{"report_id":"c4e88a5c-5a76-42ee-8e8d-4ea22cd84353","version":6,"status":"done","tags":[],"date":"2026-04-25T14:10:21Z","url":{"schema":"https","addr":"prenblog.com/niz/es/pre2?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":0,"asn":0,"as":"","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"title":"prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","dom":{"size":39,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"086707e4369f60afedcafb16050a7618","sha1":"8216b0cc6876cbd44f01c158e7dff3833ceccd41","sha256":"a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e","sha512":"aade21843813e2cab329b99185c6f61db7907a556ea974e0315dcf3ad967cab20fee66d4f10db0d0ec43a71e086ce6d700d5524103deaefa3ce5f6be74ba5737","ssdeep":"","tlshash":"6a9000fee0a2000efc303bc00cc2238a0c28c3a830028e002ac038b8c80822bcc032c8","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"2023-03-07T01:03:24Z","last_seen":"2026-08-08T04:15:18.550826Z","times_seen":1036129,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":0,"asn":0,"as":"","country":"Germany","country_code":"DE"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-30T14:10:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"mandarv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"mandarv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"prenblog.com","ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"domain_registered":"2022-05-27","domain_rank":0,"first_seen":"2022-07-25T15:16:36Z","last_seen":"2026-03-31T14:41:04.626526Z","alert_count":70,"request_count":35,"received_data":2545285,"sent_data":17985,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"cdn.leadbit.com","ip":{"addr":"162.248.160.4","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"domain_registered":"2013-10-28","domain_rank":0,"first_seen":"2017-02-01T19:51:41Z","last_seen":"2026-03-31T14:41:04.728244Z","alert_count":0,"request_count":1,"received_data":35356,"sent_data":430,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"mandarv.com","ip":{"addr":"49.12.46.246","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2022-07-05","domain_rank":4105442,"first_seen":"2022-07-05T15:19:55Z","last_seen":"2026-03-31T14:41:04.563032Z","alert_count":2,"request_count":1,"received_data":287,"sent_data":557,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"prenblog.com/cdn/js/jquery.js","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3576a6e73c9dccdbbc4a2cf8ff544ad7","sha1":"06e872300088b9ba8a08427d28ed0efcdf9c6ff5","sha256":"61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf","sha512":"27d41f6cfb8596a183d8261509aeb39fcffb3c48199c6a4ce6ab45381660c2e8e30e71b9c39163c78e98ceabc887f391b2d723ee5b92b6fbc81e48ac422e522b","ssdeep":"1536:s6IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:O+vIklosn/BLXjxzMhsSQ","tlshash":"b393f8ed73c6717243ab30ae40af610ef1365869280d8410f129e8f9bc79a499277f7d","size":93636,"data":"","first_seen":"2023-03-07T01:02:53Z","last_seen":"2026-08-08T02:08:47.152756Z","times_seen":37463,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"14ccbc1ab337a31b69788b161267139c","sha1":"c78b305ea6e9018c7a1ef45dac30c9e3c661c0ae","sha256":"24c0a84ec615132206e5fc3e1d91849140acb590cbd81979daae1e01a6e874d5","sha512":"3a016b0b6cb03ae5a7adebaf3ae8215f7e437b80eb5da4c8c908e035ad1d45434a738843dee35b54ea920604b1e7664edbf981b0f3729f77f05259e50f741411","ssdeep":"","tlshash":"7301fd9320c80674c12a3063de294b4eda719a993dd284363e0c52091ff1e22d3bdfe9","size":833,"data":"","first_seen":"2023-04-07T08:15:44Z","last_seen":"2026-04-25T14:10:25.227857Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mandarv.com/layer-data?callback=App.jsonCallback\u0026v=2\u0026page=prenblog.com%2Fniz%2Fes%2Fpre2\u0026iframe=false\u0026callback=App.jsonCallback\u0026TID=63d03d757eed7b540303ee13\u0026_=1777126198337","fqdn":"mandarv.com","domain":"mandarv.com","tld":"com"},"ip":{"addr":"49.12.46.246","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"65821ef0e83f806b139eaafcce937b14","sha1":"f9162ceda149f6de3d0ecb636bee307c53a3ef25","sha256":"06bd2685677ace0a313f23ac5f8df29094dc9aa3e7f0f0169463bd84db48de6c","sha512":"3956f1947aba0152441e747325a609d717dd4fe77c32d17acdc3f2e3f085bf30e634a5276937e40d648000fa14275d7cdf54a2448aacafa0374c408a6222b2be","ssdeep":"","tlshash":"1cc02b00184004c2b82d034d1c41c441524a38530b794fb70981de4809cc0400005386","size":132,"data":"","first_seen":"2026-04-25T14:10:25.196556Z","last_seen":"2026-04-25T14:10:25.196556Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/cdn/js/comebacker/comebacker.js","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"d78593ec7669ea80eb1d95a5d8ce51ba","sha1":"0af40b477a376c8920b196b8a24f8a4ed779bc58","sha256":"f884791990c5603c3d054df07ce5e59fed82e0f4fde0382f5d0337eed0585bf1","sha512":"2143c077954a39d453a662a1bdbbe419df38ce80d665bdbde05859628308a47c6d4a760b63663a635b0ded8e5b5ec74f2037ea58948457b21a9d3c0ca29cf166","ssdeep":"96:yNu0nDOkZJiH6fjdOroPSb2mNKPkbKQmKTCz9kItP1ZN5pmkC6w1VSTgmdop9CyJ:yodkZJk6aFNKPLQTlId1ZH7C6wu0Ka9d","tlshash":"86c1013917fba9054092902b9f2b69c47678403f3606ca683c1c7f690ffde144635ba8","size":5711,"data":"","first_seen":"2023-03-07T12:08:25Z","last_seen":"2026-04-25T14:10:25.220394Z","times_seen":44,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/cdn/js/lr.js","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"a43e6005c2cd4a286edda05c65be20f3","sha1":"e10860458a359805892ffc02a601f2a39740cd1b","sha256":"2e5ceb0db2381457a740cfd2772340ce813aca2f1adc97f1220070053adaa293","sha512":"c20192b34fa1f88471333866bbb55fbec564c480194273d5f764d4ecad92c0ace99abe74317b5de0ea4a887b30b903c78d6999507964dd4f60f13278e9d85f19","ssdeep":"96:TblWGbu1NxP9Hq1Pg7wvHzMjMHbjfFi3kSQM+PJsxbZBIu5H:flWGEHT7QuWPFeqJmB3H","tlshash":"5dd19489b091902953ee20bb862f1386b736545e340aa95cf765dcd16e7cd0f012bb3d","size":6706,"data":"","first_seen":"2025-10-31T01:42:56.822179Z","last_seen":"2026-04-25T14:10:25.215325Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/js/translater.js","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"61f9fcfff6f471ca671e93d2f58e4277","sha1":"121c7b86a611e0037ecb754fbe55d07bc486a5a3","sha256":"d63d9a4e13ce8e148eb690dc461568de87d3d632a6ee0e476e2cbcfe167fb7b6","sha512":"6e29f209a862b63a02cf02febf4c11abf98d8a1af8b73783af7810d4e715bb57878d12e02710109bde33b07a20d6e463d4f581b71fb25953c14ac1b591705842","ssdeep":"192:tAJhpA8P1h+5UhzPM4XqNzcnHp/zkApe0c9ne6btNxW+f2zrrWh1k82wZJ:mfpnP1UOhzPl+GQAp9cxDbtfWhrWjk8/","tlshash":"dd3276278a86075749f233c69282e933b147e0cd3204ce97f8bb965413df989968ba5d","size":11228,"data":"","first_seen":"2023-05-31T01:10:04Z","last_seen":"2026-04-25T14:10:25.188126Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/comm-7.jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/comm-7.jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 7926\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-1ef6\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7926,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality\", baseline, precision 8, 200x200, components 3","md5":"e52c5b513aa7836411e696c0c7bfdd70","sha1":"047520e6b8bbbc991e8b76a7a1584aba6d5d409b","sha256":"9ea3cd0dde4ec4460acd8040d0d529f47ce274bf8e44a5d8610ab82b77201a41","sha512":"2f6780c33162a90f51a59b0f597b45411432e3a295ea6cb1e4b008d8af4f7373f4b469deec11d59743c3903ba5e5d293f5f45529fd1bfe987726436ad9ce285a","ssdeep":"192:LQad+kwR8zPBRjylu0m35bvM4Q+1BTXWnLB6xw0bio4pzvdE:LRdfjTyUfO4Q+PS6rp4hva","tlshash":"c6f19d4e4393ba1ed3122f10625226fa07943e68ce5df2ff420fc2a9963de75491a231","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.183567Z","times_seen":42,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/photo(3).jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.143Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/photo(3).jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 42225\r\nlast-modified: Wed, 18 Mar 2020 17:04:16 GMT\r\netag: \"5e725490-a4f1\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42225,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 800x600, components 3","md5":"09f86cbff739f25cb7ee45a685a50f2f","sha1":"3d8448fd5401ecf14ff97d41d28f183a84ae0401","sha256":"bc255aa1761ab27a4d93d909264682225cdc684798ba38635832bd09bd4adb6d","sha512":"5d30c8901c17064892cc980515e4344560976c38027db6bb55fd2ef3500ab284164ad7a1eb4f1de4ed79f9cb05c906058c563b6e82850c08de1d03966ae3c2a4","ssdeep":"768:Y7cDuKJedTDkro2rfhufV9KBPQljibDAD5MFDFu69ZAaQnWplUXFEK/:Y7cD9eDkro21y9KBPIjgM5MVwDaQn0l+","tlshash":"9b13f19f3178b9da41ce1b22602c4711bb99c7460ab4ed7a2eadc6e817104f1de02e4e","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.185814Z","times_seen":41,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.leadbit.com/comebacker/default/comebacker_all_en.jpg","fqdn":"cdn.leadbit.com","domain":"leadbit.com","tld":"com"},"ip":{"addr":"162.248.160.4","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"leadbit.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Apr 2026 13:14:13 GMT","end":"Mon, 20 Jul 2026 13:14:12 GMT"},"fingerprint":{"sha1":"B4:BB:22:2A:FF:B2:7C:C1:C9:A2:BF:DA:C0:AF:BD:15:26:B9:9B:9F","sha256":"6A:FC:65:86:50:AD:38:7B:86:BE:74:1A:20:0F:B7:7F:7B:44:05:5D:83:39:CE:99:25:FF:37:72:DB:37:72:37"}}},"request":{"raw":"GET /comebacker/default/comebacker_all_en.jpg HTTP/1.1\r\nHost: cdn.leadbit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 35050\r\nlast-modified: Mon, 08 Feb 2016 17:06:16 GMT\r\netag: \"56b8cb08-88ea\"\r\nexpires: Sat, 25 Apr 2026 16:09:58 GMT\r\ncache-control: max-age=7200, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35050,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 610x180, components 3","md5":"096001e92315593c24a34c9aae4942d3","sha1":"7eb2b65aa5f710b7e5cfc0d65c4343c68df727e0","sha256":"fcb34398df36359d2e4f3c57fbbf3bb337898a225f6d15e16c9577c50da4e859","sha512":"ee7e5dcc409ddd2fc527d9fc55a095646ea513a5da2d79a198cabaaceeb440edaa619e0b21a892bb20d33a1675dc3c1758452cf89dbd2373270eddb7de16d7f7","ssdeep":"768:sO0DS1G7kIogEVBaYMsQ+nrcPeLDVwHuDUQhMJmvzBacmg:ssIVEVBaYn/rcPvwhEm15mg","tlshash":"34f2e0094078766ddfcfd65bd9a7db38f1210874fabac0522c8c90d37e9bba44914792","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.187314Z","times_seen":42,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":57,"dns":1,"connect":20,"send":0,"wait":42,"receive":1,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/js/translater.js","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/js/translater.js HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 12 May 2020 14:40:57 GMT\r\netag: W/\"5ebab579-2bfc\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11260,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (564), with CRLF line terminators","md5":"61f9fcfff6f471ca671e93d2f58e4277","sha1":"121c7b86a611e0037ecb754fbe55d07bc486a5a3","sha256":"d63d9a4e13ce8e148eb690dc461568de87d3d632a6ee0e476e2cbcfe167fb7b6","sha512":"6e29f209a862b63a02cf02febf4c11abf98d8a1af8b73783af7810d4e715bb57878d12e02710109bde33b07a20d6e463d4f581b71fb25953c14ac1b591705842","ssdeep":"192:tAJhpA8P1h+5UhzPM4XqNzcnHp/zkApe0c9ne6btNxW+f2zrrWh1k82wZJ:mfpnP1UOhzPl+GQAp9cxDbtfWhrWjk8/","tlshash":"dd3276278a86075749f233c69282e933b147e0cd3204ce97f8bb965413df989968ba5d","first_seen":"2023-05-31T01:10:04Z","last_seen":"2026-04-25T14:10:25.188126Z","times_seen":9,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/header.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.127Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/header.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 123394\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-1e202\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":123394,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1100 x 217, 8-bit/color RGBA, non-interlaced","md5":"c48b4ff7dc542438445715e6e36ff5d1","sha1":"e0d33e6386bfa0eb44529c45229e236c08b33d33","sha256":"ad2345f9e5ed131729f174f67b80db5fea0d6d61b4ba405536aed8d483a10bd5","sha512":"ef900297635f72e2adfabba56ac3ec912e10cb08eafb95ccc15672a825a6b248060215dd98daa5961ccb0534d9ffc0d3b263daac04abb1f018aab16d37dfad11","ssdeep":"3072:MjjOJr3pYevjI/g8QfU8rgv0LcbKCqUnEjjihn4f2PjT63qVO:MjjOJrCev04L5rgv9bKTUEnYtbVO","tlshash":"14c302c0cac5ced7eda5df5aa09bc7a5d8b6321422288bd47af4fdca4ec4d81426d904","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.189663Z","times_seen":42,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/Bloglovin-Icon.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/Bloglovin-Icon.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 47374\r\nlast-modified: Wed, 18 Mar 2020 17:04:12 GMT\r\netag: \"5e72548c-b90e\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47374,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1025 x 1025, 8-bit/color RGBA, non-interlaced","md5":"9b1e02ce724a9290889236411edffbd3","sha1":"ecde447232c85592f85c6d1e198d600cca907a77","sha256":"2bba498971e3e6be1834887dc9fa6d59114e0af21cdabc0c0bd28013af932fea","sha512":"8d0d949afbb99e9bd6cf32c5356032559f1e7fe242f313cffe64a2465c9553df047d343b1a7bb3ae8e27aadad70e82c9e9648696bdf4a4f8311d33def762cc88","ssdeep":"768:n/OigEX+aaa0sBnCybtAEa6p6AVj8wvb713PTrjDAig2DhRTkhaeWkE6vlS+Vu:nmW0+RtAEJp6AKeXhPTbXDhRdeWl6vlK","tlshash":"7923f1a945522af1d0d43d70fc8a9840bbd5afa703157a6ba4f0f12ecd3e65a70e71d0","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.191375Z","times_seen":42,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/authorization.css","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.126Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/authorization.css HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: text/css\r\ncontent-length: 1\r\nlast-modified: Wed, 18 Mar 2020 17:04:12 GMT\r\netag: \"5e72548c-1\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/css","magic":"very short file (no magic)","md5":"68b329da9893e34099c7d8ad5cb9c940","sha1":"adc83b19e793491b1c6ea0fd8b46cd9f32e592fc","sha256":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","sha512":"be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09","ssdeep":"","tlshash":"c700000000000000c00000300000000030300000000000000000000000000000000000","first_seen":"2023-03-07T01:02:54Z","last_seen":"2026-08-08T03:44:46.468564Z","times_seen":229071,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/product.jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/product.jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 395704\r\nlast-modified: Wed, 18 Mar 2020 17:04:16 GMT\r\netag: \"5e725490-609b8\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":395704,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1131x836, components 3","md5":"7dc63a0ca14cda2a5dc833862a6074c9","sha1":"b9b79fcd17b82d6691f342164b7f542d1ef0aa6d","sha256":"98f6085e0bd595f0cf92bb1915eaa5dd93a65bf00060bce882c8a140be808c3c","sha512":"23666427bb782b987f7771b9fdda5d2565b99868e6cd2e39b922f80918736f30fff6d82dc138ce031c67625fb3e60aee6cf6bb0e518a12ffbbaf105c8659a814","ssdeep":"6144:3xIA+A0n870Etr2sEcbxYhNZSfxdoh17qeyqCMzhBpwnnlLSEDKxSu5ykRIo7/G7:qa0EtrSc1eNZSfxg2ehwnlLSEWQMjTG7","tlshash":"4e8423a5ab41a6abf55e1d7c0e3701ec336b0081b861c0b9f0ef0479fee89164693d9d","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.194596Z","times_seen":43,"resource_available":false,"data":null}},"time_used":413,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":333,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/comm-3.jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/comm-3.jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 187835\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-2ddbb\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":187835,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"e16a439d8c0fccf69e2f6f5263b9bf5f","sha1":"b77fae37b0247ecc8e64d2f525b42da21db2b177","sha256":"4304924c0adefa2ee6190c2644758c7b08530efd37d78d09def8ab448ff0d006","sha512":"16d4f1e5528c824f1c2d5dc5d7f6318898ea09b78124debc02214adf39f5c7a93c036ff5705415723f35b1422f5b0733df603f9e3b7a22d717fe63d37cb89b05","ssdeep":"3072:9pmfrBqExeOEDUO5JiSSglDg2H/E1zkxjy3VOp1d6p/Bf0X6lLC9Q:S9qEzED3fiSSADLspejyFPBfzJSQ","tlshash":"950412c30425a64724b1ead243e21f7ce5cfb56df6ab808053d74fe84165f76825f4a2","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.195867Z","times_seen":42,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mandarv.com/layer-data?callback=App.jsonCallback\u0026v=2\u0026page=prenblog.com%2Fniz%2Fes%2Fpre2\u0026iframe=false\u0026callback=App.jsonCallback\u0026TID=63d03d757eed7b540303ee13\u0026_=1777126198337","fqdn":"mandarv.com","domain":"mandarv.com","tld":"com"},"ip":{"addr":"49.12.46.246","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.381Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mandarv.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 25 Feb 2026 12:18:49 GMT","end":"Tue, 26 May 2026 12:18:48 GMT"},"fingerprint":{"sha1":"C7:A6:67:9B:00:49:28:02:78:E4:E1:D5:67:A6:B0:77:A7:1B:CE:A7","sha256":"2D:E4:A8:F4:B0:7F:6E:74:C2:61:0B:C8:3C:BA:DF:2C:40:36:30:BF:58:DD:D5:03:19:FC:D5:F7:0D:3E:BF:3C"}}},"request":{"raw":"GET /layer-data?callback=App.jsonCallback\u0026v=2\u0026page=prenblog.com%2Fniz%2Fes%2Fpre2\u0026iframe=false\u0026callback=App.jsonCallback\u0026TID=63d03d757eed7b540303ee13\u0026_=1777126198337 HTTP/1.1\r\nHost: mandarv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 25 Apr 2026 14:09:58 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":132,"size_decoded":0,"mime_type":"application/json","magic":"ASCII text","md5":"65821ef0e83f806b139eaafcce937b14","sha1":"f9162ceda149f6de3d0ecb636bee307c53a3ef25","sha256":"06bd2685677ace0a313f23ac5f8df29094dc9aa3e7f0f0169463bd84db48de6c","sha512":"3956f1947aba0152441e747325a609d717dd4fe77c32d17acdc3f2e3f085bf30e634a5276937e40d648000fa14275d7cdf54a2448aacafa0374c408a6222b2be","ssdeep":"","tlshash":"1cc02b00184004c2b82d034d1c41c441524a38530b794fb70981de4809cc0400005386","first_seen":"2026-04-25T14:10:25.196556Z","last_seen":"2026-04-25T14:10:25.196556Z","times_seen":1,"resource_available":true,"data":null}},"time_used":347,"timings":{"blocked":154,"dns":72,"connect":37,"send":0,"wait":36,"receive":0,"ssl":45},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"mandarv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"mandarv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.594Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: text/html; charset=utf-8\r\nlast-modified: Tue, 21 Sep 2021 15:24:28 GMT\r\netag: W/\"6149f92c-12236\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":74294,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (869)","md5":"29b693149a15e309835414f3aa54a00a","sha1":"b48d95c52b45c709a95644fccc067d8dba2b34ce","sha256":"d0a9a0291c05b7a96058be4481b0c59c85c9bdaf67a0747ccffd496633aea73d","sha512":"f48464568190826084a88dd21b7b80b186dc6989ec5f460dfc8ffce75078c5385fb35528f350f219eb8e9e35ff1f69ebf9d13aef41c4a085de87fca5c46495f1","ssdeep":"1536:XQ8SAxt0OrfQ8y229dfSfq7wBtdMQ8i4bcpA44CQOVUucS1d9JoVgDha:A3ut5fM4SrWY","tlshash":"d273846195fa0937609391c9aa65eb1b3ed2920be7074a40b6fd1be41fcbc87ed0750c","first_seen":"2025-10-31T01:44:28.709642Z","last_seen":"2026-04-25T14:10:25.198574Z","times_seen":6,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/style.css","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/style.css HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 18 Mar 2020 17:04:16 GMT\r\netag: W/\"5e725490-29181\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":168321,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1901), with CRLF line terminators","md5":"9ce7b5a189d33e5e22b22845afe3e49e","sha1":"16bb2fb6ed9702491d7ce97bf7efcff432a65a30","sha256":"2bb1faf0248b8d5a672741dcdf4d0c82e802315d158210de5620003f70a82bb6","sha512":"0a40bdd8cb0646ce5a679a6305f8d637b1f04a8da5df295a6a443ad0b4b010ad293ec307788a4c9dfdcdd41bfb5e5238631fe02ff3d18252caccb9124f06cca7","ssdeep":"1536:iqXMcQ8enlz+TpMBgCWlFFG3Jiu/Dh6o89nAkdH:4PWTY1oD","tlshash":"eaf3c711da5360067032a7e46f220a9dff9083119f4614a9fbfd56078eb2de4f1a8f9d","first_seen":"2023-04-07T08:15:44Z","last_seen":"2026-04-25T14:10:25.199964Z","times_seen":32,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/comm-1.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/comm-1.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 112248\r\nlast-modified: Wed, 18 Mar 2020 17:04:12 GMT\r\netag: \"5e72548c-1b678\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":112248,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 297 x 288, 8-bit/color RGBA, non-interlaced","md5":"6893c35ca439aec8e182ba0a118a2738","sha1":"3839e63a4d9630865f70896620f22d35c9c684b7","sha256":"a1b07d7e1133d9b39921e0c8a5e5e50b09c2d745872e6d7a9433654805210b57","sha512":"3da02e18914394b299e3a05d9bbd2217a119345a6c544427f057405855afccf825fb61405d225c9cae20e854f10c65ea183889a9c1cc02610ae22d3dc9d4d283","ssdeep":"1536:h87DZyFZhV7zdfw1R2n+UGM9LR76bfEw0iEhyiMAlqKrZb+FO+qcmqrKaQn95wHo:0KZD7hfwflY9LR7uD09haAlqAhM496fA","tlshash":"11b312d826c65e623e1bae0e836a47288701b171457337959e320ecfe6fd45e6044a7e","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.201377Z","times_seen":41,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/photo(2).jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/photo(2).jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 110743\r\nlast-modified: Wed, 18 Mar 2020 17:04:16 GMT\r\netag: \"5e725490-1b097\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":110743,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 655x636, components 3","md5":"a3f9346f6e65d5ba0bf65bab73628c4f","sha1":"29c1dc7ce6cdd5cb96e1eead7c59959878afce4c","sha256":"017bef470a8c067bfacf083c8bb316ff7c0ee062dcebf6146447b12477faaa1e","sha512":"69e504d93d22ca59af480853015adf6cb4568ce06bf99604c4eb945a14c592c64f133dcf8caeae3d77e0e9de521293e263e594c32e21cd32bd3501b6cba24b46","ssdeep":"3072:tp/dZ/OkhFQeey3FwpSE/WzNQWt64KcGL9edTMj+6h:fGkhaeeUFwpZWZQWnKcG6n6h","tlshash":"99b3120e422770ce9b9e069410febba6c33b7bf946ab284c1535f258209055552efdef","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.202953Z","times_seen":41,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":78,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/comm-2.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/comm-2.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 266270\r\nlast-modified: Wed, 18 Mar 2020 17:04:12 GMT\r\netag: \"5e72548c-4101e\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":266270,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 391 x 399, 8-bit/color RGBA, non-interlaced","md5":"a7121c411ca4860e16948b477791a59d","sha1":"131e932badd3ffd660ff654abeb2dd2dc095d367","sha256":"eade7d796a99bd2e0f9e2b790090efec3609dcb74f371e4a1b0c4eac36c3fb9a","sha512":"656f0c8eed52f3f72af4780869c1e259124d30e064e406d1b2bf77b2ccd72a15ed33d0bee349900d9e697c31b1138d7a98b9441e4a2cfadcd6bfa8da005691c2","ssdeep":"6144:3LZkIJorvQVEGBzYgu3e7kwFoF4YkKaYCPi:bZJSKB57JFoe55i","tlshash":"7e4423f266a05b8038f955f7cc9b30bcd0bf68aa92841f4e4e5d58a2b57d0b3c60752c","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.204298Z","times_seen":42,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":136,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/cdn/js/jquery.js","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.124Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /cdn/js/jquery.js HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 08 Sep 2015 14:12:04 GMT\r\netag: W/\"55eeecb4-16dc4\"\r\nexpires: Sat, 25 Apr 2026 16:09:58 GMT\r\ncache-control: max-age=7200\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93636,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65483)","md5":"3576a6e73c9dccdbbc4a2cf8ff544ad7","sha1":"06e872300088b9ba8a08427d28ed0efcdf9c6ff5","sha256":"61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf","sha512":"27d41f6cfb8596a183d8261509aeb39fcffb3c48199c6a4ce6ab45381660c2e8e30e71b9c39163c78e98ceabc887f391b2d723ee5b92b6fbc81e48ac422e522b","ssdeep":"1536:s6IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:O+vIklosn/BLXjxzMhsSQ","tlshash":"b393f8ed73c6717243ab30ae40af610ef1365869280d8410f129e8f9bc79a499277f7d","first_seen":"2023-03-07T01:02:53Z","last_seen":"2026-08-08T02:08:47.152756Z","times_seen":37463,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/content-1.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.128Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/content-1.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 269504\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-41cc0\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":269504,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 483 x 362, 8-bit/color RGBA, non-interlaced","md5":"0b8a63d982ee4e09e0a99d674e987a7e","sha1":"52d8d43c3a904283bfee62dbd33e81ca3a65a528","sha256":"654a0aca70c4e31dae34bf8898427a4047e80a94ea0502a50075badf4cb986cf","sha512":"fc930ec233a6752b8983cae3ae9bb4587746ac0356fe5381062268441b4d2f4d34077c23629071a5d54741a959207fb47f0e61d97cf16942d859337a052c269a","ssdeep":"6144:vZHfRDjPFSfp8vRp0GLEGJ6pLHQDhfBA4VZK30LGUHOv9E:v9Hgp8vX0VGJfhfBAKM0VHOv9E","tlshash":"5c441244ef6b386434a626aff5589b0cbd1c0216c5d5da607e1f1d7a0f02fcd6a22a37","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.206311Z","times_seen":42,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/icon18_wrench_allbkg.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/icon18_wrench_allbkg.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 475\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-1db\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":475,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 18 x 18, 8-bit colormap, non-interlaced","md5":"f617effe6d96c15acfea8b2e8aae551f","sha1":"6d676af11ad2e84b620cce4d5992b657cb2d8ab6","sha256":"d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b","sha512":"3189a6281ad065848afc700a47bea885cd3905dae11ccb28b88c81d3b28f73f4dfa2d5d1883bb9325dc7729a32aa29b7d1181ae5752df00f6931624b50571986","ssdeep":"","tlshash":"05f0dcc117d54d91d5b90977e51d013659e1500b66374bcf19b69034ae79108e0f92e5","first_seen":"2023-04-14T12:22:04Z","last_seen":"2026-08-03T11:05:19.279334Z","times_seen":1041,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/facebook-logo-button.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/facebook-logo-button.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 6768\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-1a70\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6768,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 167 x 167, 8-bit/color RGBA, non-interlaced","md5":"66232f46d9113d46a242e2bb96245186","sha1":"12a6eb776bf401968519b8a031f808e735316b2b","sha256":"4fc050fcb901b3716a072da3de82b05c369583cb8a825cc2df04a698eebc7735","sha512":"eec0ec78b2da23794f88247f7eb1e0302b5723f557818d393b8768b2f07f7cc94dd6b7dd20e6f403be8d6c1bbdf2f79112f630f66f8b6262843af12675022819","ssdeep":"192:MG79Yz8wTp6hcx4XS0m83CMHdFVgtEA21H:MygHTpuHSpmCMHdFVtH","tlshash":"d3d1af822a960f7dc0356e2897592393cd82f140b931b57dd6a8e2bb31be7604797883","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.208947Z","times_seen":42,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/google-plus-logo-button.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/google-plus-logo-button.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 8759\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-2237\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8759,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 167 x 167, 8-bit/color RGBA, non-interlaced","md5":"432760c6573ed2ce0a87efa1d4113333","sha1":"e7bb520af1d3f5aa9d0dafdf87e45c70c8a23142","sha256":"91c6f752b82cc3343de0af83aebf429838607a713325b9f598760f649148806a","sha512":"a3b5e7369e6b937a8660ae109aecd62b290fb8d2fdd3497bbaa41f27fcde2aaed4f4651c01dd9e589733e9cc4563f65fb961a3ffdc30c956e1b31a4f558275a3","ssdeep":"192:MG79Yz8wTp6hczhcVqvaECLTcimueLKDq3obxzkJmVo:MygHTpuUGWtCPciOLKRVk8+","tlshash":"8302bfe526600ed1c159bfbbc14613eec0d5b190c37b5eaf6a1b91b2d5e8f6101c6743","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.210405Z","times_seen":42,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/instagram-logo.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.148Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/instagram-logo.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 8410\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-20da\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8410,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 167 x 167, 8-bit/color RGBA, non-interlaced","md5":"7e44ce769336c24dd03f401c2f962877","sha1":"2969c59862bb0d4471104e3aa9e933bf3a91b118","sha256":"9de2ea2db06ae148dee859fd8955949a603574df198cf79f8e22cd79d906ead1","sha512":"42587486fedc7395c46804204c6c701aca05dc77079d4bb93984611dec1f67d088bc0e2935019770419f9d7a57f3af2e57630b9ba2200c1c52fd86c6e2a2d7ea","ssdeep":"192:MG79Yz8wTp6hcu/IFT8R869osiEKrYV98sebwyrCLqo:MygHTpuhI29oPEAYYKyYH","tlshash":"9b02af087f1d8f76d5815d2324c3a54ad852f328977a41bfe87be1fa54ecb014a0a831","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.211644Z","times_seen":42,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/pinterest-logotype-circle.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/pinterest-logotype-circle.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 17892\r\nlast-modified: Wed, 18 Mar 2020 17:04:16 GMT\r\netag: \"5e725490-45e4\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17892,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 379 x 379, 8-bit/color RGBA, non-interlaced","md5":"5bfe7fe3eaaaba2a094b2d7115688ae5","sha1":"54b464c129be423455e73a4de0a0197bff9fa76f","sha256":"d7e1f5d6f8291890e9183025efe44cafc984a666ba8e190e29464e2f91462dee","sha512":"44b003c2307ae611517c834ec5d20b250e7771a1070b1c1cdda4704ebdc0823aaafd98f1b78fd221af0a105e61910b82df08ab1b8f91cdc5e312202b6dc45572","ssdeep":"384:FygHTpu7b72m7Ih2JSCJ4MVe/4FvxgMkiejOeM19YKvhIHM6qUcAm9:F/S72m7mMJU4FvxgMkiejS19Y0qDch9","tlshash":"d082c08566091fbeb02336e0584dabbbc0606a10761a2235edfc5fb7c141cb2dee540f","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.212813Z","times_seen":42,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/translate_24dp.png","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/translate_24dp.png HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 825\r\nlast-modified: Wed, 18 Mar 2020 17:04:16 GMT\r\netag: \"5e725490-339\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":825,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced","md5":"55ff382a8b09329e3230a1797eb8f5fd","sha1":"026ae089006a674da7dcc9bf6b986c5d59e75478","sha256":"1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213","sha512":"e787c75cd8f6796de116fdbe0d7b8a3707bb09e02fe3d9f3fa15e5d783931023dbd62344d5178f547e401dba160f0382a1204db09efb322273c7525e592edd79","ssdeep":"","tlshash":"c001d6f78abb02e96290e29fc3d166009b0c7666c11f053dee9c3c9a074fed4a253148","first_seen":"2023-04-10T07:01:36Z","last_seen":"2026-04-25T14:10:25.213986Z","times_seen":130,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-25T14:09:57.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:57 GMT\r\ncontent-type: text/html\r\ncontent-length: 166\r\nlocation: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74294,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T04:24:20.804972Z","times_seen":17772833,"resource_available":true,"data":null}},"time_used":252,"timings":{"blocked":112,"dns":61,"connect":20,"send":0,"wait":23,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/cdn/js/lr.js","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.125Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /cdn/js/lr.js HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 05 Jun 2025 13:30:48 GMT\r\netag: W/\"68419c08-1a32\"\r\nexpires: Sat, 25 Apr 2026 16:09:58 GMT\r\ncache-control: max-age=7200\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6706,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (6706), with no line terminators","md5":"a43e6005c2cd4a286edda05c65be20f3","sha1":"e10860458a359805892ffc02a601f2a39740cd1b","sha256":"2e5ceb0db2381457a740cfd2772340ce813aca2f1adc97f1220070053adaa293","sha512":"c20192b34fa1f88471333866bbb55fbec564c480194273d5f764d4ecad92c0ace99abe74317b5de0ea4a887b30b903c78d6999507964dd4f60f13278e9d85f19","ssdeep":"96:TblWGbu1NxP9Hq1Pg7wvHzMjMHbjfFi3kSQM+PJsxbZBIu5H:flWGEHT7QuWPFeqJmB3H","tlshash":"5dd19489b091902953ee20bb862f1386b736545e340aa95cf765dcd16e7cd0f012bb3d","first_seen":"2025-10-31T01:42:56.822179Z","last_seen":"2026-04-25T14:10:25.215325Z","times_seen":30,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/content-2.jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/content-2.jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 28754\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-7052\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28754,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 80\", baseline, precision 8, 500x332, components 3","md5":"ddc8fb64f89f81b63a2cfcc537502c59","sha1":"a9b78163de527efe80a10b2e1e8d2dd549d5f1b3","sha256":"51f9ae8f46023943e0006ac502774fa612aaa124bf38fc77b2205ca532220f83","sha512":"d46d4382391c437be4644d2a2450f1d5e1b29703f9a0cb07f2e1ea6beebe01e24a4ed2b10a141c4e352252132924171ab93a7a16bf18741e4eb415afb1dc8a34","ssdeep":"384:wkkbg9N9YTatwNlfOtq/bLk21FXQmskGksCIggKyRfbUrzb7/EW/WeHjIlGeZZ+s:wkk8j9YpBs2Hrry9UD4kjIlAEP","tlshash":"1dd2e1402ce36e44b596dabb01f2b2ccf0256ae2283ddf5d553af0d49d516cc2ab88c8","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.216071Z","times_seen":42,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/content-6.jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.135Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/content-6.jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 47470\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-b96e\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47470,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 960x720, components 3","md5":"5317939721b64832c14837a639320409","sha1":"ad8e042b2770ed7d2f4498da535ca873c55f0792","sha256":"ff093adbf20b5c3d7bb46a77389d7f9a6334c1f71656226ffc2d488e5677e5b8","sha512":"46590efa31def2906833241f046d3a893012e6fcfcf81f2fd4020888ddd6d29119c5a8dcecdf2daa3a745c63ad7df13123a520f74a7c0eed5c2f2ead543dc0a9","ssdeep":"768:tqd9kAfxDPKltyrhAUwwwe31g74erGpQYebLq2iv+J+cN+PKQw37nIlQVa2GN:gd9k2xDPQxwJO7KSbLqq+PP67Q","tlshash":"7723e1ad2b1c19b3d3ab9afe09cd3e823f4b675d294323cdb457741e853061209a1a68","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.217631Z","times_seen":42,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/comm-2.jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.139Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/comm-2.jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 5636\r\nlast-modified: Wed, 18 Mar 2020 17:04:12 GMT\r\netag: \"5e72548c-1604\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5636,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 200x200, segment length 16, baseline, precision 8, 180x179, components 3","md5":"a30ab064a1e2385bf12205d0bff5b881","sha1":"05426265ee05899c4b586c2ffedcafe9482607bf","sha256":"c79cc4fe80cbf69bab181c1b7aeb72f7a1bcd0f6cd0614f5e3a9d539a6be9f52","sha512":"335e85a2f5f87aea69dd20a3be034f6596170b3560910c88ff508f87bbd036c0c28b6343d66fe57c14dc8d76e8d2b3d1430f28c69351bce51e51171b3fd60c0d","ssdeep":"96:Za4V+nT/IyYYTXkRwBRU4PPffmsQlfxmy624+/IyT:ZjV+nTAyYYT0RwBRXesAm6IyT","tlshash":"4dc19d36f09d201de9a7fabc1cf13eb2b84aad5e7de12e0f211930a3a1824224472001","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.218879Z","times_seen":42,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":78,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/cdn/js/comebacker/comebacker.js","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /cdn/js/comebacker/comebacker.js HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 21 Oct 2016 10:53:22 GMT\r\netag: W/\"5809f3a2-164f\"\r\nexpires: Sat, 25 Apr 2026 16:09:58 GMT\r\ncache-control: max-age=7200\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5711,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (304)","md5":"d78593ec7669ea80eb1d95a5d8ce51ba","sha1":"0af40b477a376c8920b196b8a24f8a4ed779bc58","sha256":"f884791990c5603c3d054df07ce5e59fed82e0f4fde0382f5d0337eed0585bf1","sha512":"2143c077954a39d453a662a1bdbbe419df38ce80d665bdbde05859628308a47c6d4a760b63663a635b0ded8e5b5ec74f2037ea58948457b21a9d3c0ca29cf166","ssdeep":"96:yNu0nDOkZJiH6fjdOroPSb2mNKPkbKQmKTCz9kItP1ZN5pmkC6w1VSTgmdop9CyJ:yodkZJk6aFNKPLQTlId1ZH7C6wu0Ka9d","tlshash":"86c1013917fba9054092902b9f2b69c47678403f3606ca683c1c7f690ffde144635ba8","first_seen":"2023-03-07T12:08:25Z","last_seen":"2026-04-25T14:10:25.220394Z","times_seen":44,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-25T14:09:57.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:57 GMT\r\ncontent-type: text/html; charset=utf-8\r\nlast-modified: Tue, 21 Sep 2021 15:24:28 GMT\r\netag: W/\"6149f92c-12236\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74294,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (869)","md5":"29b693149a15e309835414f3aa54a00a","sha1":"b48d95c52b45c709a95644fccc067d8dba2b34ce","sha256":"d0a9a0291c05b7a96058be4481b0c59c85c9bdaf67a0747ccffd496633aea73d","sha512":"f48464568190826084a88dd21b7b80b186dc6989ec5f460dfc8ffce75078c5385fb35528f350f219eb8e9e35ff1f69ebf9d13aef41c4a085de87fca5c46495f1","ssdeep":"1536:XQ8SAxt0OrfQ8y229dfSfq7wBtdMQ8i4bcpA44CQOVUucS1d9JoVgDha:A3ut5fM4SrWY","tlshash":"d273846195fa0937609391c9aa65eb1b3ed2920be7074a40b6fd1be41fcbc87ed0750c","first_seen":"2025-10-31T01:44:28.709642Z","last_seen":"2026-04-25T14:10:25.198574Z","times_seen":6,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/translateelement.css","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/translateelement.css HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 18 Mar 2020 17:04:16 GMT\r\netag: W/\"5e725490-4906\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18694,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (18640)","md5":"f31412e050a29ba842bf1e66b871016e","sha1":"ec787470d08847ebfcb23131565d23205b41f91f","sha256":"c8df1e8929a3ba6d84700e19cca7ca12a840ce408d79fd3129cd2aa00d544767","sha512":"e61271413283194367f3e88c74672999655a13f0fc45199c97436a2c27e77c4d7c61e1c09cb9603ab14c01b77cfca43baec33aed05c89152bc340e042eec7b07","ssdeep":"384:Z6/FpzOTH+pYwFQQFzosq6yzGy60wQHZAOcUcmMt0wGq6K:Z4FxskYwFQdcUcmMp","tlshash":"5a8231707564102cf02bc6b6b5c0b9cd62228a66d712463bbbedb55ddac12f9073b326","first_seen":"2023-04-07T08:15:44Z","last_seen":"2026-04-25T14:10:25.221506Z","times_seen":40,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/content-3.jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/content-3.jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 59633\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-e8f1\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59633,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 960x540, components 3","md5":"47a13e35155e969a8d0e8807dd68fa21","sha1":"669b4ebad0ca19d2d3f92848076dd003b8bb7926","sha256":"58de00e477633046ac3c102f300a901b3b0bd471c5f746936d0f9f8d477a056d","sha512":"c449263d35c826323f3272ad4074b6c2b8a2f21661d6ed98ea449338de5ebb8af183ad47ef89edf1ecbd6f806e728effc9715ed01854a8283fb7dde955a70f07","ssdeep":"1536:09+hgamSNrAY6YunQA9+rnQOqVzLL3wYuq/oLMWglPM8bH:vhzmi6Yut9k3qVzwLLMZPFH","tlshash":"054302a6eadcbe87fc7358b9192fb99207a16514432e7e5b38698e3c07150e3b908510","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.222152Z","times_seen":42,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/content-4.jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.132Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/content-4.jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 38109\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-94dd\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38109,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 75\", baseline, precision 8, 1142x846, components 3","md5":"0eb0c228e626cb4ee0a683ffed6d3dcb","sha1":"0d26bdee84007483e9abdb927610309c79397506","sha256":"cf9923cd482a858781586684f0c6276ce3548000efac3b35ce02a0bc4cf85ed1","sha512":"c2a9a36a74f14d18c35365fd1085392327929c03e2d09491b0bb70dc26e3b6c6ab7b609d8b5a81ad190da372698066bb1a2aef1b902fb5b6c54b3809714f368e","ssdeep":"768:/BAgXXMR87ndj+p8oR/fg85zwoBHKcDXFNtDy/Xon:/mgHHn1voR/15EKHP7I/2","tlshash":"c203c7139c185b83e12987e4be035dad6f5a7b4ce99239ff41234edb3e241620d9d12e","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.222888Z","times_seen":41,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/content-5.jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.134Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/content-5.jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 132430\r\nlast-modified: Wed, 18 Mar 2020 17:04:14 GMT\r\netag: \"5e72548e-2054e\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":132430,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 918x918, components 3","md5":"a91dddf08f26b42894d2aa762485f547","sha1":"ea32e217751df8b0af1cb1ef0a6a6178e45d5630","sha256":"dfff7ed9ce46238607199d75d4f2f3faf6a55bb9ca6f12c3d3651e1bc5d7c09e","sha512":"eedb39f5450dc159e3bd85bb3c7c1f7e0367a604713b8dcb7a13c7e175075581d238dc62e3624732540ffa93a7dc45fa0565dc091dcf20902f274ba0cb2ded27","ssdeep":"3072:uvO5sXgLNytwu0DxF3BsVTD3p6y87WqCgjWAxd5:IfXgLNytDAxF3+VTbwJWAX5","tlshash":"a4d3138b7bce4e5dd72cacb98a95533bb454574e0c9802c78e97868b0760be74dc7903","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.224022Z","times_seen":42,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/photo(4).jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.144Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/photo(4).jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 37742\r\nlast-modified: Wed, 18 Mar 2020 17:04:16 GMT\r\netag: \"5e725490-936e\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37742,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 93\", baseline, precision 8, 308x327, components 3","md5":"0367dd74d23cf14d72a15e9f39243306","sha1":"b731ecc61d2f8dea49122b46ab601905e41b4ed4","sha256":"cd81ed9db85d595a7405e09dbfd80a794034a1659c1f97dda3f6e8aae6dceee3","sha512":"8fc55ad0b589d7945b2f7f3ce5a5057f951061dd84b19d459fb12a25a0daa5eb8c6e9a290dc1a15b17d6e1eda8ae3fc4aa7f488179b81b2bed572b299bbb3e3f","ssdeep":"768:0enXx1td8EXwz92BQLRe8p1t+0hahVvRXoy7C/WS:0enTUIQLRhH+0hIvRXlw","tlshash":"b403f239ba905bdb61026358db8d99c6b3a203390bbff64f7abf440e3658444c61b309","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.22519Z","times_seen":42,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/3597120983-css_bundle_v2.css","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/3597120983-css_bundle_v2.css HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 18 Mar 2020 17:04:12 GMT\r\netag: W/\"5e72548c-ba32\"\r\nexpires: Tue, 20 Apr 2027 14:09:58 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47666,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (682), with CRLF line terminators","md5":"2a1be08571051207ccc882e55d6dd368","sha1":"f12fad206681bd359940d8be424e8ca9627fc549","sha256":"5d39f194589a779f98986438355b7d3bedb388aba58560e885e1d15165c321d6","sha512":"05db73d5e48a3689baf518904c1bb6e46ee6225c8935b777163f062a47f9b4835d0000d4f4567d064c001ef6acab16b2cba71a03b30e5e74bb8f35521ff80a3d","ssdeep":"384:UDxnIoBmOEfm49APQN8zltcXPWq/fAF4fmlhbY8P8SO9f7IOlwQXsXuqzp:UDxxBZEt9AS8zltcNXXzluQXsXuqF","tlshash":"73236320da42240ba23bcb787bf69741fb5444b3db0601adbbd572988ff59b84422f5d","first_seen":"2023-04-07T08:15:44Z","last_seen":"2026-04-25T14:10:25.226458Z","times_seen":41,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"prenblog.com/niz/es/pre2/index_files/photo(1).jpg","fqdn":"prenblog.com","domain":"prenblog.com","tld":"com"},"ip":{"addr":"162.248.160.45","port":443,"asn":0,"as":"","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com","date":"2026-04-25T14:09:58.138Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prenblog.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sun, 29 Mar 2026 22:36:12 GMT","end":"Sat, 27 Jun 2026 22:36:11 GMT"},"fingerprint":{"sha1":"12:23:17:6A:D2:73:6D:DD:EA:1F:D5:0F:A8:4F:3E:B2:F8:14:1B:64","sha256":"FF:C2:1C:F5:6D:AE:27:55:AC:F7:A2:D3:6C:3B:C4:51:5C:32:27:2A:B8:76:3F:63:48:63:FD:D5:08:A1:54:5E"}}},"request":{"raw":"GET /niz/es/pre2/index_files/photo(1).jpg HTTP/1.1\r\nHost: prenblog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prenblog.com/niz/es/pre2/?tid=63d03d757eed7b540303ee13\u0026host=mandarv.com\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 25 Apr 2026 14:09:58 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 2838\r\nlast-modified: Wed, 18 Mar 2020 17:04:16 GMT\r\netag: \"5e725490-b16\"\r\nexpires: Tue, 20 Apr 2027 14:09:57 GMT\r\ncache-control: max-age=31104000, public\r\nx-static-region: DE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2838,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 93\", baseline, precision 8, 100x100, components 3","md5":"2077dec28ddb93ae36bb8709da93aeb5","sha1":"65539299507034484c0a9c95b11c1737cc1ee1c7","sha256":"d4121f02fc065036fa536fce0a6c85a23ab523f47a2ec8671a8025a65eed26f8","sha512":"5a61fd0cebef1aec45a164640498234ffb4ffbe54a7d22c2dc24ce800b70cb84968a9c96d2b106acf7bb550758ade891b3900982d66241f0fbdfabfe344ed8b1","ssdeep":"","tlshash":"70517c5b73568338656ad7a1edb410359b0da7b3b9307a9cb67002f1f2704caca9ca0d","first_seen":"2023-05-22T15:20:24Z","last_seen":"2026-04-25T14:10:25.227151Z","times_seen":42,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":78,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-25","alert":"Sinkholed","trigger":"prenblog.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}