114ce13e5a3c6afbd1aaa68c2d52842323f0b","first_seen":"2025-11-26T12:06:49.209825Z","last_seen":"2026-03-26T02:35:10.487465Z","times_seen":20,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/assets/js/collections.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/snax/assets/js/collections.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Jan 2025 11:50:27 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677fb803-2582\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020426\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K6xPEphWX%2FPpwb1w8PaMLZ92qnJ45SlH%2B8VRpmuyHXZJh4XALfGbIja%2BgTvYvPDeSBmBlrbWVZ8dujm0pjPhKJb3yZJyVhLQwsWU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb81eac4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9602,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9602), with no line terminators","md5":"a00fd6dd5efd53a26e2371f5bb53d6f2","sha1":"602b11ca1782aad596d9932809d021e397bdef59","sha256":"5f0989a9002df46b705fb45e14d611df0d8ecc6f6ad2f6587bfe88c1adb0ed60","sha512":"c58632da8c048b85e5874f90630166ead20d82c7a0c905e475134bb53ae4f303430f0f6a9c264155c63e391855e92f56e77eace6fb6916cf6da84d0b69a1fa18","ssdeep":"192:dsAwfcmlfYzoJt1aCBPFImljFd8qftRlCf6fXfCBf9bf9fbRx9lDw9AvR2bnazaQ:dsAUlCu15FIyjFdhtRlaSPUJBFpDw9Ep","tlshash":"60121f4d350077b601eb713654ef459b2873a9b2f1854d4025bba6aacf7ca8d6033b2f","first_seen":"2023-03-07T13:00:40Z","last_seen":"2026-04-10T06:56:50.456531Z","times_seen":159,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/jquery.waypoints/jquery.waypoints.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/jquery.waypoints/jquery.waypoints.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-2281\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GeeT2VWJjrqPATGT5KMssEBa41z4xJOA%2Fc1RXFaTXi%2Fr6WhLTqIn%2FxCt9uu55Rc4E0VaxOc3I6JdhTVvwH1rW5vu5qHQ6pUJ7ubQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb83ebd4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8833,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8668)","md5":"43b1aa1ea2d73e79e9d45980c7920446","sha1":"1bef149aedeafff7a797e799cfba168bed0d6dc6","sha256":"9c7bd3dadf6edc19d3b8876a8e2b0b0ae6b54f403d7e987ec82b041128cfdd35","sha512":"a32d0d5ca42ddadaf3c4ca3a2570d8bc372a3494503e72f9e80043a0f742fafb083899d4f8e2ee73740fdd32409ec34a5d45d5a62b79c5160a4e28a3de8bfd42","ssdeep":"192:5BwzxsMCm1dJDl6hj8P6PEGnvfiZaLkYluY4pLyUJWZPeGz+nrFr:5BQoIJDlC8CPZnvrLkYluYTUuPeGzs","tlshash":"52026189750534221bdf90fad91f474ab3375828a80680bdb4c8d4ed28f252d676bf7a","first_seen":"2023-03-07T01:10:49Z","last_seen":"2026-04-11T11:53:21.923398Z","times_seen":6182,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/ui/core.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.160Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/jquery/ui/core.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 16 Apr 2025 03:29:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67ff2433-53d8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020355\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mi3rND1Bvj%2BQO%2BU1d7MLNKIHrSL8IIFVG0T0YUfb0qfkE3b%2BOu6RN90mSozeLIQVsWpeJiZ0FtLk%2FkMvvJ6JPzLYGerhR4i%2FUgBr\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb83ebe4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21464,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8189)","md5":"da215ae12b95b3aeeb2047667016c7f8","sha1":"480a7087aa74b5b47c47f05a11670e823a3ae4c0","sha256":"699210a5ed06e497b4730ec83bb65ac4c2269ae4a0ee8af3f24aae7ee5b66b76","sha512":"d256ddc828c06f7b84f7df706a4481928a186ea6d3e1358254a1ec02f403d72d2f3aecd682a93aad61b8f236f17dbcf7e6ca100f78c30a348682bf8ee125d8ff","ssdeep":"384:G/rsrDr8LVyraS3dtrqorqr8hrpCip8fuxNhlGX0CiS9rH/OrLrErJ29FkFvd:iS33ZdvK47kv","tlshash":"06a2d94eb246380586f7a2a5402f521fb132e25cb105c8ddf468d8da3c7eea95173f79","first_seen":"2025-04-15T23:53:17.313193Z","last_seen":"2026-04-11T12:56:35.108808Z","times_seen":224987,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/rtMedia.activity.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.200Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/app/assets/js/rtMedia.activity.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-1e3\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020442\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GNA5dreR79VDs19SKE5Nc1CagpB5yk00t1KvPU%2BaCONCgeW7umKZEDqqPOX88lfmx1%2B6n4iLBO1X2VR1jBeuujRvSHIZ%2FOjF21Lu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb85ed14c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":483,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"ce9cdeb4f10040db7cb613cf45c3ab61","sha1":"b446a76736c511c312f603ecf78518a5c394e82c","sha256":"c363181e68b5b45b6737fa393081226e8c36db5e8416590e5cccdc02f8fbeb10","sha512":"f9469cae2979020ca5cd87b6e2b401b037c0ad6d0e8c8c516a7b7f3330d7e9a0943acd5d5bbfebbf5ba087a3f7b36faa389e4ca04f6804eeddf417f08c87b694","ssdeep":"","tlshash":"2df05c5ca072a41545ef7268950be04de220c05312814ea13c8c82bc4f733286761f1f","first_seen":"2024-05-21T06:58:08Z","last_seen":"2026-03-26T02:35:10.540367Z","times_seen":29,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/ajax-search.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/ajax-search.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-816\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UaWUi3ZwZQ%2BHRccUEXtyA3b7Rf%2Fl8GgXXPo%2B%2BPj63bXlOu0SLxaCKTtl2I9AbGhwoOH%2BBlT81rySbrCgjOLMOacHQtp5NWDVjF1Q\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb84ec84c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2070,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"346dfc33d02645d41fb1b3e0eccf1e28","sha1":"e12b9884e047f6b4d077f58be7a40859c1965ac9","sha256":"1c045fd18778d6cb007565f471c7d6f442aef231cd65359b0fbcef666b432155","sha512":"439e4a25d402234082c06f3020d9346d872ede53f9f053b41eaefb6356c4c4a5b206f7c36dcf73d944cbdb5b39e0a1df4afe2dfa197f85e495e1e6e571f1217c","ssdeep":"","tlshash":"d641591f68b35c6146b7353f6fefa4c6692420636808da053c8c76c44fcc9689775bb9","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-07T06:08:43.049874Z","times_seen":482,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/css/dashicons.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.030Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/css/dashicons.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Thu, 04 Mar 2021 06:46:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6040823e-e688\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020435\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cuWKGdbNajlFiGBAh%2FE%2BO7Yl8afUgHb8J%2BuINZTm7tw8oAGl7EYiMop357xZ6XMjrXT9O3le7NfB%2FCKRV74qlqrS%2BcoYuF9M0W7j\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7be8a4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":59016,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (58981)","md5":"d68d6bf519169d86e155bad0bed833f8","sha1":"27ba9c67d0e775fc4e6dd62011daf4c3902698fc","sha256":"c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e","sha512":"fd0956d1a7165e61348fda53d859493a094d5a669aa0ba648be3381b02ed170efd776704af6965f1e31143f510172ee941d4f2fc32c4751d9b8763b66301486d","ssdeep":"768:oey/Z24B3P3aXOhUzSv16CAyLquqSfurIdUMbs73KO08QSJ2BQH02CRqxMWs5rJq:ox/ZvB/qPWMiquqioMUXQSJYIMW+rJq","tlshash":"9c43c2b1a74a40d677b0c843af65b26a5582bd7df8409cdef40b821c1af3635069dfb8","first_seen":"2023-04-05T05:16:42Z","last_seen":"2026-04-11T12:15:54.376932Z","times_seen":124412,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":120,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/rtmedia.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.085Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/app/assets/js/rtmedia.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-6ee8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yrnb9d%2BxcJAN2JAVe74en5%2F5vylwegfly0B9N9yV4HXKRta%2BNRbnlMJoXjXQzmwqlw1II%2Bjj8nu54iAEAHfxN0Jfz7QApf9M7W4S\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7fea14c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28392,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (28392), with no line terminators","md5":"b8e2e149eb4f36d6d4094855d3619b8c","sha1":"e215f744534e895633effb63c16ce359d6ed197e","sha256":"10a4048a0fbf352096b38f940ffc7fad31c91795808ce6e27de597174a647ff3","sha512":"97fcb4e0c48109e488debcda4ef270f1a5507ac902f64fb2dba36c2f159a589039d1727d24b00ffb3e28f71ba4ad5342b58853d0fd3848aeafbf4b9fa3ae8b6e","ssdeep":"384:4IgorPnrVo8ER4z6YB9rm2jkJqMj8mjiwidqKgMqnI1UY7YwQHZy3pBz9zI9L+/M:4IgjL8WdoqjMqn7Y8TSpQJ+qie","tlshash":"29d29314b71493fac1bf70adf4bf67373067ec23b29144643c57646859a8a882253f9e","first_seen":"2025-09-15T15:38:38.820255Z","last_seen":"2026-03-31T06:48:54.151248Z","times_seen":43,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/media-ace/includes/lazy-load/assets/js/lazysizes/plugins/unveilhooks/ls.unveilhooks.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/media-ace/includes/lazy-load/assets/js/lazysizes/plugins/unveilhooks/ls.unveilhooks.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 27 Apr 2024 18:28:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"662d43d5-671\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8%2B5C8qHlcs3peoWugfNKDLHne6Z9Z8SCwYKw8A%2FCIP3uHwooUK1oe96FhNKeDek8KrFBhK29WojsOqicYHUqNY4oFhZKHZ1dykrU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb81ea94c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1649,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1623)","md5":"728be2cf7dd0e1fb913065f11f8a113c","sha1":"328fd3e7478d57b7930bdfc5bd2e44d1e845fad7","sha256":"80107f11f8fef70c5d2d2ff48293c1fddc0a7f904b00412d121d717bf454e14b","sha512":"10795e6ae880e77685f37862fbf60d4a7ee0af3be2250c4f37afb46c675a33e4ba1f2e1c8d704954919c51ad71037b50446b44bbef54a2444aeb34ab122aa8f5","ssdeep":"","tlshash":"9131617f322468337c6608f1905f550276a2f1732e099e118ae7dae4d63aece2c35618","first_seen":"2023-03-07T12:11:03Z","last_seen":"2026-04-10T06:56:50.431335Z","times_seen":276,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/jquery.placeholder/placeholders.jquery.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.138Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/jquery.placeholder/placeholders.jquery.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: \"6846fb70-1555\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 1103679\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dNFdGsLtc%2Fi%2FeiurGZ4Gv7PRL2HkHYgMMVKPN9g%2BnwcWKiZrvY5HIe20pgv2mIf%2F2KFYs5mstV2dkd8GqaPU7wcTzIEqMjWOwXa4\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb82eb84c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5461,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4289)","md5":"a174a677ef7798a1adbda44b740996f5","sha1":"1a3587ed5f71778c68adfb80bf3e4b2419ff2b97","sha256":"aabc30ee10c2b23a718fe443f43b051563fa5c58aa4b48cb64155a424e451468","sha512":"649a4305d36d63c5c092111b1698cf35ea4fe117e230b5b2b4c92349b284c89ce41353d2dcb73666d6a02262a450042329a035c22874153ee1358381a2cad31b","ssdeep":"96:h6LJvsVYMQHqEodWadgRA7C3rMpZtgPrUGvERRjPMv3:hJYMQHRFadg/3GzavERhPMv3","tlshash":"6db1957e324677b31da714e8f8abdc967870a3f6b10b4c60d064e492393cce956b6d48","first_seen":"2023-03-07T12:03:52Z","last_seen":"2026-04-10T07:04:34.919996Z","times_seen":742,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/category/candid-teens/page/7/","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.114Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /category/candid-teens/page/7/ HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-11T12:55:49.320816Z","times_seen":13621212,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Thick-Ass-Track-Teen-In-Shorts-364x449.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.160Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Thick-Ass-Track-Teen-In-Shorts-364x449.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 51814\r\nlast-modified: Sat, 19 Jul 2025 11:56:51 GMT\r\nvary: Accept-Encoding\r\netag: \"687b8803-ca66\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lfsLxE5y8yXEPm%2Bp6nF8YfPf%2F1muEa84atKotigpINZMsZSndLVtVor%2F2PLgTWiw1hLvim4rkstxTyj33e9it3n7PyGILJptMaC3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbf9d4f4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51814,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x449, components 3","md5":"100e89c761dbe62483bb02346fed7124","sha1":"002aaa046a28afcc94737089d0aece31fd226559","sha256":"e5a41321c56a817fc7105f8e17d406dce4ff24c2e421fb0518b0cb47750a8ff0","sha512":"55e8d281a9192ea31dbda44e87dbd1840152800775df6680f4a3368bbba4bff79390fe5fbf09c1b869a243d1687b412c7380f0c0cc5bf4047019da057299973f","ssdeep":"1536:PN7kEJfKFkkpNnBvUyjYUQ/wW144yuOi4dW:dkEBl2BvJjYT//17h4M","tlshash":"d6330207c7096ac6f258f9bf86632d921bf059c15f633776164cf440e0850c5eaaaafd","first_seen":"2026-01-01T22:57:26.546482Z","last_seen":"2026-01-01T22:57:26.546482Z","times_seen":1,"resource_available":false,"data":null}},"time_used":731,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":458,"receive":273,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qwiupo5vesol.s4.adsco.re/","fqdn":"qwiupo5vesol.s4.adsco.re","domain":"adsco.re","tld":"re"},"ip":{"addr":"185.200.116.60","port":443,"asn":9009,"as":"M247 Europe SRL","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.s4.adsco.re","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Nov 2025 09:14:21 GMT","end":"Wed, 11 Feb 2026 09:14:20 GMT"},"fingerprint":{"sha1":"7A:03:26:53:17:4A:DA:4B:6B:97:17:4A:3D:39:18:9E:5A:E0:99:3D","sha256":"BC:B6:01:45:97:52:31:7E:50:44:A4:6C:B3:E7:A3:3D:8E:5A:1E:32:79:2D:E0:BF:94:ED:5C:36:3A:0D:94:6E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: qwiupo5vesol.s4.adsco.re\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 01 Jan 2026 22:56:52 GMT\r\ncontent-type: text/html\r\ncontent-length: 0\r\nlast-modified: Tue, 03 Oct 2023 13:29:59 GMT\r\netag: \"651c1757-0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-11T12:55:49.320816Z","times_seen":13621212,"resource_available":true,"data":null}},"time_used":1705,"timings":{"blocked":756,"dns":198,"connect":183,"send":0,"wait":185,"receive":0,"ssl":379},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"scripts.simpleanalyticscdn.com/latest.js","fqdn":"scripts.simpleanalyticscdn.com","domain":"simpleanalyticscdn.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.066Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"scripts.simpleanalyticscdn.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 14 Dec 2025 01:01:56 GMT","end":"Sat, 14 Mar 2026 01:01:55 GMT"},"fingerprint":{"sha1":"2D:0F:46:43:1F:5A:DB:37:E0:FB:7B:9E:1F:EB:80:7F:8F:61:29:8C","sha256":"EC:00:B6:EA:BB:1E:8B:A2:FC:F0:57:8C:56:9C:E8:70:0E:F9:AF:ED:BA:3D:1F:FD:99:D5:1B:8E:D3:5A:F5:6B"}}},"request":{"raw":"GET /latest.js HTTP/1.1\r\nHost: scripts.simpleanalyticscdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 103822\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\ncache-control: public, max-age=604800\r\ncontent-encoding: br\r\netag: \"64ab8017-1d5b\"\r\nlast-modified: Mon, 10 Jul 2023 03:50:47 GMT\r\ncdn-storageserver: DE-632\r\ncdn-fileserver: 635\r\ncdn-proxyver: 1.33\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 08/14/2025 09:10:03\r\ncdn-edgestorageid: 830\r\nsimple-analytics: true\r\ncdn-requestid: 9df8e22a9954637b46ba18fcfd9eb48d\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":7515,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (7370)","md5":"aa6014215f23cb3f6cb4902be02d081a","sha1":"44ba2453c2e980ba84602006b4b912736cfd913c","sha256":"a965bdafdcbdf6a1bc0a04fb81ee6d5fb86e1fde7a2da4e8998ab3bcf467bdb4","sha512":"483e8e0a4575808ab0c1262718d85a0b2b9d8bd76d7808ed19050cff3c13690191fe6afb1c9e93576fb153630b413aeffe9fd56bb169d66f97d7fcea1c311917","ssdeep":"96:afayldLqaMRuO24q4cVWQ4BPdTJJ6/j4YE9KQeL6lRS+LwNYzCZu2vQmaDN:abctc45PPQj4YE9uWA+Y1Zu2vQmaZ","tlshash":"4df10adcb2a1707397d3307281afd20ea33b779b398bc4555d1899d4ac7494a4027f2c","first_seen":"2023-05-06T11:43:24Z","last_seen":"2026-04-11T11:32:57.410375Z","times_seen":1463,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":42,"connect":8,"send":0,"wait":3,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/picturefill/picturefill.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.144Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/picturefill/picturefill.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-1e1b\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020395\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h5%2B0hXFi%2FoxO3ANnfBu0nCvc5RXZdsry9sueCK8wk95cgBiUKLMsFCHGeTHdg4bkLgSsPkUnJy6%2FSHBuLnWizSL7hws8HoytFkLc\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb83ebb4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7707,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (7525)","md5":"d3325bc1d59dae5aedda1c5ead0cd1d6","sha1":"f4b1fea0baec4ab9b6bff45bdea81d8883357e35","sha256":"d603b6e5c404d28a9f1c12bb0b57d8c9967836a8f53cce046a2ab3fd1f3b2f52","sha512":"3b90e2cf6024a8a58aecbc38b7c0671c5ff8ec22cc3e2187f674f803a53afad647080abe8e3ddd03f36091cd4b2b71e6ad386d8c87a6c3932d32b1f0b15f2d4e","ssdeep":"192:h1Xr6SGagHW0rIEtQDvhI3t4An5C5Pr+EfWL:hFr6SGDbJ56Pr+Efi","tlshash":"eff1d7be7a6931779a9334b0a83f611bf03399a6750884e0d451c0ad7cb8e95903ff9c","first_seen":"2023-03-07T12:03:53Z","last_seen":"2026-04-10T12:19:32.676845Z","times_seen":1138,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2024/04/output-onlinepngtools1.png","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.928Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2024/04/output-onlinepngtools1.png HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 1340\r\nlast-modified: Wed, 25 Dec 2024 11:05:27 GMT\r\nvary: Accept-Encoding\r\netag: \"676be6f7-53c\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 5310783\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Shsk1wpnV43ZGDyB6yd4bX6yFMuumjcRLNfCgHmnYFOjPU4ZiYi3Qo83Qe8VsSMyhqhSXMzWH9ra2JJddpCgDy%2F4mv8Xqhq8nUL7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: 9b759cbe4c694c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1340,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 49 x 58, 8-bit colormap, non-interlaced","md5":"a13f67d97c341361a87682b8a202b382","sha1":"f8be984dfce18204127db5c3e20d99adc617bb3e","sha256":"d02f81360bac4455432a5f8b638ffce40e3162c1cced26f2210986e8bdbbbcc1","sha512":"b7b02fa94729e7ef2c11d190e43afffde84e5561c87f540faf3d3ffeccb7580750b7a129257b86af1807eb4441a90a82bbee347d4d6f5c5474614d96f0fe41b2","ssdeep":"","tlshash":"6c21c8a7d505fd7cd5b8112f4ed7b9a5cf5a87cb0362d22100d707b0a9153342115f14","first_seen":"2025-06-25T06:21:17.72983Z","last_seen":"2026-03-26T02:35:10.549704Z","times_seen":12,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/lib/media-element/wp-mediaelement.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.026Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/lib/media-element/wp-mediaelement.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-fe4\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=igipnCiSqkDI29zfIOlKtMNJ4LflO0ibDbFVNEH93qM1qtPqRiGAodp02WyvKjsKIVY9Bnk83j%2FCFa7D%2FMC4puVZ%2Bv%2BBcMhhtAMu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7ae874c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4068,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (4068), with no line terminators","md5":"ad088d44c475a26d541c1b3988a8a274","sha1":"01e36b46e40508913711f1d77f1822d4480d8d9a","sha256":"39a4f60a1f751e551c219309c7271d22f05bd4f1db878e20a25eba7c6c245e0c","sha512":"c46fff392399076222b39bf579d910ce9f34b4bf0f17bb133a1fade589a5001b7703e9ecb621f5e88d1e53d99c5799687c79821944c387246dbc50ffe813bef7","ssdeep":"","tlshash":"bc81fe108414ad2df4ea722b6acdc75d743ad787fe75e7f86936e3b4c098a842073984","first_seen":"2023-04-06T15:55:49Z","last_seen":"2026-04-10T08:40:59.71628Z","times_seen":229,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/vendors/emoji-picker.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/app/assets/js/vendors/emoji-picker.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-3286\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GttFJnjBWe4yl8WTkhBL8%2FBI7wc37wpdcs%2BfWvY5voIuM3vhgDuJtb6oiQHVmC1sryBr%2FF16bjEkS1ruJWlv0sGcC2niYrddJ7jK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7fea04c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12934,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (12934), with no line terminators","md5":"df49c64afd4fff79dc46d85eec027d1d","sha1":"a67eaa44b7f592838601ba1709ea3be27f32d4e8","sha256":"8f04c1d478a1110f1ad48b5029dc9f36266aac5ad377b9befefba8cf5df0fd39","sha512":"dd30ea5ddca57d4fbc695b438915efa25135a31589ba61d8e7454b7acec300b1022dfa7d20d357f4c34a5f2336a98bc01514fb414ae553a7ccab00eda3b9b634","ssdeep":"96:tNh1up2Tqdm2MY3952gmnVKttxYccFLCegU6S8tGXcheeyBEyd00Y8ztpK:/hqc290gxYNpC7dggMSrp8rK","tlshash":"95429002f68177b771ebb2d2df864d0d751d5d42a091193b23244cb383d42b46aabafe","first_seen":"2023-10-15T12:53:01Z","last_seen":"2026-03-31T06:48:54.06444Z","times_seen":111,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/stickyfill/stickyfill.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.132Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/stickyfill/stickyfill.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-1893\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eQZWgosOabuC0Utna2c4vTOtvJ%2B2%2FYE1YwBPh8cippILUQAxuf8fdOLl8rHh5eLTxSyTbO%2Fb3mttAUnrdH6Hur%2FYym3V0Ob6ChvJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb82eb74c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6291,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6165)","md5":"593e9b79f6e7ce55f18e215cee71c97b","sha1":"05c1dd24e4e71352f7ec69cbeec0dfe8dea721eb","sha256":"77bf60e84e126d1609cc0a302c3953dc25ae054aaee3514d04a4726d4f2609fe","sha512":"384baf3b44411049ac1fa9508b8cb9d19f82ab561864915df6f8d0029eca30652ca1b8055efcfe35aafbf0f7604881d29c8047d14df13c9a88cb7610b833871c","ssdeep":"192:uc6dWtkuaoqt94VK6YVIwgQSzK7OUlvH/CkUmbROm5ujZ2woogtOXnPrf:uCSuaV0VRzGOUlHam135lTorf","tlshash":"b9d183453770353281a3eb27617fa60732725498d9a3d099b02cccecae7cdc911bb978","first_seen":"2023-03-07T12:03:53Z","last_seen":"2026-04-10T07:04:34.933252Z","times_seen":654,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/isotope/isotope.pkgd.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/isotope/isotope.pkgd.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-8a75\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020396\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xw0DUIKgrrKV4mG4%2BJQFaQl2j%2F3i3dm8vX6UA%2FFWHV%2Bj75yGjsw02nVtpRCAnsM%2BCcrFOwU%2BNlVJR6nPIaTpgLQYK7ohQqnHVzA%2F\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb84ec94c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35445,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32019)","md5":"2afcff647ed260006faa71c8e779e8d4","sha1":"c4e5994f24ee8c8d2cf2d6602f0b56b9096a2e98","sha256":"081ae9baaacc857c1c2cb51de6dbd0e1eb811c2761ef01a50df373f2f6eefe22","sha512":"66ad813b1ca1be74455eed3e584ea88e964b394da3767a9baccd61995746cf27826b50e03375f943803f22cf710352246d478377bef9e5d34d23f3f349fd8f7b","ssdeep":"768:LAyxsGKyc1gfflZVP4eAnmc6FumKSshD6cD6GLQfq9SvDz2A1Fxt:rxVKDSfJP4Nnmc6FuCshD6cD6xS9ODzV","tlshash":"f3f2d84f73403925468bf166926f160fb137a56c6a4790acba6ad8db1c79c0d6033fbc","first_seen":"2023-03-07T01:03:01Z","last_seen":"2026-04-11T12:26:53.489022Z","times_seen":18397,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/isotope.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.184Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/isotope.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6846fb70-79d\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2ViAcYOjToXbpQRpWJaxoOKRXDgkJ%2FbrP2C10u%2BTTGJs%2Bp7W95f2%2BlSI1PShlJ7l3n3msvOqyk2rZMYSZ%2Fu8HVaS7ZdTcwK9IL3b\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb85ecc4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1949,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"866cd58cdf83ed14591975680d1ddd86","sha1":"f0fe46a1be19384c096af214788bd0899bb8cf7f","sha256":"b3e753b9b9059add4690320991fbe7a21cf8233c92ba60e17498179919484436","sha512":"e48f822812586117e259a37c96def74f24a1cc64bc56488f0de5f7a5e814dbc9580882a9f948738a798dfec8d44833cccc5ed7bf76ed897a63534ae9cd8d3a6d","ssdeep":"","tlshash":"d341a34d38b33e3010bb707a0fff50d8a03a5463a185da107d6d37858f6e1551573a9d","first_seen":"2023-03-11T09:50:42Z","last_seen":"2026-04-01T14:34:26.187688Z","times_seen":28,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Gym-Candid-Part88-364x334.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Gym-Candid-Part88-364x334.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 34925\r\nlast-modified: Mon, 14 Jul 2025 09:15:44 GMT\r\nvary: Accept-Encoding\r\netag: \"6874cac0-886d\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yEDl8f5tdPBTV0PraNEDtVvjantZaGijXVkgQGLADOjgnSx4Th3C6y76hHaHPW3BUkKC4sbs6DdYKoK3h7gohTqnhpbgtsx2y5GD\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc04d7f4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34925,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x334, components 3","md5":"f806e2a043078afe73011c619fb5eeed","sha1":"6d4b5fc85f13f8a90596bcaf12c8397db6330eb1","sha256":"d26b5bb14c8a4e8524a13eec30581969378dd2e1bc479f3dac4fa0947e248430","sha512":"b7913e04cd7a5c63e20496bd6bf5d8fa49b75895e5334f13233f0086826a36500fbbbb83faba5849676a2171ba0d8ddc0016cdf10d4243aeccb5c4be7dec9c55","ssdeep":"768:AgusevnjGAdSX7uAm2uHzsMCaeOm/H30exOpPGAvj4cl:A9nFSxmvwxav6X2sDcl","tlshash":"8df2025c91277117c18acf787852d8af753f97808cc3d699f5b8d0da86bc6b018a9858","first_seen":"2026-01-01T22:57:26.553145Z","last_seen":"2026-01-01T22:57:26.553145Z","times_seen":1,"resource_available":false,"data":null}},"time_used":675,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":459,"receive":216,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/dist/hooks.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/dist/hooks.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 13 Nov 2024 08:57:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"673469f6-12a8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yOnWeaiIbUp6mrrt5THx6KVzx7HCUIgfBTeWzoH6Zd1nBp2ERC15Uwb794orPfpjqRj0E80NY0accnARUtXg4W5uu5kFqY27U2lV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb83ec34c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4776,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4741)","md5":"c6fddbb6be69793478de26fc245b2acf","sha1":"a136ebf5054fdc19729b3592005fe0fefec4bb4c","sha256":"9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3","sha512":"8a766304caa9c888cfcab64eabab906905965e7fbcfc4f79c74ab122b892456abad215d0883df17023a16a18ba15a6a4b3d0fa5345cab7173d778f725b827c33","ssdeep":"96:vmK40IdSs6c7DE/3sc/YrEBnUBPwKxbqe/Ds91sBYt1Em4kCofWQRemN:OK40IdS/cHg3NZBnUJbqe/DeGYtu7kC6","tlshash":"b4a161c47482b870a2237457e0bb1485757eabb5743990c5a24dd8a02db3dcfe0a7a3e","first_seen":"2024-11-13T05:08:51.627546Z","last_seen":"2026-04-11T12:50:47.448115Z","times_seen":211392,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/dist/a11y.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/dist/a11y.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 13 Nov 2024 08:57:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"673469f6-936\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jM4DlBZP2Z3R64JpQAZshmhq1c8eIVkAG%2BCO6LKRiP7sVC%2B3SwXKP1yMMf0bIgRZrs1v8q4reRlpaZ63EN3ADpQT8528%2FAVIs7X9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb84ec54c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2358,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2322)","md5":"d60d16abc088d80092cef147505a08e4","sha1":"681fbfeb2a611e0db7620dfc72af70a76aa67a7a","sha256":"cf1aa9163953fb477fe5cf452229042578738fa9e600c6ef64c47e4635ba78c2","sha512":"57100e48a4a04b95910cf5f2967883d8d259b2b68c82f0eaa12bbde4d6ddfbe7710cd741db8e727172cc0bb27b8825afd8a72c2a34412f242b951f6ed47b60fa","ssdeep":"","tlshash":"2f4131723450767294bf66f79c3d93c6bf358a303a47e0549e0caea93239c9a21357a1","first_seen":"2024-11-13T06:33:24.842079Z","last_seen":"2026-04-11T11:13:43.775983Z","times_seen":37825,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/imagesloaded.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.183Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/imagesloaded.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 12 Aug 2023 03:48:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64d7010a-1590\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020400\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Be%2Fvmj%2BLptMkUFkvp2Cd96UztO2Z%2Ba47TPXkWkS0YuUDF%2B8pwVsy5mFrkjFg5y%2B%2BYp225zyIjKygBLRMBgdC5bby%2Bgha80H6%2BQWq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb84eca4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5520,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4358)","md5":"6823120876c9afc8929418c9a6f8e343","sha1":"90b0adb37d70ffec5f9189c36bb0027c310c9502","sha256":"b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1","sha512":"63d84226815c831245754adb30040ee72dcf218d01f991a5619675374bbe3b706e3721d32f5120d9d27e500813e8214244992b3875b3a7e7e4bc7ded5201183a","ssdeep":"96:PwSrH5hrG6Qpw1rIN2Bkqsu6B89w1y+7Y3qv5StcXyuC0r4oYeTnf49uVhWWTfju:PwSrq6Qpw1rI2k1u6i9woa3hSSCP9+XC","tlshash":"00b1318db7737563125aa0f2b31b430ab3b6509ea128419d765cecf39cb490a1973fb0","first_seen":"2023-11-08T01:34:44Z","last_seen":"2026-04-11T13:00:12.164663Z","times_seen":151193,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/lib/media-element/mediaelementplayer-legacy.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.019Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/lib/media-element/mediaelementplayer-legacy.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Wed, 03 Dec 2025 15:29:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69305773-2bf8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 1188773\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B3FEfjfLmARVB%2Bd7FmElCr41fx8cONM4lFUmc4hxix6VHhdlmCxK%2FcH%2BLqtTLyopq2i8Z8NVf8lZ1vrxA%2Bz9AawumhhfAPuy9jN5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7ae854c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11256,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (11256), with no line terminators","md5":"2b0dd7eecea03b4bdedb94ba622fdb03","sha1":"703becba85161118dd6fc66af465428ef43f561c","sha256":"b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646","sha512":"fe64cff950921bdf83ec09fe79ca5ce52de40f5b8788697eb1d7b28055f2817778347d5d3c81a324801c7ec7151b3ee0eee99b2882c3c3b10bd760342d3bf3e7","ssdeep":"192:xthsVmeDXDanvgZenjAJKdXSMpNO96hDIzL79V1QVSD1CNxn6fR31r:czDanvuenjAkNBhDInSwh31r","tlshash":"713223929c88212cf43795645ac107ec923fc303fd62ededb73c7679caca58a516a943","first_seen":"2023-04-05T04:06:46Z","last_seen":"2026-04-11T13:02:00.199566Z","times_seen":70818,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Blonde-Teen-Princess-Amazing-Ass-Creepshot-364x365.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.260Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Blonde-Teen-Princess-Amazing-Ass-Creepshot-364x365.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 25241\r\nlast-modified: Mon, 14 Jul 2025 09:15:14 GMT\r\nvary: Accept-Encoding\r\netag: \"6874caa2-6299\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yvnr8wBUV137PgPj0WhTkd3ZAjhJAuCSUiIOB356L19nsebgt03TT6jzkLohls7moA5xIU9vxw0OjiKkOAVzmVYs3KeKzqOpHXX3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc04d814c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25241,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x365, components 3","md5":"bf7406a385e00019ac071af8b1290d64","sha1":"00e04aa825615d6876ae01af30840fa9b8d39d85","sha256":"7b45b1370f01d771cb612fc78018425871557279409a84e96c5f12c5faf39ed6","sha512":"92a29166804a754ee90a28bc027cc5e4e5e70d6b15e6453a8c3b203c4157a6d7e592a797bd091d3e7944ab4883a0f7864c4ceb8a91988999e6e170fd46b8c58c","ssdeep":"384:C/ID4ere8bOmrtbpphGF03fGrV2VBh7SkZALBLsHlyAXJXPD+6KBO2iz0j:CwD4eVqmrtP+5ClZCB4AAXlDuBOPa","tlshash":"f9b2e19a82d2cb53cb49ac3d9e1cff2f969558a89a04b921a4fc8783725c5d04685c63","first_seen":"2026-01-01T22:57:26.557747Z","last_seen":"2026-01-01T22:57:26.557747Z","times_seen":1,"resource_available":false,"data":null}},"time_used":630,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":458,"receive":172,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/snax/css/snax.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/snax/css/snax.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Thu, 09 Jan 2025 11:50:27 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677fb803-be74\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020442\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eFAu8qe8GfGv1UKh%2BZmftrXmKJyv7bcCFFBZ2MXTkEFHx4oog6NbtKlTwJFZPFC%2B4c3z1eShXYYAUaAQYFfUAgHHDlyQQnd5odrY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb79e7d4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48756,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (48750), with no line terminators","md5":"35b4493184bfbc56218b33fb59270a5d","sha1":"02d46eed4ed5bda3d89655c10314deec6f07499d","sha256":"8bd0ece453523856db6704ce9e88360cd63332528e1fe83cc60731e21109f6f1","sha512":"e0c61a2131bc65a8760c1b2da64f00511a0f92c1112273531dd2bff752f543f526c104264440469e9ff255c6a50469dfc97c50eb918315c7bc540eb7b75df4b5","ssdeep":"768:XyxTpweALN4WBKdRfsqraRNT5tXRoGZGnZyZph7u0aPmtm8:Xy+T+koGZGnZyZph7N","tlshash":"6d234161a988124d729bc720abc2a3de15298542f2d30fcee53e5615cbfef4c2573b49","first_seen":"2023-04-15T20:35:37Z","last_seen":"2026-04-10T06:56:50.468623Z","times_seen":86,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/VB-Tight-Teen-Black-Shorts-Slight-VPL-364x293.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.251Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/VB-Tight-Teen-Black-Shorts-Slight-VPL-364x293.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 23150\r\nlast-modified: Tue, 15 Jul 2025 08:33:59 GMT\r\nvary: Accept-Encoding\r\netag: \"68761277-5a6e\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AGTB%2F9Sj6Kj0livAOdMyfXyKEvUk2ZWQ%2BRHBWqq%2BEPu0b4cANMiFYD0ApDucga1kHBpqX%2BK8AebU9PHALUSm0tKCygcoUADWG6re\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc03d7e4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23150,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x293, components 3","md5":"faf49b4cbe225710c69a2298617a0111","sha1":"04f9561ae58af3a247392f7a0e3a1400b07bb6cb","sha256":"9e19c2844a6cf23c39affbc275c343195e5b8803e031f501bb47ca4e2a1742f0","sha512":"6d3979316032d68b509dafaa62887fd8b9f1a900cc457301871db8d193206b32652a735f679306f27cc4ec8286b28784f6f2e6528871fd06bb25c50e87f4db3c","ssdeep":"384:C4wJQ/Pveriw0xr2J3QO++ULMFvRROhrXMSl9yMqD1yEqaK4DQVDvP0Tk:sIe2Dxu9FvShrXMSlgMqns4mPL","tlshash":"62a2d0b1cea599d6ba860e604f349868d3f65e47631e340c8b37d5603da1bf21536d44","first_seen":"2026-01-01T22:57:26.560476Z","last_seen":"2026-01-01T22:57:26.560476Z","times_seen":1,"resource_available":false,"data":null}},"time_used":706,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":516,"receive":190,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Lulu-Leggings-Sexy-Teen-Fantastic-Ass-Creepshot-364x337.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:52.386Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Lulu-Leggings-Sexy-Teen-Fantastic-Ass-Creepshot-364x337.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 23512\r\nlast-modified: Mon, 14 Jul 2025 09:13:53 GMT\r\nvary: Accept-Encoding\r\netag: \"6874ca51-5bd8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JseUL6gbpV%2BQObsOAKfWuP94TBjdDSrwN9qNBmR9T%2FtzoziGwd4qI0cvssNa7KDpMoaZefR1LtPDSiEKjhuVSNL6haNacoSJU8cC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc76ea14c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23512,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x337, components 3","md5":"cc7a6c64e4b370c36c4a0c037b3edeeb","sha1":"5c2c7df9c35bb3eb5c500533c153ac38ad9c032e","sha256":"916050685271041caa8b4592a47d261f807f336fb720550050d9d17748c6539a","sha512":"f1967baf80646f6be03690c94e15898b1dc766376ba767c97c5259db41e24617bed3fc3d9b0fe9fec71d24fb04d6e57f9a994505566558cd13333446681368a4","ssdeep":"384:zWC5eZT4S6/oODSNROEWXMQNLLUgGwpylq6NklpGC8qFJWsJvdqAT7BTMei6EROv:04eOefWcQNFGw6NoG0lrBTtYSARbjY","tlshash":"6eb2cf745c58a6a7f2658da40d8222214b48f10952fac6e730b5f1e638dfeb4a291ff0","first_seen":"2026-01-01T22:57:26.562084Z","last_seen":"2026-01-01T22:57:26.562084Z","times_seen":1,"resource_available":false,"data":null}},"time_used":619,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":448,"receive":171,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/app/assets/js/wp67-mediaelement-init.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/app/assets/js/wp67-mediaelement-init.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 03 Dec 2025 15:29:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69305773-17a\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 1277983\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pM4oVG56I7%2BkXpso9WZX3evXc1J%2BZ2p5aU27evXrltpB3cHjZ9SDkF3dUjCcKmSoDg0w8aR9Oj0gAsi3lNP5Ss3lDrWi5nSSZUP8\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb85ecf4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":378,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (378), with no line terminators","md5":"52cd112eac1cfa8d64086c17dbdc35ac","sha1":"26263dd7b72ac4649194eef3dd01bf57a33ccc38","sha256":"54dcb9a11edf1cad34ece55088561a39f3b9fe5a7ffb166406bcd82d36774117","sha512":"b978268cfd89a7702f73bdb01595e02d8953ad648af4424168858aaddb9b46c8d52b00528a6e1b4838e6044b17ed7767191dc33068b4bcf33cc63dffcedb2fad","ssdeep":"","tlshash":"9ae068182c946631343b421a153b27bcf1361e391289c472bc20392f4bb8da02245c14","first_seen":"2025-11-02T17:42:24.26243Z","last_seen":"2026-03-31T06:48:54.159103Z","times_seen":44,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/spartan/v22/l7gfbjR61M69yt8Z2QKtlA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.640Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/spartan/v22/l7gfbjR61M69yt8Z2QKtlA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 33008\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 27 Dec 2025 11:02:47 GMT\r\nexpires: Sun, 27 Dec 2026 11:02:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 474843\r\nlast-modified: Wed, 27 Aug 2025 20:22:20 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":33008,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 33008, version 1.0","md5":"1e5b736dd0cb2251c20c1473fb84c1de","sha1":"d902711ad5237cbb0698429e1a420aab6552862c","sha256":"0e6bde53280ffff74447f376a66cd051deacd0c2295aea8d6ab7488d3fea19db","sha512":"086de6017072405b7386953edb2554c953421d295219284a9d772c7e98fc352feee0a3b08682850d039e8223ba1fa70890c24855bad308c580c1bb345ee7f44c","ssdeep":"768:BCBcWHlwbUwozrG29tx55MZ5tAZ+EksDZ1qWlzpZMHVt:QCWFwb5sjXBYEksDZ4JVt","tlshash":"e5e2e08c91acc132bec87cad0c456b5dc3823fceb1a5e2e068e16656b4dd854d671b7c","first_seen":"2025-09-02T18:54:35.598097Z","last_seen":"2026-04-11T11:34:00.487739Z","times_seen":1041,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":110,"dns":3,"connect":7,"send":0,"wait":8,"receive":2,"ssl":95},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qwiupo5vesol.l4.adsco.re/","fqdn":"qwiupo5vesol.l4.adsco.re","domain":"adsco.re","tld":"re"},"ip":{"addr":"185.200.118.62","port":443,"asn":9009,"as":"M247 Europe SRL","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.l4.adsco.re","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Nov 2025 09:14:30 GMT","end":"Wed, 11 Feb 2026 09:14:29 GMT"},"fingerprint":{"sha1":"44:4A:2D:C5:7F:AC:E8:4E:70:9B:91:5D:F6:AE:99:5F:66:18:51:46","sha256":"3B:1C:F2:20:1E:BC:6C:00:04:8F:3E:30:B9:AC:DE:26:B1:D4:73:CB:C2:6F:2F:F4:1C:E8:C4:A5:FD:38:8D:68"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: qwiupo5vesol.l4.adsco.re\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: text/html\r\ncontent-length: 0\r\nlast-modified: Fri, 02 Jun 2023 14:03:32 GMT\r\netag: \"6479f6b4-0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-11T12:55:49.320816Z","times_seen":13621212,"resource_available":true,"data":null}},"time_used":310,"timings":{"blocked":140,"dns":53,"connect":24,"send":0,"wait":31,"receive":0,"ssl":58},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pagead2.googlesyndication.com/pagead/js/adsbygoogle.js","fqdn":"pagead2.googlesyndication.com","domain":"googlesyndication.com","tld":"com"},"ip":{"addr":"142.250.178.66","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:52.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.g.doubleclick.net","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:49:37 GMT","end":"Wed, 25 Feb 2026 15:49:36 GMT"},"fingerprint":{"sha1":"F7:14:56:D7:7C:B6:25:7B:E0:63:1C:15:8B:BB:E7:B8:8F:D7:3B:0B","sha256":"97:B8:36:EB:45:3A:F4:9C:E2:0C:DC:7F:1A:1A:39:DD:49:84:6B:99:A5:77:93:14:FC:FB:D2:6B:5D:B5:25:DF"}}},"request":{"raw":"GET /pagead/js/adsbygoogle.js HTTP/1.1\r\nHost: pagead2.googlesyndication.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\np3p: policyref=\"https://www.googleadservices.com/pagead/p3p.xml\", CP=\"NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC\"\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nlink: \u003chttps://googleads.g.doubleclick.net\u003e; rel=\"preconnect\"; crossorigin\r\nvary: Accept-Encoding\r\ndate: Thu, 01 Jan 2026 22:56:52 GMT\r\nexpires: Thu, 01 Jan 2026 22:56:52 GMT\r\ncache-control: private, max-age=3600, stale-while-revalidate=3600\r\ncontent-type: text/javascript; charset=UTF-8\r\netag: 9730463764093754125\r\naccess-control-allow-origin: *\r\nx-content-type-options: nosniff\r\ncontent-disposition: attachment; filename=\"f.txt\"\r\ncontent-encoding: br\r\nserver: cafe\r\ncontent-length: 55402\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":163331,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (4830)","md5":"e118703e09fb69bda931377d06e41328","sha1":"d61168128fbbcda8f5ec7c6bcc281010eae427fa","sha256":"e634b27f4ba71b1cfbedacf7961d33c9182237093e333300eaa5afbd2556cbae","sha512":"5c04e73dab46e77bc5c846dff6bbd82e15e137399b5931aac00145e47b7a8948c15900dd2b66d05dc4741a61e4befa607ed854dc6aaf54155b75004988dc33ff","ssdeep":"3072:6LOf8nZkhS8ulyCUdTHEB8ElEYSpkp3AmUll3Ok/sArs2LYgTzkEmMIDwIOqku:6LOf8Zk09lyCUdbw8ElEYXwmUT3x9rTA","tlshash":"edf3f8d971a2bcb7876389e5006f4107b42da863f00cc8b0f2d8ded97a249655277fad","first_seen":"2026-01-01T22:57:26.564445Z","last_seen":"2026-01-01T22:57:26.564445Z","times_seen":1,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":76,"dns":18,"connect":18,"send":0,"wait":40,"receive":22,"ssl":60},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Sexy-Teens-In-Shorts-Creepshot-364x289.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:52.384Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Sexy-Teens-In-Shorts-Creepshot-364x289.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:52 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 18768\r\nlast-modified: Mon, 14 Jul 2025 09:14:26 GMT\r\nvary: Accept-Encoding\r\netag: \"6874ca72-4950\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bqr2nAw8kkOZMaNifDXRxqAXtdW62iUicxO9A%2FCHrayMKPGa23TJWo%2B36BRVXMO9GHddQ7LCtfB%2BkaBb7t0lcDBANLDT3hvIOABp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cc76ea04c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18768,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x289, components 3","md5":"f2a874096e8339364e700424e0d3f67a","sha1":"c882f575b0050986c26f3f8e02803c486f28c155","sha256":"d0f7cfe4ede246c81260fcdc65fc7a333d4df241b479b0783ca8f4a105220dc8","sha512":"9096d3487a62e1d25afe11868dc4f86978bbac47b42e1ff9f2ebd5578f633e1e7efe01eb624177a1410f7860390a48482394d0702e642942044b31497dc37337","ssdeep":"384:98h5Z3JnOAHYPUcSKlU/F145pDqJlqhJY3vMsh4PNvfv0e7f3jV52HFe:98hL3JOAHYPUcSgq45pq6JY3vMO4PNvZ","tlshash":"ce82c0a4c7c958d0729f593cda49d1ccf54519058b0ad175aaf5cba043fd2d83c2a2ef","first_seen":"2026-01-01T22:57:26.566Z","last_seen":"2026-01-01T22:57:26.566Z","times_seen":1,"resource_available":false,"data":null}},"time_used":597,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":448,"receive":149,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/plupload/plupload.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/plupload/plupload.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 03 Feb 2023 02:06:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"63dc6c28-3cf5\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 3020343\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BX8mNSfpp7Djn0uI63fFEjSrUZppb0%2BE%2FY%2B%2FBCPPFvqSsUp%2Fa5RwRw5RCIPty3sALXq8mnvJjqNXO04nRpwZJg3q27QdTN%2BBdRgQ\"}]}\r\ncf-ray: 9b759cb7de8e4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15605,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (15605), with no line terminators","md5":"111b8979f6f57c288948fd651584ceea","sha1":"83be728367a86428425ff186b9226ebc3000f554","sha256":"b0069bc7672025c216451d39e7bfd4d74776acd2d44f48a3edb9aa8f37fa6b7f","sha512":"417f95bdfcd3a82da8bc608e7982c4bf0295adc22006708ef7936b8b48aecc2277748462261d47c12a85327c5550ee7275db4f5ac157b44cd4f4049552ed691f","ssdeep":"384:abats/jkgkMzNioIt1VQxRYRZ7/4B/TvyUh:a2WjkUgtHr49","tlshash":"9d62e79e3995788d3b2bb076a19f05026132c43a04638030f5b9e2e25cb455e97bfefc","first_seen":"2023-04-02T21:14:45Z","last_seen":"2026-04-11T10:06:11.976712Z","times_seen":5161,"resource_available":true,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/comment-ace/assets/css/iconfont/fonts/cace.woff","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/comment-ace/assets/css/iconfont/fonts/cace.woff HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: font/woff\r\ncontent-length: 2960\r\nlast-modified: Tue, 18 Feb 2025 09:12:28 GMT\r\nvary: Accept-Encoding\r\netag: \"67b44efc-b90\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 3816336\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2Al%2BM1F2X7DLBFqbLVyqfEQuGj65tJ0ck%2BC6yVCKf8Cf7C7%2BUMgdHaBZGGhB%2BfWpeuLaaj85IvUDkk5F7xEzMN2eF4OChKL2GaEY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: 9b759cb7ee984c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2960,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 2960, version 1.0","md5":"732099dfe35b4c149a021d145c2d8143","sha1":"2cc67f54b4a2d9aa886eb658ef953d2767ba4637","sha256":"20f9344a77d5b07bcb299e0441ff84c6be230c8f59ec9aec151dd3e2230eda19","sha512":"27bec41aabfd8a77312b237fe6d7c3ce62f0944784069fe9669c7cc4c137f422b0559fad2533bf6cb960778363b46bb7562f42933d22d28660419703167178f6","ssdeep":"","tlshash":"bd515baeac95aa85c0ef74bcf7d55032f3e4571a43a10e2f81dc0680a1b499f519a867","first_seen":"2023-05-04T13:36:37Z","last_seen":"2026-04-10T06:56:50.419138Z","times_seen":100,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/comment-ace/assets/css/all.min.css","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/comment-ace/assets/css/all.min.css HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: text/css; charset=utf-8\r\nlast-modified: Tue, 18 Feb 2025 09:12:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b44efc-2686\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020434\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KnzE9mzMID6EAvfnEp9HnFflmtcka8mVrBXAkAN4oQ%2Fiy7S9MxH6VMoAP7FLuXFcNIkjKkK6djuuHDEst0hO1wMG8RhLSl7J%2FS8%2F\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb78e784c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9862,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (9862), with no line terminators","md5":"e73bb4132ca48a42f4b15959ff35ba5b","sha1":"49e3b6efc5619e9d5af50549a3b09ec7339dc7ef","sha256":"5b265c14f4af40744077ce7b5de3ac6488aa0806e709f9d185ab65e31610b060","sha512":"de673f7cc6fa10b5c5207abf4fc138d2943818c4feb7a5c2f80198c3f07109a38b14173d131bce1874b8cddbb52baf67e2795dbb984c6a0ff89125e2304bd9a2","ssdeep":"192:F9KYOYkfu8s4Y2AcYxsMCMNdVjNxU45hRdEYaiifRYmhckhE/PxRv3bRt0mMyMsr:KYOYk2X4Y2AcYiMCMNdVjfp5hLEYa3fS","tlshash":"141221ada0c40669312fe5116ee0e35e3051db22d312aedef56f19148acaff7126231f","first_seen":"2023-04-13T05:49:11Z","last_seen":"2026-04-10T06:56:50.417545Z","times_seen":58,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/lib/media-element/wp-mediaelement.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/lib/media-element/wp-mediaelement.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-2dd\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WbbE3MoOA1X9pDskRR2AcsieUKZvZyuLXhYKQNr8PNfg0Ag89MVoEQqBL%2FA9ir42zvsLDmRS5DJ8JcJiCIphKBY5vVxOO8AMCIdd\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7fe9f4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":733,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (733), with no line terminators","md5":"bbc4f3add6171c484f437bb1ffdc916d","sha1":"2797d844c7f75f612ae9f650421951f593d00ac4","sha256":"884dcde59ba613bfe275159bdc6cf440aaaeaaf6073c7970bbab83d312cb90df","sha512":"8cf261a87ed3fe44b75812194240b06bc4c247dff059e718582d22ae4e3b4e3142e682bb0d1c0bc3a923bb1a06671a037ea3466df635f0c1716033399b0039cc","ssdeep":"","tlshash":"ea01c09d3d8036a69c7b4025e03f171870f6cd27818d2e32ea64d4771e74c5082b6e4c","first_seen":"2023-03-07T12:07:29Z","last_seen":"2026-04-06T00:01:23.081388Z","times_seen":137,"resource_available":true,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/plugins/buddypress-media/lib/touchswipe/jquery.touchSwipe.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.197Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/plugins/buddypress-media/lib/touchswipe/jquery.touchSwipe.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 20 Nov 2025 15:29:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691f33f2-2a32\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=19ZD4YTpXjLxdpnPM7Pm%2FQiwxPC2O%2BLRMd5dYDmSlEZ0WqoItDi2pWQSiw%2B%2FEoFN2p3uHTMXA8s8gLRmo4%2Bzv%2BKRVu0HE0U%2BH8IT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb85ece4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10802,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10802), with no line terminators","md5":"a5a52e18911e6582e6309ed252b109b4","sha1":"563931c2311e579e33ea6a55c547b499746bf63a","sha256":"0c6ef976b32b0f9158ce1211ed5d75bc3197e5a1802a70749e186fba11b78498","sha512":"9195a4d5c1d4f9d654cc65586720f9c9cf02162e5be8093e1af90a069f9acc11cf68c8ec0f7c8010ada711811cd30dc67b6a826b67ea6690a08646044b058842","ssdeep":"192:CPdvQkDXw6P7AVLLuXOEQPiDOcu8vcixiJaeSg+RyPNWgdukfRZfEsBJtMv/G1Hs:C1ZDXw6P79XOEQv8UitjgTdukfrB/tMF","tlshash":"812242c17751b167bded7275929f1202b56e4ca70a0ac8b4e062e9d4be300789277fcd","first_seen":"2023-03-07T13:02:15Z","last_seen":"2026-04-10T03:56:27.85485Z","times_seen":637,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/backbone.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/backbone.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 16 Apr 2025 03:29:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67ff2433-5eed\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020434\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BXQrqQDGHLimCNljyBDrnt3cg6fevLhg8Mglf3TX%2B96wjqfLRR9o24ONi9Cx%2FX6NCo%2B5l1ilHJ7x6x6gN4BBCdc3e1UnYak2CcKL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7fe9c4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24301,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (24266)","md5":"5b5c2ebb1043a2089f38b2471b881395","sha1":"bab51f7bf5f98e554f4b7a445664344f810f4d79","sha256":"a69b2b7f72b1b54c21af59b45da481c18dac7d98b0971c8688503dd0ca75b364","sha512":"e2a52b399fcf1f2e45410a3d60f5c16a62a8674723e439acaa15dad5c2a3bb5f77a2706bbe43aabf22ee4c23cd76193214aaf9f29b79a86a3b5b552e356e2b7a","ssdeep":"384:P+wdhm6Smn9N8Tc1WsP8b/GXlPDFXYEk0NTo/bYybx9ZP0AyCEolSdO6zCBk:oraRuZW6ywq","tlshash":"74b2b7e9739269624aba70b0453f1207e23b59893409815cf6bcd4d7bc7c98d607bf78","first_seen":"2025-04-17T08:01:27.169384Z","last_seen":"2026-04-11T12:26:53.600349Z","times_seen":8997,"resource_available":true,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.blockadsnot.com/rjs-data-angular.min.css","fqdn":"www.blockadsnot.com","domain":"blockadsnot.com","tld":"com"},"ip":{"addr":"95.173.205.14","port":443,"asn":60068,"as":"Datacamp Limited","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.515Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1158060716.rsc.cdn77.org","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 14:38:11 GMT","end":"Tue, 10 Feb 2026 14:38:10 GMT"},"fingerprint":{"sha1":"E4:88:A2:ED:00:51:23:06:27:4C:D2:4D:FA:BF:2A:A7:78:D5:C5:6C","sha256":"79:FC:70:2C:EC:2D:45:B9:FB:86:EC:76:8F:9F:54:C1:1C:D1:06:66:DE:88:44:7F:7D:83:E9:AA:42:5B:C6:77"}}},"request":{"raw":"GET /rjs-data-angular.min.css HTTP/1.1\r\nHost: www.blockadsnot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 01 Jan 2026 22:56:50 GMT\r\ncontent-type: application/x-javascript\r\npopads-node: wb9\r\nexpires: Tue, 06 Jan 2026 09:23:58 GMT\r\naccess-control-allow-origin: https://xcandid.vip\r\nlink: \u003chttps://blockadsnot.com/\u003e;rel=preconnect\r\ncache-control: public, max-age=604800\r\nx-77-nzt: EwwBX63NDQH3dV8DAAwBuUwKDAH3rQEAAAwBw7WvFwG3YgAAAA\r\nx-77-nzt-ray: 2a494a15c65fc6aed7fb56693521ba21\r\nx-77-cache: HIT\r\nx-77-age: 221045\r\nvary: Accept-Encoding, Origin\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: osloNO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":41934,"size_decoded":0,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (1568)","md5":"9e5ac10efd7669d6cf2a25aababbbb92","sha1":"ce16eb16ba26f7329b7f9555c2f2b161801ab019","sha256":"86a20cd9c310bdf5a2472058631a09d88df34ad1ed1c7db7a58d9c19a48f3992","sha512":"529d93e45218fc678674025202feeede78715b15339f070570d5342b72b7943ad8881f5723b91f257cb254fe285863ebbe4c0347f98e2c239f2bbe1e3a517a09","ssdeep":"768:bt9rqAYKK2ZzFQ9JsQU+YDngZGihfzmMzhYrTsAysncCWcf5k5sigCtwCntlqorf:bbtZzFQ9JsTgZvfzmMzhYrTscpeZl","tlshash":"c3132aaab286282601e741b9503eb316b23305167912d458fcb9cdf96e3ddc6117b7fc","first_seen":"2026-01-01T22:57:26.571518Z","last_seen":"2026-01-01T22:57:26.571518Z","times_seen":1,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":52,"dns":34,"connect":5,"send":0,"wait":8,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Very-Short-Skirt-Teen-Upskirt-364x481.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.143Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Very-Short-Skirt-Teen-Upskirt-364x481.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 62884\r\nlast-modified: Mon, 21 Jul 2025 09:05:27 GMT\r\nvary: Accept-Encoding\r\netag: \"687e02d7-f5a4\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lUUsaqbPHFCNvaGPupk7O6%2B81x4%2BexwDpqqIzVZkKsVBh9iSv9x%2F0W6Ffy2IZP3CgVX3Nu0u3f6pIIbsikfqDS0m9UBv5LYOd%2BBc\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbf8d454c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":62884,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 364x481, components 3","md5":"77db792e03761c7b4f6be28dd731a7ec","sha1":"6bfc99ecb513e5a68f30e5443ffb8e1afd359508","sha256":"55fb7a2bd874ac0f70c78e38ffff32a255c110b31a3fc219cee038a08f5265a8","sha512":"a9ce883f77a3a0cda1d1832b31b46f85c1cf8f9a290588c977044d79deb82bf24e1089e99d58a807e92b5d3683f7b6501083a07dbcdb52167d4bbbec430d3f15","ssdeep":"1536:BWwQSazQlBG5RXKavOvjQ69HOWvYR4u4UFcP67JsEA7ud:BySazQPG5ZW5YuYRD6BE/d","tlshash":"bb53026489f682a6f1ec06f11f633b9553e0fc071a58598e94c1f486d99d10a69f23f8","first_seen":"2026-01-01T22:57:26.572944Z","last_seen":"2026-01-01T22:57:26.572944Z","times_seen":1,"resource_available":false,"data":null}},"time_used":862,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":518,"receive":344,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C500%2C600%2C700%2C900%7CSpartan%3A400%2C300%2C600%2C700%2C800\u0026subset=latin%2Clatin-ext\u0026display=swap\u0026ver=9.2.5","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:49.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css?family=Roboto%3A400%2C300%2C500%2C600%2C700%2C900%7CSpartan%3A400%2C300%2C600%2C700%2C800\u0026subset=latin%2Clatin-ext\u0026display=swap\u0026ver=9.2.5 HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Thu, 01 Jan 2026 22:56:50 GMT\r\ndate: Thu, 01 Jan 2026 22:56:50 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":37700,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"af932eb00b219435ab8f1f242c395d24","sha1":"9c7594fc5a10517c1b27d1b64c8d55e7045b1610","sha256":"c0e376cc563feb2878559b6515d2757dfd639746ba8cd39fd74d51c48acfc812","sha512":"fc5e74aa1baddae83a0cca1863e5155554cad31db03625f98dab34b5eb6ac9478680bd2aa2d5187e513cb2f72dcdd1467198e5529cc6dc67aa6de4d3ba493820","ssdeep":"768:pCJmwBUiRDfMTcfFBhiEymDcTYeBai75tWtmJrBXiuIcdmtC0BQiVPTnw30CBGi+:SrANyyA","tlshash":"4803fba1041b50009b834cd223cebf35fe1f92517046d0b9abfdab6badcbc66526935d","first_seen":"2025-11-21T22:22:54.998412Z","last_seen":"2026-02-18T03:11:44.982274Z","times_seen":17,"resource_available":false,"data":null}},"time_used":889,"timings":{"blocked":366,"dns":1,"connect":11,"send":0,"wait":20,"receive":0,"ssl":480},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"4.adsco.re:2087/","fqdn":"4.adsco.re","domain":"adsco.re","tld":"re"},"ip":{"addr":"162.252.214.5","port":2087,"asn":53334,"as":"TUT-AS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.516Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_RSA_WITH_AES_256_CBC_SHA","key_group_name":"none","signature_name":"none","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.adsco.re","organization":"Adscore Technologies DMCC"},"issuer":{"commonName":"Sectigo Public Server Authentication CA OV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 15 Sep 2025 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"EC:13:B4:EC:A8:B2:CD:2E:12:E1:84:0E:E5:64:5D:88:D5:CA:3A:59","sha256":"C9:35:54:5E:EF:18:4E:21:62:7D:1D:23:55:D2:B9:CC:68:48:01:7B:AC:A5:8B:D9:3D:71:85:DC:07:17:02:2F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 4.adsco.re:2087\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 01 Jan 2026 22:56:51 GMT\r\nContent-Type: text/plain;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Methods: GET, HEAD, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\nAccess-Control-Allow-Origin: https://xcandid.vip\r\nAccess-Control-Expose-Headers: *\r\nAccess-Control-Max-Age: 2592000\r\nCache-Control: private, max-age=300, immutable, stale-if-error=300, stale-while-revalidate=300\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":45,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"5b41cb22f84f645a103acc7bfbf084ff","sha1":"bac3967b26d5ec4a0d09a580714e8219796816bd","sha256":"709f0a0dfab9f9e074f4a4a348dcb09150838284d21e75cfb9e5ceaeeb2054bc","sha512":"772066ed1119519a19884fc94de2c9f2cc538b4528d9e2651a89b93d65bd4000b18297bfbdd8903b65146858935d33cac048c321dad2ea4f1f84ca6dd9b7d98f","ssdeep":"","tlshash":"7990041154441d34dc45470c4f0d0f0553dc5153df377374ddc50f0414531344141d00","first_seen":"2023-04-05T06:05:36Z","last_seen":"2026-03-30T19:07:46.969854Z","times_seen":25700,"resource_available":true,"data":null}},"time_used":223,"timings":{"blocked":92,"dns":1,"connect":29,"send":0,"wait":30,"receive":0,"ssl":66},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Thu, 01 Jan 2026 23:44:49 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DMX4KiMdxVbBldZjpd%2B4kUhiU%2FiHlXUadkyoSCzVVB3euP4FFQ9GUZrIPk1g7%2FlSSZa1uIUJNcVPeQG454iLYdD7%2BWuIGKhyKkcE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncf-ray: 9b759cb7ee994c11-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-04-11T12:56:48.283324Z","times_seen":299489,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/underscore.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.074Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/underscore.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 16 Apr 2025 03:29:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67ff2433-49d9\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 3020449\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4ziV9EYVxrdFwvr2VGmUlevUbXQT4w50dJRX1AzRSHI6s5ZgxSRk3MkAqPyuU0e2PfLXzcmKGF%2FzqJq2Ym3%2B0JgU9rHbenhb6aZN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb7ee9b4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18905,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18870)","md5":"dadb3f410026822807858737cbc7b64c","sha1":"477bafdb06d8dc0c22ada8d30067b5a0af2d79b4","sha256":"2f61c0b3d5a147bae06a4f6fd7d90031ddf39cba37e17926999b2645ac746a14","sha512":"1f6cfaf7978f2bd30503abaed49c193625e9a204ce359806449558d0caf09cae7dd10d2156e25f61b8f49efc3b7420b1332a480990da94f5a2ea3d30c262e8bf","ssdeep":"384:u2Rq5yjN1V02mEHrJDzWpl0bMpOt3PPD71ijeE9OWj:LqIbV0sHGl0dD71Uj","tlshash":"288281c83ac2f05aa76330b5406f508bf23a3ea16cada840c265e4f8bd7445d9137d6d","first_seen":"2025-04-01T10:25:57.91067Z","last_seen":"2026-04-11T13:00:12.172595Z","times_seen":92877,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":80,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/spartan/v22/l7gfbjR61M69yt8Z2QKtlA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/spartan/v22/l7gfbjR61M69yt8Z2QKtlA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 33008\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 27 Dec 2025 11:02:47 GMT\r\nexpires: Sun, 27 Dec 2026 11:02:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 474843\r\nlast-modified: Wed, 27 Aug 2025 20:22:20 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":33008,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 33008, version 1.0","md5":"1e5b736dd0cb2251c20c1473fb84c1de","sha1":"d902711ad5237cbb0698429e1a420aab6552862c","sha256":"0e6bde53280ffff74447f376a66cd051deacd0c2295aea8d6ab7488d3fea19db","sha512":"086de6017072405b7386953edb2554c953421d295219284a9d772c7e98fc352feee0a3b08682850d039e8223ba1fa70890c24855bad308c580c1bb345ee7f44c","ssdeep":"768:BCBcWHlwbUwozrG29tx55MZ5tAZ+EksDZ1qWlzpZMHVt:QCWFwb5sjXBYEksDZ4JVt","tlshash":"e5e2e08c91acc132bec87cad0c456b5dc3823fceb1a5e2e068e16656b4dd854d671b7c","first_seen":"2025-09-02T18:54:35.598097Z","last_seen":"2026-04-11T11:34:00.487739Z","times_seen":1041,"resource_available":false,"data":null}},"time_used":272,"timings":{"blocked":134,"dns":0,"connect":0,"send":0,"wait":8,"receive":3,"ssl":127},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"blockadsnot.com/rzdaiabazqmaqoqzn?HTsbYknl=BQOCAAAAAAAACZUAAoEv6C5u0HLYbCxaFs9PRYSMfzjsFnnLcVUBCo5bbYJtiHrIHJesueuwNKMA29L8H5kbYt73HsHPrnk3SXqau6jg3jcQEpAsDCdK1fRujKg603joFbNEXv83o0wIo9aEWulHV2ol6qQ67p2bkYGrBLlhpUjSJ-IsXD6WmP7FjYpt9g9vg1lTbAj58Nromjk7zs93no80pdGfrfTkoWix77rXtgk6AF16OjSqE3CIbDO-0HnB9wM9BEPfCAWf9e1fVL10CtqjIFEPWe9KFOgaRLMUREi_12odUuV2bl07x9ckd6le8_8ALamfMRV0vQtlvrAcFvxy9Sjc-yRaIujWUQhViynUQLiod-a9AGqHh_vxFJBuGEIV9bjrZxLxXfL_hW27OfLvUVvrgnrrh5I-HgkLiI91lhUKo5UZqX5Dr_tdfD47KLwMUXVXeE0zkIakh_WTQflCaKa0UgaheCERJR8B3LwpWN4llKU2dX9GAxTzHZpNtpKVrCJo_vhuIOLchkUowMYo6RJAgpgWF0pcmV--f29iObDTOC0Qsb0U5zveOhYRprrXyhYyCYXztY03-wQD0WKW6ZaX4tsqlbeTfenpoTZ3hElpaQyTpToj8Lg3WX1rBAvem0V8Iu7RzaIWnA7klRDXC4L-xo6knzn-MZTLfaDR212AJV5z8Z2OqefiBYj99LQrEUYtlbvjg7XynPG6FF7qEV2p6TkCTgXMlooaRgPnsTXgSGCSGCt1f1nURuBDSTNOpIhk8YA7eLrGwbI7m6A4Ps9j12uPCaY0P7bSr8xa0iqGl1k4JDbXRxsfGDvv8kInaifPdFLJcFHHhqkdmX1b-ecHGnNsQGQFyt9KkOE37ODytAiv74co4VLnYdmhaO_YImFP229VUIitCnR7Y-uOeyzel1I3LhRMgdhJyYg42Rqo73i0K0vRtYtTf8YLty9JqyE7JV8hbZeBu5uXDe1auTQMPTSnf8NRtPmkeX4uOQg9_TE61oGPuZc72wKbGHrGTEIHELd0rjFDipY1ngLXLAXy1gv8nUEw5nrWS8acSaQoE7T7_6wO4sTv2FpWrfw6_AFb3ZKLsVgSru3D_ENfqZdt60TY8SqrMbsclnNBQQryvnrQvUx1RVOhE_qhXKpME6hqHRY2iXtR5k6Fk_9xEMELrzleAveTpJacJ8VbCQVTLkR2fTN2ff6-\u0026YRtMXzLF=4\u0026DxYBXbSi=5249889\u0026YxKwWZRJ=\u0026oPhSZsKg=3:1,3:1,0\u0026JDXgBMRy=\u0026oVOHeYEh=\u0026SeZogvYM=1280,1024,1,1280,1024,0","fqdn":"blockadsnot.com","domain":"blockadsnot.com","tld":"com"},"ip":{"addr":"208.95.112.254","port":443,"asn":53334,"as":"TUT-AS","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:53.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"blockadsnot.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 04 Apr 2025 00:00:00 GMT","end":"Tue, 05 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"1E:C1:DD:D3:65:DB:48:42:4B:E9:38:9C:2B:C9:89:AD:03:15:09:01","sha256":"52:9E:8C:A6:FC:C6:91:C5:D7:DC:4D:0A:2B:16:72:72:8F:31:B7:EA:EE:CB:E2:7C:7C:A7:F2:F2:16:11:0E:8C"}}},"request":{"raw":"GET /rzdaiabazqmaqoqzn?HTsbYknl=BQOCAAAAAAAACZUAAoEv6C5u0HLYbCxaFs9PRYSMfzjsFnnLcVUBCo5bbYJtiHrIHJesueuwNKMA29L8H5kbYt73HsHPrnk3SXqau6jg3jcQEpAsDCdK1fRujKg603joFbNEXv83o0wIo9aEWulHV2ol6qQ67p2bkYGrBLlhpUjSJ-IsXD6WmP7FjYpt9g9vg1lTbAj58Nromjk7zs93no80pdGfrfTkoWix77rXtgk6AF16OjSqE3CIbDO-0HnB9wM9BEPfCAWf9e1fVL10CtqjIFEPWe9KFOgaRLMUREi_12odUuV2bl07x9ckd6le8_8ALamfMRV0vQtlvrAcFvxy9Sjc-yRaIujWUQhViynUQLiod-a9AGqHh_vxFJBuGEIV9bjrZxLxXfL_hW27OfLvUVvrgnrrh5I-HgkLiI91lhUKo5UZqX5Dr_tdfD47KLwMUXVXeE0zkIakh_WTQflCaKa0UgaheCERJR8B3LwpWN4llKU2dX9GAxTzHZpNtpKVrCJo_vhuIOLchkUowMYo6RJAgpgWF0pcmV--f29iObDTOC0Qsb0U5zveOhYRprrXyhYyCYXztY03-wQD0WKW6ZaX4tsqlbeTfenpoTZ3hElpaQyTpToj8Lg3WX1rBAvem0V8Iu7RzaIWnA7klRDXC4L-xo6knzn-MZTLfaDR212AJV5z8Z2OqefiBYj99LQrEUYtlbvjg7XynPG6FF7qEV2p6TkCTgXMlooaRgPnsTXgSGCSGCt1f1nURuBDSTNOpIhk8YA7eLrGwbI7m6A4Ps9j12uPCaY0P7bSr8xa0iqGl1k4JDbXRxsfGDvv8kInaifPdFLJcFHHhqkdmX1b-ecHGnNsQGQFyt9KkOE37ODytAiv74co4VLnYdmhaO_YImFP229VUIitCnR7Y-uOeyzel1I3LhRMgdhJyYg42Rqo73i0K0vRtYtTf8YLty9JqyE7JV8hbZeBu5uXDe1auTQMPTSnf8NRtPmkeX4uOQg9_TE61oGPuZc72wKbGHrGTEIHELd0rjFDipY1ngLXLAXy1gv8nUEw5nrWS8acSaQoE7T7_6wO4sTv2FpWrfw6_AFb3ZKLsVgSru3D_ENfqZdt60TY8SqrMbsclnNBQQryvnrQvUx1RVOhE_qhXKpME6hqHRY2iXtR5k6Fk_9xEMELrzleAveTpJacJ8VbCQVTLkR2fTN2ff6-\u0026YRtMXzLF=4\u0026DxYBXbSi=5249889\u0026YxKwWZRJ=\u0026oPhSZsKg=3:1,3:1,0\u0026JDXgBMRy=\u0026oVOHeYEh=\u0026SeZogvYM=1280,1024,1,1280,1024,0 HTTP/1.1\r\nHost: blockadsnot.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\npopads-node: wb3\r\naccess-control-allow-origin: *\r\nasf: 9\r\npopads-ec: ASB\r\ncontent-type: text/javascript;charset=UTF-8\r\ncontent-length: 44\r\ndate: Thu, 01 Jan 2026 22:56:53 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":44,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"d5f0a25e4d3522d56d48ce7bc3e518fb","sha1":"86794caff58f7fee6e684c2ba7195f970a8d6f4c","sha256":"9d781128a8ece413b003d5612b8398bf9340ef7f5b751d12bd125ba523d3ceb5","sha512":"a3a81801f516a4eb11f00d6f56dab0ed4b8a79219e6b4f5436993479f09dae08f14cffbab3327ff66fb39201d8eba1153ae7114f7705a01cc6f0edf840ef1616","ssdeep":"","tlshash":"789002801814116115d1500b8d5159d01259b1a4540801324446ca502dc7883a415774","first_seen":"2023-03-07T01:17:45Z","last_seen":"2026-04-11T13:01:57.376548Z","times_seen":23126,"resource_available":true,"data":null}},"time_used":730,"timings":{"blocked":306,"dns":1,"connect":94,"send":0,"wait":117,"receive":0,"ssl":207},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-includes/js/jquery/jquery-migrate.min.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery-migrate.min.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 09 Jun 2023 15:19:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"648342fc-3509\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 3020379\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3%2FgJ3Y7set%2FMpOcjObhBwqQbqV02ivPejpzUTLmgSAGHNxBQBp2eI%2B4HFdNmr%2FtcbGWPRBAPpcviGM%2BUoDIOOEAj2SUNfes%2Fd4D9\"}]}\r\ncf-ray: 9b759cb7de904c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13577,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-04-11T12:56:35.146326Z","times_seen":654492,"resource_available":true,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":89,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/themes/bimber%20final/js/global.js","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/themes/bimber%20final/js/global.js HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:49 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Jun 2025 15:19:12 GMT\r\nvary: Accept-Encoding\r\netag: \"6846fb70-b93b\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nage: 1181293\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B9yWdUwtM0lTNmswyy3sTcOaS3%2BMOHcCRA1XgltY5CjbXdEsxmwnhPBrXWe%2FydsCmy2l5eF7uBd%2Bg6NcexE54XX85p4qiocrKqpn\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b759cb83ec04c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47419,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"8b5cca173e2d12b1d577e1ce80202e07","sha1":"8cf07aa4aaf5e4affefb8a202110a8811da669f2","sha256":"f6abddbe5d6b87ebdfc3ef94d51cb72b139804c2ad38ee3ed1aeb591012b5076","sha512":"27580f84aff88c237e05785183e23dc84fb004e2ab06d1d97d70cd6e47a93e44818d1437e8a54b1207b56361f52c7773ec33101baa4180ba1bd4e33d070658be","ssdeep":"768:7sRhAFkI0t6urttwi2A+L1eCgkYf3+jiHKeF3EvN5uT6EG+fhsBtxmim43:7sWkII+ngkiOjiK0uKe3X3","tlshash":"b9235d1a79f32d21443bb07a4bef60c4b26944279149ce143c9d73885fcc56866aafee","first_seen":"2023-03-07T13:00:40Z","last_seen":"2026-04-07T06:08:43.025377Z","times_seen":412,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:50.633Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 30 Dec 2025 19:22:36 GMT\r\nexpires: Wed, 30 Dec 2026 19:22:36 GMT\r\ncache-control: public, max-age=31536000\r\nage: 185654\r\nlast-modified: Tue, 18 Nov 2025 19:00:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40128, version 1.0","md5":"9a01b69183a9604ab3a439e388b30501","sha1":"8ed1d59003d0dbe6360481017b44665153665fbe","sha256":"20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2","sha512":"0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca","ssdeep":"768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO","tlshash":"3703023a5e3ccf1a84157a703950f6d9a8481e548e9d143b4f1ac7bf085dde2209b6d4","first_seen":"2025-01-08T22:59:02.845106Z","last_seen":"2026-04-11T12:56:17.699134Z","times_seen":729584,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":140,"dns":5,"connect":22,"send":0,"wait":9,"receive":7,"ssl":110},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xcandid.vip/wp-content/uploads/2025/07/Teen-Duo-Hot-Creepshot-Asses-364x405.jpg","fqdn":"xcandid.vip","domain":"xcandid.vip","tld":"vip"},"ip":{"addr":"104.21.42.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xcandid.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 02:43:23 GMT","end":"Thu, 26 Mar 2026 03:40:59 GMT"},"fingerprint":{"sha1":"A1:64:66:12:5C:4B:CB:49:E1:34:92:D4:31:59:58:79:B7:C6:59:6F","sha256":"55:ED:46:C8:FF:B8:65:E9:B6:E2:2F:BB:86:F3:72:23:C4:9B:CC:B1:87:90:A5:14:A1:42:0F:55:0F:F3:10:0F"}}},"request":{"raw":"GET /wp-content/uploads/2025/07/Teen-Duo-Hot-Creepshot-Asses-364x405.jpg HTTP/1.1\r\nHost: xcandid.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xcandid.vip/category/candid-teens/page/6/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 30112\r\nlast-modified: Fri, 18 Jul 2025 09:23:59 GMT\r\nvary: Accept-Encoding\r\netag: \"687a12af-75a0\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PJkwoW53UnL3sy1htkR6JgmmKzMCitK0sfpy%2FydbkCprbG4Puug8cIGXVN2sSRFIJEx%2FM3cHF6V9%2BeLN4YSL01fiMZgUVcyco%2BlC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9b759cbfad504c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30112,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 240x240, segment length 16, baseline, precision 8, 364x405, components 3","md5":"482d160c93ae4d51c7b5b3a02197876d","sha1":"9e59c3e7adc2a863259592f8e5c5b53f822efa24","sha256":"44d00708e67d52b198c7888e7c9d392109a4357d1fb9ce3be70bbd28d8cd5701","sha512":"4aaf7a0ef25d4aebae8c1cfffe675d6aa3a2b24b99f002a3ae5b9e89cc8305fadf1451f837d1d7f4607cf84214c182ac9f0677e44f960077316f08acd1fc9134","ssdeep":"768:fPfuOVsuodRUZKxsgJ3e9w/Q2ScfwrI+yt32ml:HfuOVCdBxer2SswGFX","tlshash":"fcd2e11bd81f91b2f104e7730b60eb85e9dbf2254989c13b3bc95f563115ea1b8394a2","first_seen":"2026-01-01T22:57:26.579441Z","last_seen":"2026-01-01T22:57:26.579441Z","times_seen":1,"resource_available":false,"data":null}},"time_used":651,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":460,"receive":191,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-01","alert":"Sinkholed","trigger":"xcandid.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6.adsco.re/","fqdn":"6.adsco.re","domain":"adsco.re","tld":"re"},"ip":{"addr":"104.16.84.77","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xcandid.vip/category/candid-teens/page/6/","date":"2026-01-01T22:56:51.517Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.adsco.re","organization":"Adscore Technologies DMCC"},"issuer":{"commonName":"Sectigo Public Server Authentication CA OV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 15 Sep 2025 00:00:00 GMT","end":"Thu, 01 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"EC:13:B4:EC:A8:B2:CD:2E:12:E1:84:0E:E5:64:5D:88:D5:CA:3A:59","sha256":"C9:35:54:5E:EF:18:4E:21:62:7D:1D:23:55:D2:B9:CC:68:48:01:7B:AC:A5:8B:D9:3D:71:85:DC:07:17:02:2F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 6.adsco.re\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xcandid.vip\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xcandid.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 01 Jan 2026 22:56:51 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 45\r\ncf-ray: 9b759cc21e0eb4fa-OSL\r\naccess-control-allow-origin: https://xcandid.vip\r\ncache-control: private, max-age=300, immutable, stale-if-error=300, stale-while-revalidate=300\r\naccess-control-allow-headers: Content-Type\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-expose-headers: *\r\naccess-control-max-age: 2592000\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"5b41cb22f84f645a103acc7bfbf084ff","sha1":"bac3967b26d5ec4a0d09a580714e8219796816bd","sha256":"709f0a0dfab9f9e074f4a4a348dcb09150838284d21e75cfb9e5ceaeeb2054bc","sha512":"772066ed1119519a19884fc94de2c9f2cc538b4528d9e2651a89b93d65bd4000b18297bfbdd8903b65146858935d33cac048c321dad2ea4f1f84ca6dd9b7d98f","ssdeep":"","tlshash":"7990041154441d34dc45470c4f0d0f0553dc5153df377374ddc50f0414531344141d00","first_seen":"2023-04-05T06:05:36Z","last_seen":"2026-03-30T19:07:46.969854Z","times_seen":25700,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":20,"dns":1,"connect":1,"send":0,"wait":10,"receive":19,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}