{"report_id":"bea82737-a9f4-47b1-9e08-6b2e8195c812","version":0,"status":"done","tags":[],"date":"2026-07-14T14:53:28Z","url":{"schema":"https","addr":"safewonline.xyz/","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":0,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"safewonline.xyz/","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"title":"Safew免费聊天软件 – 免费下载的安全聊天应用","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"safewonline.xyz/","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":0,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-18T14:53:28Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-12T22:19:35.511658Z","alert_count":0,"request_count":5,"received_data":230001,"sent_data":2815,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-12T22:22:25.184057Z","alert_count":0,"request_count":1,"received_data":32388,"sent_data":629,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"safewonline.xyz","ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"domain_registered":"2026-01-13","domain_rank":0,"first_seen":"2026-07-14T14:53:28.91995Z","last_seen":"2026-07-14T14:53:28.91995Z","alert_count":22,"request_count":22,"received_data":1101676,"sent_data":12766,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WordPress:7.0.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"imagesLoaded:5.0.0","description":"jQuery plugin for seeing if the images are loaded.","website":"https://imagesloaded.desandro.com/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/jquery/jquery.masonry.min.js?ver=3.1.2b","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"cd0eb3406096ff80266e7c9d7d419186","sha1":"0e3709691bf96233766de30e2fd473b84166c5b6","sha256":"c2e606e1fc82ea3a554aad5d0520e25d2677b89a891dc5c49e7ace08fce92e25","sha512":"3caf5308cdbc5f42f1eccf5944e8ca785ac086b85954765c1f40d91bd9cc9f3fe6eb816ad821b534f9ad36395f4b6b5d361bea24eb272e94cad2824f03faaac6","ssdeep":"","tlshash":"2b31ee46a55137a067b372e5703f610f023aa7bc9242d1e8318ec6e289be4056633b36","size":1819,"data":"","first_seen":"2023-03-07T01:07:32Z","last_seen":"2026-07-14T18:48:41.780386Z","times_seen":26420,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/wp-emoji-release.min.js?ver=7.0.1","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","size":22752,"data":"","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-07-14T18:15:55.731613Z","times_seen":4621,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-07-14T18:17:09.530047Z","times_seen":967794,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13577,"data":"","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-07-14T18:17:09.607443Z","times_seen":888589,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/wp-emoji-loader.min.js","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a3b97fda1435ff9c3b37d27c62ccd404","sha1":"3ec6dc95d03f8bc8f0720363dec53181168ea8ba","sha256":"ec1cda2830f3457704d428342bd416627e76cd891e40db22f27bcfbdee05d216","sha512":"f78b52fcfc996abcc44da87892034a95226984444c5be52901a42f49572ca801f38e9d01afa7471a8831087905b3a7610f66c77025b2116de37c9da0f7efc0ab","ssdeep":"","tlshash":"d271879ae77638dfb2f900f2697a0d47e7614436d6c8d438c9bda3141cb5893c274b46","size":3766,"data":"","first_seen":"2026-07-14T14:53:32.490789Z","last_seen":"2026-07-14T14:55:08.023389Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/masonry.min.js?ver=4.2.2","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b3fc826e58fc554108e4a651c9c7848","sha1":"76778fd446e2ff2377588a7b4ac4d79f258427c9","sha256":"e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb","sha512":"ae192d8d804f7dafd8b7a95220ceb66c0c308a51cdf42c172c20f71f50052e4529b01f8781c5f305e1e0d6c5367d9678f1d908ee4273db594fbb650c56a9f61b","ssdeep":"384:Ar7mIr/Dh5rA3rzB4rMhr/XWGHW/6rMz1xftF2OUVP4eAnbhfreD6dCBEOav7blM:+SxxGG2/71xftFqVP4eAnI0ROavPSCzo","tlshash":"b9b2848f73407425428bf16696af020fb137655c7a4790acba6ad8db1cb984d2037fbd","size":24138,"data":"","first_seen":"2023-03-07T01:02:57Z","last_seen":"2026-07-14T17:55:12.635728Z","times_seen":78935,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/anima-frontend-js-extra","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"912532e29aa1eafa485a1b8ee05727c7","sha1":"ba44d9e3d467bb500e1a4ca1b0d2334633c2eba2","sha256":"dd4de772600a268c588baa11724ca0233a6ea90b32b353bdfa9f8d5649027d4f","sha512":"7589b98f9eed4e8d01e00da7cdd61d0121a116243b963bdc12847ec23bdabc9e457d0f81e2cf6c34b6c300e60a7449028202b88076b684cd9a4b9437c93d9bf3","ssdeep":"","tlshash":"4d11a749c05b1a14cd6b9bb0595c414560cc16b0c050c6209df5c84800d5bb2174d669","size":1000,"data":"","first_seen":"2026-07-14T14:53:32.491725Z","last_seen":"2026-07-14T14:55:08.022742Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/imagesloaded.min.js?ver=5.0.0","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6823120876c9afc8929418c9a6f8e343","sha1":"90b0adb37d70ffec5f9189c36bb0027c310c9502","sha256":"b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1","sha512":"63d84226815c831245754adb30040ee72dcf218d01f991a5619675374bbe3b706e3721d32f5120d9d27e500813e8214244992b3875b3a7e7e4bc7ded5201183a","ssdeep":"96:PwSrH5hrG6Qpw1rIN2Bkqsu6B89w1y+7Y3qv5StcXyuC0r4oYeTnf49uVhWWTfju:PwSrq6Qpw1rI2k1u6i9woa3hSSCP9+XC","tlshash":"00b1318db7737563125aa0f2b31b430ab3b6509ea128419d765cecf39cb490a1973fb0","size":5520,"data":"","first_seen":"2023-11-08T01:34:44Z","last_seen":"2026-07-14T17:55:12.641714Z","times_seen":195968,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/themes/anima/resources/js/frontend.js?ver=1.4.1.2","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"cd55166da7086bc22f1cfe440d950fca","sha1":"bba65353ddb839431cbd833f99fd8df8b65e51b6","sha256":"7c1de8fd79f117c1ba93f353c1c44a01c089400adf510d5d3bea7057e964c3cc","sha512":"614fe964436633efb4674039fe3e1b73c0efb7b854673650f8d269349d5d5d77baf88144651253b948a4c8392ab67aca6a46132485cd80022dba74fe60dcc89c","ssdeep":"384:nZazJNuhhFJGwSp5MbaMgiuqX755XnRh86qmIStYCJ4zq8W+c:nZazJN8RQ5vMgiuqX75BnRh86qdeWc","tlshash":"e48283a4325a25be24bb3364e93fc224fd3b8076a345726db96d84c51f7045806e2efd","size":19068,"data":"","first_seen":"2023-03-07T01:36:39Z","last_seen":"2026-07-14T14:55:08.014019Z","times_seen":22,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"JQMIGRATE: Migrate is installed, version 3.4.1","filename":"https://safewonline.xyz/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","line_number":2,"column_number":981}]},"http":[{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/uploads/2026/02/%E4%BD%8D%E7%BD%AE%E5%85%B1%E4%BA%AB%E4%B8%8E%E5%9C%B0%E5%9B%BE%E5%8A%9F%E8%83%BD%EF%BC%9A%E5%9C%A8SafeW%E4%B8%AD%E5%A6%82%E4%BD%95%E5%BF%AB%E9%80%9F%E5%AE%9A%E4%BD%8D%E6%9C%8B%E5%8F%8B%EF%BC%9F2-430x350.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.842Z","timestamp":1784040773842,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E4%BD%8D%E7%BD%AE%E5%85%B1%E4%BA%AB%E4%B8%8E%E5%9C%B0%E5%9B%BE%E5%8A%9F%E8%83%BD%EF%BC%9A%E5%9C%A8SafeW%E4%B8%AD%E5%A6%82%E4%BD%95%E5%BF%AB%E9%80%9F%E5%AE%9A%E4%BD%8D%E6%9C%8B%E5%8F%8B%EF%BC%9F2-430x350.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:54 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 13 Feb 2026 15:58:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698f4a20-676b\"\r\nexpires: Thu, 13 Aug 2026 14:52:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26475,"size_decoded":26624,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 430x350, components 3","md5":"401b2951abe4aca0610e5875d67e46f3","sha1":"5dfa590b2c08d93020c5b3b1adac7b6269564b5d","sha256":"def21bd51b10bdc902f5c022bf6f2f9dd6af6d126d1361e7fe9beef0827aff58","sha512":"68c452d5ffda005f8fbea74812c17ffd1c42ed40394180f0133cbc9ab16f1b19d8a9c903c3868c0060990630d7b1fbdcd14ce8281955a030556af834e138eb7f","ssdeep":"384:jVxESrGtHFMPZKn18Kz6MIpnw2fbaHEYGw8u1CcvC/MLOj3JHsE7rctAgK33/WGU:jV2SQFMPZc18Kzkdw2iC/M6jZHsEMtgU","tlshash":"96c2e062aca2116cdbf7afd6be1c59d453c20aa160e486f0a13cda333af5dc881555cf","first_seen":"2026-07-14T14:53:32.470579Z","last_seen":"2026-07-14T14:55:08.007595Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1543,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1543,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:54.403Z","timestamp":1784040774403,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://safewonline.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 10:17:38 GMT\r\nexpires: Fri, 09 Jul 2027 10:17:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 448516\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":43136,"size_decoded":43949,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-07-14T18:18:54.893342Z","times_seen":226750,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":17,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:54.406Z","timestamp":1784040774406,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://safewonline.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 10:17:38 GMT\r\nexpires: Fri, 09 Jul 2027 10:17:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 448516\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":43136,"size_decoded":43949,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-07-14T18:18:54.893342Z","times_seen":226750,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":31,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T14:52:51.317Z","timestamp":1784040771317,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlink: \u003chttps://safewonline.xyz/index.php/wp-json/\u003e; rel=\"https://api.w.org/\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WordPress:7.0.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"imagesLoaded:5.0.0","description":"jQuery plugin for seeing if the images are loaded.","website":"https://imagesloaded.desandro.com/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]}],"data":{"size":111120,"size_decoded":18212,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17819)","md5":"00c74b11b6542db54e68cf5a2f078c83","sha1":"233fa0507f4cce49658d14f480948eb2a9198f66","sha256":"3765a57fe1bb1c2611015f0adbc12f6f35cf7b8348e3447fe8d64b7f26e1f22c","sha512":"c6213eed872076c12623b45ac19b2b44826b040d308574caeb089e454f47c1aaccf57c13fd8b7f50450cc6cd31c26bd936b6e4bef9f4d023771f1f92124df079","ssdeep":"3072:JICHkItuOIMbACmY+ircSNav7kzswZhDP:L8Y+U","tlshash":"66b3f972578b497e232aa3bd90813745a3895911cef94bd4f2be804c32c9e6d16f634f","first_seen":"2026-07-14T14:53:32.47238Z","last_seen":"2026-07-14T14:55:08.017851Z","times_seen":2,"resource_available":true,"data":null}},"time_used":2258,"timings":{"blocked":-1,"dns":76,"connect":151,"send":0,"wait":963,"receive":0,"ssl":1067},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Raleway:400,300,700|Raleway:|Roboto:|Raleway:100,200,300,400,500,600,700,800,900|Raleway:400|Raleway:300|Roboto:700|Roboto:300\u0026ver=1.4.1.2","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.802Z","timestamp":1784040773802,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:24 GMT","end":"Mon, 14 Sep 2026 08:37:23 GMT"},"fingerprint":{"sha1":"85:D0:EC:C2:01:33:25:23:96:FB:2B:54:90:54:84:07:0A:49:1F:03","sha256":"9D:7C:1C:9C:6A:25:1E:17:E0:DC:FD:42:95:CA:47:3D:C1:9C:20:FB:22:47:02:E3:27:EC:7C:62:03:30:83:BA"}}},"request":{"raw":"GET /css?family=Raleway:400,300,700|Raleway:|Roboto:|Raleway:100,200,300,400,500,600,700,800,900|Raleway:400|Raleway:300|Roboto:700|Roboto:300\u0026ver=1.4.1.2 HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 14 Jul 2026 14:52:53 GMT\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31704,"size_decoded":2656,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"4e0d8114a9968b06966b22f3c0f1ab61","sha1":"761a9e3af6e01455ae74b647f1c33c6d2bfdbf93","sha256":"852bb81e8511616c849fdfd5081eb88b86fa48289ef8412dec53b8b749b311a6","sha512":"399734806a2fcef5fbe31adb4a1b824f49839b50d08dc73c779517f295b6961c3fc289960a5c9cd4eee0fa5398e3501c71bd238f40d1c9a3b649f2e692345059","ssdeep":"768:t2yr/FFsbbYSRv4wFMl22YfRiJhwhQHHYORjUM8:3IJj","tlshash":"46e222a1081794009b835cd623ce7f32fe4e52047046d47aabfd5abaacebd7613a435d","first_seen":"2026-04-30T20:04:02.749202Z","last_seen":"2026-07-14T14:55:08.018523Z","times_seen":9,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":35,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/themes/anima/style.css?ver=1.4.1.2","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.804Z","timestamp":1784040773804,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/themes/anima/style.css?ver=1.4.1.2 HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 12:24:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69809760-1e749\"\r\nexpires: Wed, 15 Jul 2026 02:52:53 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":124745,"size_decoded":24093,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (700)","md5":"6be6b181daaaeb6ec184c9f5014fa157","sha1":"8971e835659bfc03a624e7abfe93e62f735c61d3","sha256":"988f7428b348f716fc4b1b568c7305c8a99cba7ea68926aa6ae0ea7592d008bf","sha512":"dac938ea1ae2869e693e4b14cfeb6d9ba94672e6449b87fccea328cc7eaaf7ef954b1b28d49ec4d6b6b709cee644af1ca5d0f50d20860bcc84bf4313e5e38136","ssdeep":"3072:OcoE4cJ15twgklBsB8xmlmfn8YpDJkG46Ez94REWr:loERJIsB8xJ/8sDJk+","tlshash":"3ac396602f602d90a62bc39caecdeb24ce2c4091af5e4ceaf4552d6dc389585157ff8d","first_seen":"2025-10-22T03:16:40.62751Z","last_seen":"2026-07-14T14:55:08.009243Z","times_seen":14,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":452,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/uploads/2026/02/%E8%AF%AD%E9%9F%B3%E8%BD%AC%E6%96%87%E5%AD%97%E5%8A%9F%E8%83%BD%E5%9C%A8%E4%BC%9A%E8%AE%AE%E5%9C%BA%E6%99%AF%E4%B8%AD%E7%9A%84%E9%AB%98%E6%95%88%E5%BA%94%E7%94%A8%E6%A1%88%E4%BE%8B3-430x350.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.832Z","timestamp":1784040773832,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E8%AF%AD%E9%9F%B3%E8%BD%AC%E6%96%87%E5%AD%97%E5%8A%9F%E8%83%BD%E5%9C%A8%E4%BC%9A%E8%AE%AE%E5%9C%BA%E6%99%AF%E4%B8%AD%E7%9A%84%E9%AB%98%E6%95%88%E5%BA%94%E7%94%A8%E6%A1%88%E4%BE%8B3-430x350.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 25 Feb 2026 07:10:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699ea050-6cf1\"\r\nexpires: Thu, 13 Aug 2026 14:52:53 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27889,"size_decoded":27281,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 430x350, components 3","md5":"d41c88d3a836aa8e4ca9dd3cdd318639","sha1":"32a2392698981d7bb582cc712898c7d3c3d18013","sha256":"f5375dc151f6fc1eca4b365cbb0c9a82dc8d9334e7e9cd4f8de954174dac2314","sha512":"82295ec5731f0f3c39fd1de0e744cbbffbffba387f7c7834d66343a8cbf75d14ca75197e80897d726b827d32e5153d645cb658d6f89dca4d5262369453bd6165","ssdeep":"768:j2YcthnIO4xPxgMF7RMG4flbevhsAdW4trMKvmrq4OG:jFNZZZR149B0JtrL8+G","tlshash":"02c2e04a4e4e0aaec9d80f64d06f9d63474b6ae01ca2e63159f7dccd7bf1cd90627848","first_seen":"2026-07-14T14:53:32.4754Z","last_seen":"2026-07-14T14:55:08.015384Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1551,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1551,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E6%95%B0%E6%8D%AE%E5%A4%87%E4%BB%BD%E4%B8%8E%E6%81%A2%E5%A4%8D%E6%8C%87%E5%8D%971-430x350.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.835Z","timestamp":1784040773835,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/SafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E6%95%B0%E6%8D%AE%E5%A4%87%E4%BB%BD%E4%B8%8E%E6%81%A2%E5%A4%8D%E6%8C%87%E5%8D%971-430x350.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:54 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 25 Feb 2026 07:22:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699ea346-5acb\"\r\nexpires: Thu, 13 Aug 2026 14:52:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23243,"size_decoded":23594,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 430x350, components 3","md5":"74ee408217835c4f8ab94dd723b73b58","sha1":"ac40b7405785a247ffdfa629affa2513e47fbf4d","sha256":"a4d75bcd7d53e7357622caf27782ad67ed2763503f35fe29f78bfdc27dae3509","sha512":"e08239cd215bc6d6dd9ebe7769b9fae5387b57930d7342125d94c64af8f145bfb4040a7359e83ab70afe0b22ae5ac00d77cf104456045b87b54d72f0490c5395","ssdeep":"384:jFvojfv+ooqrJ0gDw2J9aErJMfABdaDvdwza7c9p5g1P6wFx97N8Yf2PYasYfBP:jFA8qegkaLrWfXdLcONrwC2TsYl","tlshash":"c4a2d0ea1ff2507026386da11050155ef4c0a9b9e94ebec6b378cf37f6a12f19f04a19","first_seen":"2026-07-14T14:53:32.476348Z","last_seen":"2026-07-14T14:55:08.016098Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1549,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1549,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:54.398Z","timestamp":1784040774398,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://safewonline.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 10:17:38 GMT\r\nexpires: Fri, 09 Jul 2027 10:17:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 448516\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":43136,"size_decoded":43949,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-07-14T18:18:54.893342Z","times_seen":226750,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":26,"dns":1,"connect":0,"send":0,"wait":25,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:54.400Z","timestamp":1784040774400,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://safewonline.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48264\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 12 Jul 2026 10:14:35 GMT\r\nexpires: Mon, 12 Jul 2027 10:14:35 GMT\r\ncache-control: public, max-age=31536000\r\nage: 189499\r\nlast-modified: Tue, 09 Sep 2025 19:08:31 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48264,"size_decoded":49077,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48264, version 1.0","md5":"e401cae7a12911a5c9752dc7a62f9dd7","sha1":"5685dd613a8a8211bf60b4b10753a47587bd0b60","sha256":"b1bef1f03a77a36fc257c5525e32a1dd621bb6f935b743a419da7ed0b18dc8f5","sha512":"dc8b6f28bc048efb508b482199c958ffaeddf15431aad34544f5b9972fd8c19e0315f74499d5549b30e15a03e41bfaf2a30613b6889b9a693a9c87c4e872e1f3","ssdeep":"768:AWHBpvVWVHIgyYwXiDAOa6GWeFGaCfLBc/qiufIdQRuEl4ofxl8VKme:AWbEIgmi8uAFCfS/OfUYuRExl8VFe","tlshash":"1123f2e56c6a826bd88c882945ee21c1f3d7f4927713d149e8fa5df8c432c05ed5066b","first_seen":"2025-05-29T19:02:42.430777Z","last_seen":"2026-07-14T18:22:55.599271Z","times_seen":59422,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":43,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/themes/anima/resources/fonts/iconmeta.ttf?ebg1dt","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:54.404Z","timestamp":1784040774404,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/themes/anima/resources/fonts/iconmeta.ttf?ebg1dt HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/wp-content/themes/anima/resources/fonts/fontfaces.css?ver=1.4.1.2\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:54 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 30384\r\nlast-modified: Mon, 02 Feb 2026 12:24:00 GMT\r\netag: \"69809760-76b0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30384,"size_decoded":30838,"mime_type":"application/octet-stream","magic":"TrueType Font data, 11 tables, 1st \"OS/2\", 14 names, Macintosh, type 1 string, iconmeta   ","md5":"f5e0b313ca8f43382794b08a77314653","sha1":"665e009123db333048c47ba3712d090c1cc76c17","sha256":"bf251e0e9a21775684b21a07bb8d46fcec727e1d2565cbd0affdd76f32daf7be","sha512":"c93141ba44e85a368f713028fca96a4bf382531f00bdb61cc4a6c8bdb79014db9b56f9d89458fbc7356737ba3f0ae23bff0b22988040d4fd3a6d7ac350e0f879","ssdeep":"384:mN40U+maHsrytnfRU2OJXPu04FLAS2OuhmCCL6aZ7GG0wFTt2gQF572t:mN4hEfRU2UX2f2zhmCDlwFTt2Qt","tlshash":"35d25bc9c7b8ee56ee14973886c7931255fcb202f15c03badec1558ce0948f90dca7aa","first_seen":"2023-09-26T15:43:28Z","last_seen":"2026-07-14T14:55:08.008464Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1282,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":980,"receive":302,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/themes/anima/resources/fonts/fontfaces.css?ver=1.4.1.2","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.800Z","timestamp":1784040773800,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/themes/anima/resources/fonts/fontfaces.css?ver=1.4.1.2 HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Feb 2026 12:24:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69809760-8a7e\"\r\nexpires: Wed, 15 Jul 2026 02:52:53 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35454,"size_decoded":6529,"mime_type":"text/css","magic":"ASCII text","md5":"cf7aae9dc6ce4e8a8200d09bb0563911","sha1":"cd946d6b5947ccc6e7527c7fe401cebe5049bee0","sha256":"810cf21e24f5a961a08a840d9f00640bdf22b4339d69c870c63185dd64bea103","sha512":"874595206f8756b166a41c5cc9c2ae46d213cfd37d5eb7d5e01d58d0a0c82a3310ac4efa27bb2284ac14916f49b2b13be5a023704dc9126337db9e819e8ab700","ssdeep":"192:UGzyLqIHa9I5lf3KuONvvG5upm/QE6cCRPc3dUZ2rCqm3dFd6C79WO8o+VQuqUvl:XCSvlc63ENUZ2mNbjUvP9","tlshash":"30f293f199ad48d05712e0c023577360ab85b329cf8ead29e1573c9ce6e671492e33ed","first_seen":"2023-09-26T15:43:28Z","last_seen":"2026-07-14T14:55:08.022061Z","times_seen":27,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.817Z","timestamp":1784040773817,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 28 Aug 2023 17:14:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64ecd5ef-15601\"\r\nexpires: Wed, 15 Jul 2026 02:52:53 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87553,"size_decoded":31160,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-07-14T18:17:09.530047Z","times_seen":967794,"resource_available":true,"data":null}},"time_used":741,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":741,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/jquery/jquery.masonry.min.js?ver=3.1.2b","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.826Z","timestamp":1784040773826,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.masonry.min.js?ver=3.1.2b HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Aug 2016 18:55:30 GMT\r\nvary: Accept-Encoding\r\netag: W/\"57b604a2-71b\"\r\nexpires: Wed, 15 Jul 2026 02:52:53 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1819,"size_decoded":1241,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1626)","md5":"cd0eb3406096ff80266e7c9d7d419186","sha1":"0e3709691bf96233766de30e2fd473b84166c5b6","sha256":"c2e606e1fc82ea3a554aad5d0520e25d2677b89a891dc5c49e7ace08fce92e25","sha512":"3caf5308cdbc5f42f1eccf5944e8ca785ac086b85954765c1f40d91bd9cc9f3fe6eb816ad821b534f9ad36395f4b6b5d361bea24eb272e94cad2824f03faaac6","ssdeep":"","tlshash":"2b31ee46a55137a067b372e5703f610f023aa7bc9242d1e8318ec6e289be4056633b36","first_seen":"2023-03-07T01:07:32Z","last_seen":"2026-07-14T18:48:41.780386Z","times_seen":26420,"resource_available":true,"data":null}},"time_used":1104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/uploads/2026/02/%E8%B7%A8%E5%B9%B3%E5%8F%B0%E6%B6%88%E6%81%AF%E5%90%8C%E6%AD%A5%EF%BC%9A%E7%A1%AE%E4%BF%9D%E8%81%8A%E5%A4%A9%E8%AE%B0%E5%BD%95%E4%B8%8D%E4%B8%A2%E5%A4%B13-430x350.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.834Z","timestamp":1784040773834,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E8%B7%A8%E5%B9%B3%E5%8F%B0%E6%B6%88%E6%81%AF%E5%90%8C%E6%AD%A5%EF%BC%9A%E7%A1%AE%E4%BF%9D%E8%81%8A%E5%A4%A9%E8%AE%B0%E5%BD%95%E4%B8%8D%E4%B8%A2%E5%A4%B13-430x350.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:54 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 25 Feb 2026 07:18:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699ea228-4e05\"\r\nexpires: Thu, 13 Aug 2026 14:52:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19973,"size_decoded":19539,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 430x350, components 3","md5":"12d0dc621d3d87d1af7b19d8f2522ce5","sha1":"6602ae1fd712a82e4e902c22098c2abf93189f9c","sha256":"3a88bfca4848fa750f3457ea86b0d73ddb9c74f1d941e068183dd4fe3e703b2e","sha512":"10b539ec06329395322921e5c465d9b64c5773996c9689d5602de31524cf5c33ae2cc111d7281813df854d76414f3d8bbd20db44e156d8a4709334a3cd29d05e","ssdeep":"384:j/8DyFQC5kC05EzCre23JJzkkzbv6ucLlFD8wcs0ZszGctrfXPVr5yauD:j/8DyFf5kCUEzGe23bkOmlVNB0ZsiCrw","tlshash":"1892d16747124185dc2909e7bc7fb5ededac7a30585eb42852b0ecc7f4257d294804bd","first_seen":"2026-07-14T14:53:32.480796Z","last_seen":"2026-07-14T14:55:08.00601Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1550,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1550,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/wp-emoji-release.min.js?ver=7.0.1","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:55.082Z","timestamp":1784040775082,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?ver=7.0.1 HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:55 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Jul 2026 21:14:39 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a500f3f-58e0\"\r\nexpires: Wed, 15 Jul 2026 02:52:55 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22752,"size_decoded":6011,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (19813)","md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-07-14T18:15:55.731613Z","times_seen":4621,"resource_available":true,"data":null}},"time_used":907,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":907,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/favicon.ico","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:57.453Z","timestamp":1784040777453,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:57 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"69802caf-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-07-14T18:15:11.643461Z","times_seen":312207,"resource_available":true,"data":null}},"time_used":656,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":656,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.819Z","timestamp":1784040773819,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 09 Jun 2023 05:49:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6482bd64-3509\"\r\nexpires: Wed, 15 Jul 2026 02:52:53 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13577,"size_decoded":5407,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-07-14T18:17:09.607443Z","times_seen":888589,"resource_available":true,"data":null}},"time_used":958,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":958,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/imagesloaded.min.js?ver=5.0.0","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.822Z","timestamp":1784040773822,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-includes/js/imagesloaded.min.js?ver=5.0.0 HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 11 Aug 2023 18:18:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64d67b72-1590\"\r\nexpires: Wed, 15 Jul 2026 02:52:53 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5520,"size_decoded":2338,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4358)","md5":"6823120876c9afc8929418c9a6f8e343","sha1":"90b0adb37d70ffec5f9189c36bb0027c310c9502","sha256":"b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1","sha512":"63d84226815c831245754adb30040ee72dcf218d01f991a5619675374bbe3b706e3721d32f5120d9d27e500813e8214244992b3875b3a7e7e4bc7ded5201183a","ssdeep":"96:PwSrH5hrG6Qpw1rIN2Bkqsu6B89w1y+7Y3qv5StcXyuC0r4oYeTnf49uVhWWTfju:PwSrq6Qpw1rI2k1u6i9woa3hSSCP9+XC","tlshash":"00b1318db7737563125aa0f2b31b430ab3b6509ea128419d765cecf39cb490a1973fb0","first_seen":"2023-11-08T01:34:44Z","last_seen":"2026-07-14T17:55:12.641714Z","times_seen":195968,"resource_available":true,"data":null}},"time_used":1039,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1039,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-includes/js/masonry.min.js?ver=4.2.2","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.824Z","timestamp":1784040773824,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-includes/js/masonry.min.js?ver=4.2.2 HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 13 Jun 2020 18:53:27 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ee520a7-5e4a\"\r\nexpires: Wed, 15 Jul 2026 02:52:53 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24138,"size_decoded":7931,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23966)","md5":"3b3fc826e58fc554108e4a651c9c7848","sha1":"76778fd446e2ff2377588a7b4ac4d79f258427c9","sha256":"e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb","sha512":"ae192d8d804f7dafd8b7a95220ceb66c0c308a51cdf42c172c20f71f50052e4529b01f8781c5f305e1e0d6c5367d9678f1d908ee4273db594fbb650c56a9f61b","ssdeep":"384:Ar7mIr/Dh5rA3rzB4rMhr/XWGHW/6rMz1xftF2OUVP4eAnbhfreD6dCBEOav7blM:+SxxGG2/71xftFqVP4eAnI0ROavPSCzo","tlshash":"b9b2848f73407425428bf16696af020fb137655c7a4790acba6ad8db1cb984d2037fbd","first_seen":"2023-03-07T01:02:57Z","last_seen":"2026-07-14T17:55:12.635728Z","times_seen":78935,"resource_available":true,"data":null}},"time_used":1105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/uploads/2026/02/%E6%96%87%E4%BB%B6%E4%BC%A0%E8%BE%93%E4%BC%98%E5%8C%96%E6%8A%80%E5%B7%A7%EF%BC%9A%E5%A4%A7%E6%96%87%E4%BB%B6%E7%A7%92%E4%BC%A0%E7%9A%843%E7%A7%8D%E6%96%B9%E6%B3%952-430x350.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.836Z","timestamp":1784040773836,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E6%96%87%E4%BB%B6%E4%BC%A0%E8%BE%93%E4%BC%98%E5%8C%96%E6%8A%80%E5%B7%A7%EF%BC%9A%E5%A4%A7%E6%96%87%E4%BB%B6%E7%A7%92%E4%BC%A0%E7%9A%843%E7%A7%8D%E6%96%B9%E6%B3%952-430x350.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:54 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 25 Feb 2026 07:25:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699ea3cd-58e5\"\r\nexpires: Thu, 13 Aug 2026 14:52:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22757,"size_decoded":22813,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 430x350, components 3","md5":"4050c902d6d564bb8b59382f67ed04f7","sha1":"c99f8834d12e91358163dcd14c10c6cf2d426349","sha256":"06e70d45448b91725203f2329d0adef7c6087978a79fe3adf12fbf227334a7f5","sha512":"a317c1a8273b01f1db4ab65c88e1e46c09e50e38fcc9df08aa23750c247064877ea7a2df0877193fb1185d90307a8448b8787feb49529090fd5432d3f1817d21","ssdeep":"384:jBa1r8CS0fPj4FeBo5likNZNumwWX+ycYxEmF83W/EezVNepHzG:jgr8CS6P2zikUmwjYKb3W8qKs","tlshash":"a3a2e1ed2785a545d10d2cb8190b1e36cb436fa0ae0c79600734ecc779b5de9df6c58a","first_seen":"2026-07-14T14:53:32.484182Z","last_seen":"2026-07-14T14:55:08.020236Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/uploads/2026/02/%E8%AF%AD%E9%9F%B3%E8%BD%AC%E6%96%87%E5%AD%97%E5%8A%9F%E8%83%BD%E5%9C%A8%E4%BC%9A%E8%AE%AE%E5%9C%BA%E6%99%AF%E4%B8%AD%E7%9A%84%E9%AB%98%E6%95%88%E5%BA%94%E7%94%A8%E6%A1%88%E4%BE%8B4-430x350.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.837Z","timestamp":1784040773837,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E8%AF%AD%E9%9F%B3%E8%BD%AC%E6%96%87%E5%AD%97%E5%8A%9F%E8%83%BD%E5%9C%A8%E4%BC%9A%E8%AE%AE%E5%9C%BA%E6%99%AF%E4%B8%AD%E7%9A%84%E9%AB%98%E6%95%88%E5%BA%94%E7%94%A8%E6%A1%88%E4%BE%8B4-430x350.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:54 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 25 Feb 2026 07:31:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699ea56b-57dc\"\r\nexpires: Thu, 13 Aug 2026 14:52:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22492,"size_decoded":22229,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 430x350, components 3","md5":"b37c6b08e59428dba4321fce32464819","sha1":"8c65358601bbb0ebe01d917f7173370cda7f552a","sha256":"319fc6959d70fd858b3b360102e619893f23d100629d1a77b3c2002f97be0e56","sha512":"0768e6dbe8ef0373e0fcd323837886249853bd2dcf34219752bce60142286147f83516dd27e377fb8419a5e4cd52912377cdc08419807f06aadd9a07a6c2a588","ssdeep":"384:jEnZehl2B3UrnAcoH0fJ49dkrAzlss33nvQpArEF7WXJWSbzfx3oA/gEj7FYSXtM:jE8Y36AcoEmPiO3n4pXF7g4A/RVYSdy3","tlshash":"e1a2e1732948a4c0ad8d2b6d5bfd1c4aed19ea587d40563b83b4dce3722b0d75a60a43","first_seen":"2026-07-14T14:53:32.485122Z","last_seen":"2026-07-14T14:55:08.011941Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1547,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1547,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/uploads/2026/02/%E7%AB%AF%E5%88%B0%E7%AB%AF%E5%8A%A0%E5%AF%86%E5%A6%82%E4%BD%95%E5%B7%A5%E4%BD%9C%EF%BC%9FSafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8%E6%9C%BA%E5%88%B6%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%902-430x350.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.839Z","timestamp":1784040773839,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E7%AB%AF%E5%88%B0%E7%AB%AF%E5%8A%A0%E5%AF%86%E5%A6%82%E4%BD%95%E5%B7%A5%E4%BD%9C%EF%BC%9FSafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8%E6%9C%BA%E5%88%B6%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%902-430x350.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:54 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 25 Feb 2026 07:35:43 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699ea64f-5a71\"\r\nexpires: Thu, 13 Aug 2026 14:52:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23153,"size_decoded":22896,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 430x350, components 3","md5":"859d181cc398b6751fbd2ff56ffd669c","sha1":"93d06c73b3cd009b12d858e29d41a89760b7f445","sha256":"22fde0ef06226fd0410422387cf87845c2323a034cb4b854e602e39de4018753","sha512":"5ef3304e5842be256d384d5350d9ff3cb3bfd86b7a516c5a06bc90e12959a0ee2a7fb95a4455a926e9d59f6ada7e864f8c908222ea46f3533ac633fffe36e911","ssdeep":"384:j/05XypVEIaV0Vj+jD2/Y1GQNwHiza413IbujB5ST9BvMhy6LlTvkU3cvwVJo88D:j/KHVw+jDooGHn41YSjB5kFKHdcUsvwu","tlshash":"bca2e003ef052b4b511d9de0b9070f195e165b1f75960ad3207a89ceb7d8ad28c6ec3d","first_seen":"2026-07-14T14:53:32.486208Z","last_seen":"2026-07-14T14:55:08.020909Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1545,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1545,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/uploads/2026/02/%E8%AF%AD%E9%9F%B3%E8%BD%AC%E6%96%87%E5%AD%97%E5%8A%9F%E8%83%BD%E5%9C%A8%E4%BC%9A%E8%AE%AE%E5%9C%BA%E6%99%AF%E4%B8%AD%E7%9A%84%E9%AB%98%E6%95%88%E5%BA%94%E7%94%A8%E6%A1%88%E4%BE%8B1-430x350.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.840Z","timestamp":1784040773840,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E8%AF%AD%E9%9F%B3%E8%BD%AC%E6%96%87%E5%AD%97%E5%8A%9F%E8%83%BD%E5%9C%A8%E4%BC%9A%E8%AE%AE%E5%9C%BA%E6%99%AF%E4%B8%AD%E7%9A%84%E9%AB%98%E6%95%88%E5%BA%94%E7%94%A8%E6%A1%88%E4%BE%8B1-430x350.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:54 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 25 Feb 2026 05:37:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699e8a91-6916\"\r\nexpires: Thu, 13 Aug 2026 14:52:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26902,"size_decoded":26684,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 430x350, components 3","md5":"525df9e1aca1007843321c3bcb6e2a4f","sha1":"20efc249fdef668143fc9babe271543898fbfcac","sha256":"10fd05ca0e4108da932727a9c3d3331475f25c41adaa714d99bbdc405084d6a7","sha512":"e12a3bf961fc4571b872107327d5b95b7043b8f4d6bf828f5db0895c63dd8568c50ad96f1e0be257074d1935bb4c601c5864beda56deba8b6c83a1248befffbd","ssdeep":"384:jFyQpxNTXyqR4U+xJPzKZ6SsyfjOMeR9n4/LVwSMnjPzg0MqsIS+FM/QXhZGkcQu:j3z4p1yf6bn4BwSkjC0SxIRZGVd","tlshash":"86c2e17b480ac1e232195fba421be2ebd78ec739101976c51fa0ebc7f6e50e5944c458","first_seen":"2026-07-14T14:53:32.487126Z","last_seen":"2026-07-14T14:55:08.012709Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1544,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1544,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:54.397Z","timestamp":1784040774397,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://safewonline.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48264\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 12 Jul 2026 10:14:35 GMT\r\nexpires: Mon, 12 Jul 2027 10:14:35 GMT\r\ncache-control: public, max-age=31536000\r\nage: 189499\r\nlast-modified: Tue, 09 Sep 2025 19:08:31 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48264,"size_decoded":49077,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48264, version 1.0","md5":"e401cae7a12911a5c9752dc7a62f9dd7","sha1":"5685dd613a8a8211bf60b4b10753a47587bd0b60","sha256":"b1bef1f03a77a36fc257c5525e32a1dd621bb6f935b743a419da7ed0b18dc8f5","sha512":"dc8b6f28bc048efb508b482199c958ffaeddf15431aad34544f5b9972fd8c19e0315f74499d5549b30e15a03e41bfaf2a30613b6889b9a693a9c87c4e872e1f3","ssdeep":"768:AWHBpvVWVHIgyYwXiDAOa6GWeFGaCfLBc/qiufIdQRuEl4ofxl8VKme:AWbEIgmi8uAFCfS/OfUYuRExl8VFe","tlshash":"1123f2e56c6a826bd88c882945ee21c1f3d7f4927713d149e8fa5df8c432c05ed5066b","first_seen":"2025-05-29T19:02:42.430777Z","last_seen":"2026-07-14T18:22:55.599271Z","times_seen":59422,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":3,"connect":31,"send":0,"wait":37,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/themes/anima/resources/js/frontend.js?ver=1.4.1.2","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.821Z","timestamp":1784040773821,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/themes/anima/resources/js/frontend.js?ver=1.4.1.2 HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Feb 2026 12:24:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69809760-4a7c\"\r\nexpires: Wed, 15 Jul 2026 02:52:53 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19068,"size_decoded":6078,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"cd55166da7086bc22f1cfe440d950fca","sha1":"bba65353ddb839431cbd833f99fd8df8b65e51b6","sha256":"7c1de8fd79f117c1ba93f353c1c44a01c089400adf510d5d3bea7057e964c3cc","sha512":"614fe964436633efb4674039fe3e1b73c0efb7b854673650f8d269349d5d5d77baf88144651253b948a4c8392ab67aca6a46132485cd80022dba74fe60dcc89c","ssdeep":"384:nZazJNuhhFJGwSp5MbaMgiuqX755XnRh86qmIStYCJ4zq8W+c:nZazJN8RQ5vMgiuqX75BnRh86qdeWc","tlshash":"e48283a4325a25be24bb3364e93fc224fd3b8076a345726db96d84c51f7045806e2efd","first_seen":"2023-03-07T01:36:39Z","last_seen":"2026-07-14T14:55:08.014019Z","times_seen":22,"resource_available":true,"data":null}},"time_used":1041,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1041,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/themes/anima/resources/images/headers/glasses.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.831Z","timestamp":1784040773831,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/themes/anima/resources/images/headers/glasses.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:53 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 02 Feb 2026 12:24:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69809760-631eb\"\r\nexpires: Thu, 13 Aug 2026 14:52:53 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":405995,"size_decoded":406334,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 2000x1100, components 3","md5":"16e54c6792255d28e47bdebbb34879b6","sha1":"7c89d29c72dcd74e0b490cc1e7af8dd29a866664","sha256":"0d620ccafbc340823ee82c2dd69e9b4300737406fdd9d451ba9eed44ca31e112","sha512":"b4895f11a164e5af50605c43919d7c093859229160aa3ac854971287ea5aca0cf28f6e4513db82d622b26617ee1a98fcc894042f39bf2b089cc7471497e5c940","ssdeep":"6144:8VpBvczPUAjjJZKsjDbuEQLd1RMp6FIoFxBL1e3l+j3JmVsyQLdulTBeZOJZ3M6K:8VcvKsTurOQF1+RE81Vdg","tlshash":"ae842309b7115ac11cc60d0487633e8a3e2ba2f277d7ecd175b0e8a173b265ace5e167","first_seen":"2026-04-07T06:06:08.354661Z","last_seen":"2026-07-14T14:55:08.014705Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1250,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"safewonline.xyz/wp-content/uploads/2026/02/%E5%A6%82%E4%BD%95%E8%AF%86%E5%88%AB%E9%92%93%E9%B1%BC%E9%93%BE%E6%8E%A5%EF%BC%9FSafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8%E6%8F%90%E7%A4%BA4-430x350.jpg","fqdn":"safewonline.xyz","domain":"safewonline.xyz","tld":"xyz"},"ip":{"addr":"38.63.176.147","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://safewonline.xyz/","date":"2026-07-14T14:52:53.841Z","timestamp":1784040773841,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"safewonline.xyz","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 05 Jun 2026 13:43:18 GMT","end":"Thu, 03 Sep 2026 13:43:17 GMT"},"fingerprint":{"sha1":"F9:B9:16:3E:C5:D3:87:77:C4:24:7A:FA:3C:56:9B:94:A9:F4:11:17","sha256":"50:25:EE:99:BB:C0:44:38:94:78:B0:B5:9D:6E:C6:D0:B6:B1:41:C0:09:F6:4E:3E:B8:FE:83:3F:58:DA:06:6B"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%E5%A6%82%E4%BD%95%E8%AF%86%E5%88%AB%E9%92%93%E9%B1%BC%E9%93%BE%E6%8E%A5%EF%BC%9FSafeW%E8%81%8A%E5%A4%A9%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8%E6%8F%90%E7%A4%BA4-430x350.jpg HTTP/1.1\r\nHost: safewonline.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://safewonline.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 14:52:54 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 24 Feb 2026 13:10:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da34c-3ce4\"\r\nexpires: Thu, 13 Aug 2026 14:52:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15588,"size_decoded":14902,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 430x350, components 3","md5":"6389be57e6700340f35d31297d3e7420","sha1":"b20f32550ea4832b89d279ddd11fd9fa0e39fdad","sha256":"85c0d93ea3bb9a850b26ea1c49a99bfd96a9f2976fd251daf5dcf4aae835fc07","sha512":"9cc07ee0cadb531c985c365b84a594f69ce45b32ef8dcf6a12d04c3ab0170bc6c4afad10d25449209f84e9a2d1f8909ccde051a4a776f6f2a579b54cc1c91d75","ssdeep":"384:jPMFDhE7x7M8kkIMINnWX+mybhjIq/PmW8:jPMl+M8k0gr7/y","tlshash":"0062be95095e48b7dcb9ef118c052b8ff291918ebd60339e00b3cd3e68815e912b56ac","first_seen":"2026-07-14T14:53:32.4899Z","last_seen":"2026-07-14T14:55:08.006786Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1543,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1543,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"safewonline.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}