{"report_id":"c81be368-ce3c-43fe-86d3-59710d90fe96","version":0,"status":"done","tags":[],"date":"2026-07-14T13:13:42Z","url":{"schema":"http","addr":"kv.lirdlfq.com/adobe","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":0,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/checking.php","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"title":"Background Image Page","dom":{"size":3069,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"8de8153df94b54f8b593cb0afef59c4c","sha1":"a9798dea9b9e9f9dcff45953f196c8cf2849f9cc","sha256":"48d759aa8d6460b130abd7d73ac94ea7e9750f745fe075f31bc19835e141f113","sha512":"7371d842381713afc22e9da925a7805332e1c9dace4b1d0cbc75207a68788298541d14c184530f9022dde52c53f4f608c4d244f8bd6f329daab6b5f2ae996430","ssdeep":"","tlshash":"00515246a8f7045b7a4790752ff36b062661c403c60ace2d3bad32d8cf85ad994a738c","dom_hash":"domhash108f256334d347edadd16143e8e209c2","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"kv.lirdlfq.com/adobe","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":0,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-18T13:13:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"kv.lirdlfq.com","ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"domain_registered":"2026-05-30","domain_rank":0,"first_seen":"2026-07-11T13:06:10.102637Z","last_seen":"2026-07-11T13:06:10.102637Z","alert_count":11,"request_count":11,"received_data":159421,"sent_data":5971,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-12T22:19:35.511658Z","alert_count":0,"request_count":2,"received_data":17256,"sent_data":1110,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-12T22:22:25.184057Z","alert_count":0,"request_count":1,"received_data":5476,"sent_data":532,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d6ccc5a48d690c1aef559c7d530eb43c","sha1":"18fb6676b6c20ba97db1ff8a4caddc3e5b809a1f","sha256":"caf8ef1d425b20f84bfd82c8a53c10e7501697a05629af72496417b59730bd2c","sha512":"85a273ae17dbbe89005265118303dca466818ce09fb90c9802b3f03f3715a72c8ad933e7da17cf2413a81689feb9b74ae12b496fbb31d428c64c4cab7c83f0b3","ssdeep":"","tlshash":"2d80008e0220030032f200038a0b2300282300eba888e08000aa0000f83030f022a8cb","size":27,"data":"","first_seen":"2025-11-07T19:27:09.928239Z","last_seen":"2026-07-16T18:01:38.070495Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/224.php","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d99f8c953ef08a84152b7bd63092301","sha1":"a6970440d9e8f3a6443022127eb4c9c54f2f7349","sha256":"b38777a7d601ac20fed848c01a0ec6298ca74c1a8385a31547cd5ed121e15a35","sha512":"0acbcd32c7970094afb7bd2fa6045451090073eafb67aa9cfc54806366ccc80ad6fe4b4f81bc28a653a4386063eaa863e325352cecdc9c4947d465eb8f8a217b","ssdeep":"","tlshash":"90b0924a18b6001c366320124aab2a0936a62677014cba5d3d2ca6921f8824e51a72d9","size":118,"data":"","first_seen":"2026-07-14T12:16:46.352274Z","last_seen":"2026-07-16T12:54:47.078697Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/checking.php","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"66d2876628581602708ac30d3b81bdef","sha1":"5dbb4530cf126ed98af68ed276b75800bded095e","sha256":"aba5277a1bf8c10da6d045cae8f8eb2ff633f549be966f04af60cc2823669548","sha512":"e0ae16992889a3b74e102832172fd81c535efdb4642294560c891af1cc0b192cc196e246641b6d54fb76ffc7b0dd16cb9ab776230f3a900ea3ea61f1b066b2d2","ssdeep":"","tlshash":"8de0d85b74a60ab81b9b64650aa75b84703290570408d204397e86a01f75d5d343e7de","size":375,"data":"","first_seen":"2026-07-14T03:32:48.389429Z","last_seen":"2026-07-17T01:20:18.316694Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Redirecting...","filename":"https://kv.lirdlfq.com/adobe/Windows/224.php","line_number":60,"column_number":17}]},"http":[{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T13:13:15.937Z","timestamp":1784034795937,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET /adobe HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Tue, 14 Jul 2026 13:13:16 GMT\r\nServer: Apache\r\nLocation: https://kv.lirdlfq.com/adobe/\r\nContent-Length: 277\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T17:40:25.636702Z","times_seen":17320310,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T13:13:16.300Z","timestamp":1784034796300,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET /adobe/ HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 14 Jul 2026 13:13:16 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T17:40:25.636702Z","times_seen":17320310,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T13:13:16.595Z","timestamp":1784034796595,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kv.lirdlfq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 22:25:42 GMT","end":"Sat, 29 Aug 2026 22:25:41 GMT"},"fingerprint":{"sha1":"99:4A:B1:97:0F:87:C6:40:4F:01:E5:44:B4:D4:E3:22:78:C7:D9:62","sha256":"2A:19:06:BD:B5:27:B0:4F:54:FF:80:52:41:84:47:9E:12:31:33:68:9C:7B:52:E8:9B:20:48:11:74:FB:31:A8"}}},"request":{"raw":"GET /adobe/Windows/ HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kv.lirdlfq.com/adobe/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nDate: Tue, 14 Jul 2026 13:13:16 GMT\r\nServer: Apache\r\nLocation: visit.php\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T17:40:25.636702Z","times_seen":17320310,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/visit.php","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T13:13:16.687Z","timestamp":1784034796687,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kv.lirdlfq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 22:25:42 GMT","end":"Sat, 29 Aug 2026 22:25:41 GMT"},"fingerprint":{"sha1":"99:4A:B1:97:0F:87:C6:40:4F:01:E5:44:B4:D4:E3:22:78:C7:D9:62","sha256":"2A:19:06:BD:B5:27:B0:4F:54:FF:80:52:41:84:47:9E:12:31:33:68:9C:7B:52:E8:9B:20:48:11:74:FB:31:A8"}}},"request":{"raw":"GET /adobe/Windows/visit.php HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://kv.lirdlfq.com/adobe/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nDate: Tue, 14 Jul 2026 13:13:16 GMT\r\nServer: Apache\r\nLocation: 224.php\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T17:40:25.636702Z","times_seen":17320310,"resource_available":true,"data":null}},"time_used":410,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":410,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/img/adobe-logo.png","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kv.lirdlfq.com/adobe/Windows/224.php","date":"2026-07-14T13:13:17.442Z","timestamp":1784034797442,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kv.lirdlfq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 22:25:42 GMT","end":"Sat, 29 Aug 2026 22:25:41 GMT"},"fingerprint":{"sha1":"99:4A:B1:97:0F:87:C6:40:4F:01:E5:44:B4:D4:E3:22:78:C7:D9:62","sha256":"2A:19:06:BD:B5:27:B0:4F:54:FF:80:52:41:84:47:9E:12:31:33:68:9C:7B:52:E8:9B:20:48:11:74:FB:31:A8"}}},"request":{"raw":"GET /adobe/Windows/img/adobe-logo.png HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kv.lirdlfq.com/adobe/Windows/224.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 14 Jul 2026 13:13:17 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 25 Apr 2025 16:52:26 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 70680\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":70680,"size_decoded":70923,"mime_type":"image/png","magic":"PNG image data, 2560 x 1388, 8-bit/color RGBA, non-interlaced","md5":"551cebb68623d1956a018b01f6326fcc","sha1":"dd070fd3307692b09b9f32c36b4e35954213d011","sha256":"d6abcfa2c801a96cede081943aac15b67f6478be14d38d556d63545d6cba03a0","sha512":"01569b594b684064daafe639f1fb8fbfdfa6632ba6962d4aec078dde122026aafdee2619ba64aff9961f9c2bd5ea7ba06a90c3d200325bc86ee5bc28ab151ac4","ssdeep":"1536:eAnf1GggwOj0bLFohp4vfoM3Qln25nCGkh8SrVOYOkqzkKrDR:J8ZKoLCfx5CNVOYOXzkK/R","tlshash":"b063f158569feb9ececc1532a83f881a2ec4b7a9831152cc43a4ff79acd18925dc40d3","first_seen":"2025-04-28T21:29:56.842472Z","last_seen":"2026-07-17T12:19:09.42404Z","times_seen":638,"resource_available":false,"data":null}},"time_used":340,"timings":{"blocked":80,"dns":0,"connect":0,"send":0,"wait":87,"receive":173,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://kv.lirdlfq.com/adobe/Windows/224.php","date":"2026-07-14T13:13:17.559Z","timestamp":1784034797559,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/poppins/v24/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://kv.lirdlfq.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 7748\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 03:05:34 GMT\r\nexpires: Fri, 09 Jul 2027 03:05:34 GMT\r\ncache-control: public, max-age=31536000\r\nage: 468463\r\nlast-modified: Mon, 15 Sep 2025 16:36:26 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":7748,"size_decoded":8560,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7748, version 1.0","md5":"a09f2fccfee35b7247b08a1a266f0328","sha1":"0da2d17e738f46d2a09e6fb7969da451719a9820","sha256":"cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446","sha512":"5e3f9a298003b84250ec6801e08ad2a4ff8845d4c3e13ea61bec37da24d26ede13b436257882124cc0c27e9a323ba92e7d23c6ad3f48a7b75535f5ed98813a0e","ssdeep":"96:0g6vAF/FXh6MmoI56TEwosGU/DbVF/QBT1gaHEYT6u/w3hXLbJPAS772+6haAftj:zp6x6TYpoDYBJg8TRkbJPAS/2+CzQa7","tlshash":"f3f19de65d1e5e8980f0102f6f6efce767950d88141dadf9a9e72f884c6ba1b04c90cd","first_seen":"2023-04-05T13:48:05Z","last_seen":"2026-07-17T17:42:13.660778Z","times_seen":263289,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":18,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/img/favicon.ico","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kv.lirdlfq.com/adobe/Windows/checking.php","date":"2026-07-14T13:13:20.074Z","timestamp":1784034800074,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kv.lirdlfq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 22:25:42 GMT","end":"Sat, 29 Aug 2026 22:25:41 GMT"},"fingerprint":{"sha1":"99:4A:B1:97:0F:87:C6:40:4F:01:E5:44:B4:D4:E3:22:78:C7:D9:62","sha256":"2A:19:06:BD:B5:27:B0:4F:54:FF:80:52:41:84:47:9E:12:31:33:68:9C:7B:52:E8:9B:20:48:11:74:FB:31:A8"}}},"request":{"raw":"GET /adobe/Windows/img/favicon.ico HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kv.lirdlfq.com/adobe/Windows/checking.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 14 Jul 2026 13:13:20 GMT\r\nServer: Apache\r\nLast-Modified: Mon, 08 Jun 2026 13:28:08 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 5430\r\nKeep-Alive: timeout=5, max=91\r\nConnection: Keep-Alive\r\nContent-Type: image/x-icon\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5430,"size_decoded":5675,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"dc94f1054a50b313ee14bbd3d4bc1c0a","sha1":"b871efbbd59e202329352c18b775f7c5743aa8de","sha256":"8e263fef3e738ac1882b97a05caaf21bbffc0bdabdf4a7e8338453c18e1e90ec","sha512":"a66b30c2e23f0d43f06b7c6889892af0975c79037fb145fd01e84d4fa04234cdf8b32ecee8fe29fa5fd13db682485e4efc7b2f3e8b9d23bdc12586ce417aa080","ssdeep":"24:EslvlQNp0eCeAuyAwNtmUc3lKFWoX6UwjobtSl554VqQBzttYtlbd6e2u:FYfCzuyAacQWoWjobtc4VqUztQlbIeB","tlshash":"30b123987672f105f1544730dccafd50e218bc14629382ef3a687e747fe63094e1829b","first_seen":"2023-05-03T21:04:04Z","last_seen":"2026-07-17T12:25:18.22592Z","times_seen":581,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/224.php","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T13:13:17.101Z","timestamp":1784034797101,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kv.lirdlfq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 22:25:42 GMT","end":"Sat, 29 Aug 2026 22:25:41 GMT"},"fingerprint":{"sha1":"99:4A:B1:97:0F:87:C6:40:4F:01:E5:44:B4:D4:E3:22:78:C7:D9:62","sha256":"2A:19:06:BD:B5:27:B0:4F:54:FF:80:52:41:84:47:9E:12:31:33:68:9C:7B:52:E8:9B:20:48:11:74:FB:31:A8"}}},"request":{"raw":"GET /adobe/Windows/224.php HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://kv.lirdlfq.com/adobe/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 14 Jul 2026 13:13:17 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1586,"size_decoded":1781,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"89c8bfa5d4e205cfca40155453b91484","sha1":"89a8d072d7da57b4c376856e08901d0e39ebab26","sha256":"99ec87cc778cd49df51ec1bd51fdbf51d19c151715e235db77f59cfb22220658","sha512":"2769bb05d0dfc4945ae1fae04482a724c96ed0b5409fa58960cd8ddd7209c12a0f6dfbf117a240371e09c0092e875ae184e455a44e3a18c21f8150923a0f548b","ssdeep":"","tlshash":"6e310416a9c05407513392b07fb26a09fa93c053534699617eec229b5fb060dc8a3f8d","first_seen":"2026-07-14T12:16:46.340575Z","last_seen":"2026-07-16T12:54:47.072776Z","times_seen":5,"resource_available":true,"data":null}},"time_used":88,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":88,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Poppins:wght@200;300;400;500\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kv.lirdlfq.com/adobe/Windows/224.php","date":"2026-07-14T13:13:17.438Z","timestamp":1784034797438,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:24 GMT","end":"Mon, 14 Sep 2026 08:37:23 GMT"},"fingerprint":{"sha1":"85:D0:EC:C2:01:33:25:23:96:FB:2B:54:90:54:84:07:0A:49:1F:03","sha256":"9D:7C:1C:9C:6A:25:1E:17:E0:DC:FD:42:95:CA:47:3D:C1:9C:20:FB:22:47:02:E3:27:EC:7C:62:03:30:83:BA"}}},"request":{"raw":"GET /css2?family=Poppins:wght@200;300;400;500\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kv.lirdlfq.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 14 Jul 2026 13:13:17 GMT\r\ndate: Tue, 14 Jul 2026 13:13:17 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4792,"size_decoded":1228,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"9c04b1c3bad01ee0643591b8168c92c6","sha1":"4e0ac3442c265e0441943ec104165b3cf45bc98a","sha256":"f00e3b44e7e737f2378b812e15467d71a5d4907350082c7089894e5bf0b3150c","sha512":"dd8c420a800322c5b7d035d87eac72f5cc217cf6cabc06f440c8ab969f617415307db7c2f0aae1c6b2345a3a64ece811c17b8674bdad34c361e54d2665c02a02","ssdeep":"96:SO6aKO6ayJc+ukO6aVN3O1arO1aTJc+ukO1aaN3OEanOEaCJc+ukOEauN3OXa3Oc:/HaedhHdPgKQcXr3B","tlshash":"67a19bd1087be114ab831cc123ce6d36ee1ea155b810e5786bfd0c98adabc654372b2d","first_seen":"2025-10-24T02:40:46.13371Z","last_seen":"2026-07-17T12:19:09.422091Z","times_seen":665,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":2,"connect":14,"send":0,"wait":34,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiEyp8kv8JHgFVrJJfecg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://kv.lirdlfq.com/adobe/Windows/224.php","date":"2026-07-14T13:13:17.551Z","timestamp":1784034797551,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Jun 2026 08:37:23 GMT","end":"Mon, 14 Sep 2026 08:37:22 GMT"},"fingerprint":{"sha1":"CD:5B:53:23:61:72:75:37:AD:E9:F1:74:B2:D2:EE:09:81:05:55:E1","sha256":"9F:07:21:2D:14:EB:C5:C0:D4:2B:42:E4:55:80:7A:BB:AF:47:A8:BC:0C:5E:05:F3:2A:2B:1F:2A:78:4D:FF:D7"}}},"request":{"raw":"GET /s/poppins/v24/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://kv.lirdlfq.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 7884\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Jul 2026 02:57:09 GMT\r\nexpires: Fri, 09 Jul 2027 02:57:09 GMT\r\ncache-control: public, max-age=31536000\r\nage: 468968\r\nlast-modified: Mon, 15 Sep 2025 16:34:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":7884,"size_decoded":8696,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7884, version 1.0","md5":"9212f6f9860f9fc6c69b02fedf6db8c3","sha1":"ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b","sha256":"7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f","sha512":"67317495f4b53e20a9f31c034e456e6c37f387dffb2c092caa5159bc441cfcadd02749ffe5bbed1d580d5300a59e48a767ef2c6d9978b474f84c1a2cd095c126","ssdeep":"192:xLFDbKO9E3rS3JWBRO/J601FSS5ZUbik3Zy2f0:pd9J5W501otlI","tlshash":"c3f1ae4eb3f2cd1be40982e53a0fc90b1c578272681fd772d067a22517893bc8db2c81","first_seen":"2023-04-05T15:35:34Z","last_seen":"2026-07-17T17:41:07.018789Z","times_seen":376199,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":0,"dns":3,"connect":30,"send":0,"wait":16,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/img/favicon.ico","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kv.lirdlfq.com/adobe/Windows/224.php","date":"2026-07-14T13:13:17.735Z","timestamp":1784034797735,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kv.lirdlfq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 22:25:42 GMT","end":"Sat, 29 Aug 2026 22:25:41 GMT"},"fingerprint":{"sha1":"99:4A:B1:97:0F:87:C6:40:4F:01:E5:44:B4:D4:E3:22:78:C7:D9:62","sha256":"2A:19:06:BD:B5:27:B0:4F:54:FF:80:52:41:84:47:9E:12:31:33:68:9C:7B:52:E8:9B:20:48:11:74:FB:31:A8"}}},"request":{"raw":"GET /adobe/Windows/img/favicon.ico HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kv.lirdlfq.com/adobe/Windows/224.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 14 Jul 2026 13:13:17 GMT\r\nServer: Apache\r\nLast-Modified: Mon, 08 Jun 2026 13:28:08 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 5430\r\nKeep-Alive: timeout=5, max=94\r\nConnection: Keep-Alive\r\nContent-Type: image/x-icon\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5430,"size_decoded":5675,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"dc94f1054a50b313ee14bbd3d4bc1c0a","sha1":"b871efbbd59e202329352c18b775f7c5743aa8de","sha256":"8e263fef3e738ac1882b97a05caaf21bbffc0bdabdf4a7e8338453c18e1e90ec","sha512":"a66b30c2e23f0d43f06b7c6889892af0975c79037fb145fd01e84d4fa04234cdf8b32ecee8fe29fa5fd13db682485e4efc7b2f3e8b9d23bdc12586ce417aa080","ssdeep":"24:EslvlQNp0eCeAuyAwNtmUc3lKFWoX6UwjobtSl554VqQBzttYtlbd6e2u:FYfCzuyAacQWoWjobtc4VqUztQlbIeB","tlshash":"30b123987672f105f1544730dccafd50e218bc14629382ef3a687e747fe63094e1829b","first_seen":"2023-05-03T21:04:04Z","last_seen":"2026-07-17T12:25:18.22592Z","times_seen":581,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":0,"dns":0,"connect":87,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/checking.php","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T13:13:19.684Z","timestamp":1784034799684,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kv.lirdlfq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 22:25:42 GMT","end":"Sat, 29 Aug 2026 22:25:41 GMT"},"fingerprint":{"sha1":"99:4A:B1:97:0F:87:C6:40:4F:01:E5:44:B4:D4:E3:22:78:C7:D9:62","sha256":"2A:19:06:BD:B5:27:B0:4F:54:FF:80:52:41:84:47:9E:12:31:33:68:9C:7B:52:E8:9B:20:48:11:74:FB:31:A8"}}},"request":{"raw":"GET /adobe/Windows/checking.php HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kv.lirdlfq.com/adobe/Windows/224.php\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 14 Jul 2026 13:13:19 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=93\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3215,"size_decoded":3410,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8019b9cfc756f24f9cc576932c9cda1f","sha1":"449826aeaaa3186240a1b471353947e967f615d6","sha256":"98204f5480909113407f4690201b4c0ff516c63d46d620b562060d8bd552237d","sha512":"ab20d773d29b2afb16229f5757450b8325e41758a9dd7cdae36aae1f6f8e7b06a200da4d7d3f37315f826198d96c60b300849ce493e55760a6065bfbb5a17008","ssdeep":"","tlshash":"00612e26e9c5045b227792b5bff35709eb62c043830286193abe22d79fb494880a77cc","first_seen":"2026-07-14T03:32:48.382185Z","last_seen":"2026-07-17T01:20:18.315923Z","times_seen":11,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/img/adobe-logo-2017.png","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kv.lirdlfq.com/adobe/Windows/checking.php","date":"2026-07-14T13:13:19.804Z","timestamp":1784034799804,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kv.lirdlfq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 22:25:42 GMT","end":"Sat, 29 Aug 2026 22:25:41 GMT"},"fingerprint":{"sha1":"99:4A:B1:97:0F:87:C6:40:4F:01:E5:44:B4:D4:E3:22:78:C7:D9:62","sha256":"2A:19:06:BD:B5:27:B0:4F:54:FF:80:52:41:84:47:9E:12:31:33:68:9C:7B:52:E8:9B:20:48:11:74:FB:31:A8"}}},"request":{"raw":"GET /adobe/Windows/img/adobe-logo-2017.png HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kv.lirdlfq.com/adobe/Windows/checking.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 14 Jul 2026 13:13:19 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 25 Apr 2025 16:13:00 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 19877\r\nKeep-Alive: timeout=5, max=92\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":19877,"size_decoded":20120,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"e67a678815f9017921a8155d736e8e2c","sha1":"96c665f9538353db9871cff1a0544770518f5f1b","sha256":"dfb997ee526ce42483b1c190c2118821e931835f503fee6abe1bb8e4bef69dcc","sha512":"7ba4c7004ee981a8a26acc9d7017706b5979293440df161247caee88cd84fa6885493605842b3f6b4b4ffe7d4a4d97febcdbe30eb2188448fb41c33e8848928f","ssdeep":"384:bCIWq3zyX0NSh/iRerDruNPtuzyZkznD9MoZjUHMDH26jBUlNb:bCe3zyreSk13kznD9Majdj26jm/","tlshash":"1f92c067363346a2c19c1f3256daca672763d633185b4f2126e2b458ccfb702b317b02","first_seen":"2025-04-28T21:29:56.840393Z","last_seen":"2026-07-17T12:19:09.42947Z","times_seen":579,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kv.lirdlfq.com/adobe/Windows/img/Screenshot%202025-04-25%20161700.png","fqdn":"kv.lirdlfq.com","domain":"lirdlfq.com","tld":"com"},"ip":{"addr":"198.71.59.189","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kv.lirdlfq.com/adobe/Windows/checking.php","date":"2026-07-14T13:13:19.809Z","timestamp":1784034799809,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kv.lirdlfq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 22:25:42 GMT","end":"Sat, 29 Aug 2026 22:25:41 GMT"},"fingerprint":{"sha1":"99:4A:B1:97:0F:87:C6:40:4F:01:E5:44:B4:D4:E3:22:78:C7:D9:62","sha256":"2A:19:06:BD:B5:27:B0:4F:54:FF:80:52:41:84:47:9E:12:31:33:68:9C:7B:52:E8:9B:20:48:11:74:FB:31:A8"}}},"request":{"raw":"GET /adobe/Windows/img/Screenshot%202025-04-25%20161700.png HTTP/1.1\r\nHost: kv.lirdlfq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kv.lirdlfq.com/adobe/Windows/checking.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 14 Jul 2026 13:13:19 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 25 Apr 2025 15:46:16 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 50730\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":50730,"size_decoded":50974,"mime_type":"image/png","magic":"PNG image data, 1919 x 905, 8-bit/color RGBA, non-interlaced","md5":"969fd557eba0534f7bbbc9568f3352eb","sha1":"c6efbbfd283cf69aa142355d77b67fbf83abdbe9","sha256":"b77fa58e6433a52e56d0d4ccc8656c630fe7ebb7a83ce698863651722a5f5e07","sha512":"2acc31e681ad0d5a113434a4b80ba7a5c4f068d282ebf372ef2d5e7f87f19a677d047486d0a2408097568ea2287dcef3fe5f0cb20c68df2c3d1d0e96f3ffe339","ssdeep":"1536:++rBcFGSBUpuaDEAxe18fYEYgwaU+W4NVYiwAg:++rBWhB4ueEAI/EYdai48p","tlshash":"6833af560d26c50aeca799397e72aff537010eec233883589bfcd0c157991f5ae409b8","first_seen":"2025-10-24T02:40:46.131091Z","last_seen":"2026-07-17T12:25:18.224578Z","times_seen":545,"resource_available":false,"data":null}},"time_used":260,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":87,"receive":173,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kv.lirdlfq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}