{"report_id":"ca13a1cf-3464-4704-ba4b-a6b7fceeb49a","version":6,"status":"done","tags":[],"date":"2025-08-31T06:16:40Z","url":{"schema":"http","addr":"navi52.com","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.48.1","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"navi52.com/","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"title":"Rust Case Opening"},"submit":{"url":{"schema":"http","addr":"navi52.com","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.48.1","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-05T06:16:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-31","alert":"Sinkholed","trigger":"navi52.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"navi52.com","ip":{"addr":"104.21.16.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":6,"request_count":6,"received_data":315637,"sent_data":5281,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"steamcommunity-a.akamaihd.net","ip":{"addr":"23.36.76.123","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2009-09-14","domain_rank":70320,"first_seen":"2014-06-06T20:59:46Z","last_seen":"2025-08-28T21:06:48.305234Z","alert_count":0,"request_count":1,"received_data":13737,"sent_data":539,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"i.postimg.cc","ip":{"addr":"46.105.222.161","port":443,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"domain_registered":"2016-06-11","domain_rank":103883,"first_seen":"2018-04-11T10:01:12Z","last_seen":"2025-08-28T07:02:56.869966Z","alert_count":0,"request_count":1,"received_data":283991,"sent_data":425,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"upload.wikimedia.org","ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"domain_registered":"2003-03-16","domain_rank":4329,"first_seen":"2012-05-21T09:39:45Z","last_seen":"2025-08-28T15:50:28.221861Z","alert_count":0,"request_count":1,"received_data":2860,"sent_data":437,"comment":"","tags":null,"fingerprints":[{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"navi52.com/","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.16.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f47aff43fdd43a7f32a868180cea00d8","sha1":"dbf6a81cf165e79fae1c9aea1ff2499244872a45","sha256":"a1f6ac8ed9f420baa9da1ac6d60077c30f4919ce3aecc1db4e8ccbc1d286cbd8","sha512":"f14a70ef69b1dbbee57e6f9f9aecdf4e7bb6f46e776dda3e38ea0424c6ed577489876b2dc3c3c6abbd71736928d6969fd7e64704b9cd905f09014f081be901f8","ssdeep":"768:I9zDjAFZYzxf2205QXId662jnXSZae6kShO:I9zDjAgf2cu6pSZaelt","tlshash":"b0f2a347646ae37682f210d6c21a25d3e649ff717d1ca51bb3936d0ef34ce80d7a8229","size":34841,"data":"","first_seen":"2025-08-20T14:36:50.2093Z","last_seen":"2025-09-08T00:12:31.5336Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"navi52.com/731c2d502f0355585950064d.js","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.16.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f2e6ad803bf88fccbb72961e43ff429e","sha1":"56db95479f7810e9f542e83e4377cabe81302695","sha256":"b861218899fc72b61ba992e171c944d7ac565eee89bc63ed07478b012e052bcd","sha512":"58e558e0e8c1c6d832aea879f4a65528172e692a7fdad4182adf525f2230fd59ddb7ddee9c6544dddcc4e01ede6c03b5af0209d2ac650b19331d239964f38b60","ssdeep":"3072:IF28YS9B8IXmtDaMMaIEwRp2ZZ2+tNlVuOp5JapFssb4unk2jSw3mK+k:IMu9B/Rp2ZZ2+tNl3p7oZkQLP+k","tlshash":"0944974067c0a85c239b9b7a771fb4e9f42a05af3d89494fd101fc506aaa607fef9530","size":258551,"data":"","first_seen":"2025-08-20T14:36:50.101551Z","last_seen":"2025-09-08T00:38:20.00241Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"navi52.com/731c2d502f0355","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.16.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://navi52.com/","date":"2025-08-31T06:16:19.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"navi52.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 00:10:07 GMT","end":"Sat, 08 Nov 2025 01:07:23 GMT"},"fingerprint":{"sha1":"57:04:9B:DC:EC:A3:99:85:87:B4:12:BE:2B:07:32:A7:E0:C5:05:A3","sha256":"B4:FE:4F:5D:82:27:67:68:5C:23:82:C9:17:58:36:93:40:E4:02:C4:1E:B9:E6:87:80:A8:B2:37:D7:9B:29:AF"}}},"request":{"raw":"POST /731c2d502f0355 HTTP/1.1\r\nHost: navi52.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 40\r\nOrigin: null\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.-jSrxFH7vZ1HGXphCPFTRuWss04hCxJw.5JuZHYrqV98y4aut.WZIv0f4XkNS7SCLv1cFdfmuei9A4xUlXGV95FxaL1wiKpCfrjHKCj3M41ltniaewLYIu63bXcm9Urj6gf0N9ItV0tczFitaCZmEuBbh7TfzFHoz89pLwRtocN4YK9PJwR8vpmTcK-f6PNCWgVZ6a8FuWC-ZOSoqoIe2DpB1EooCeFcZTHReB0NWtERNCcYtxqyrIASkhrl-N3riy3T_4.dufGOTHNYiWInzSi828hRw; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6NzksInNlY3JldCI6IjdlYzFiMjYxNzRjNTU2OWU0NGNiYjQ3ODhjZmViOTI4Iiwic2VydmljZSI6IlN0ZWFtIn0.eURBqs9abpPJpYSQ0hGQC7yHmggAXMxRcFjH2igpKrE\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 201 Created\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/html; charset=utf-8\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ndate: Sun, 31 Aug 2025 06:16:19 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JyH4t8KyxFNh3VPm73F4NHxfPnNXzKPPHj4W%2Bfcpge1PdMX0amNdGUIC3h6J4qVnV7EhzCNX8LPRNsXpnx2Xl7%2FXuFWUQBuv\"}]}\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 977a660149d3b51b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"201","status_text":"Created","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14894,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"51d3f21fd64159085d27db4c844b92a0","sha1":"ee155185dc73b109486f82ae2e826087634c9033","sha256":"c56293e56ee2f3cc4ca69f4ea6d376c05a3a0ae76174ba063a83a5c06897f572","sha512":"1ed2a79975cc390df77f1ac3a2b3e72446472d062d241281ccf148c6a8bd03898dc76354c4eacc6e297286da358416ff5a62f627e80754591808d9a2d2bb0691","ssdeep":"192:h3nnriHMKraTZXLGsm171HF0NjN3RAKbQ/CfxUt78cfzPUT41uvYtkIJUq13Tfmi:hXnrZeoXq13Tf3KJLAq96qDlLI/A1HA","tlshash":"7d62c91669f30105ab57e1d82ff3074831a4a003e506cd6d7becf284cf96ae498a7b9c","first_seen":"2025-08-31T06:16:44.336666Z","last_seen":"2025-08-31T06:16:44.336666Z","times_seen":1,"resource_available":false,"data":null}},"time_used":321,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":319,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-31","alert":"Sinkholed","trigger":"navi52.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"navi52.com/731c2d502f0355585950064d.js","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.16.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://navi52.com/731c2d502f0355","date":"2025-08-31T06:16:19.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"navi52.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 00:10:07 GMT","end":"Sat, 08 Nov 2025 01:07:23 GMT"},"fingerprint":{"sha1":"57:04:9B:DC:EC:A3:99:85:87:B4:12:BE:2B:07:32:A7:E0:C5:05:A3","sha256":"B4:FE:4F:5D:82:27:67:68:5C:23:82:C9:17:58:36:93:40:E4:02:C4:1E:B9:E6:87:80:A8:B2:37:D7:9B:29:AF"}}},"request":{"raw":"GET /731c2d502f0355585950064d.js HTTP/1.1\r\nHost: navi52.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.-jSrxFH7vZ1HGXphCPFTRuWss04hCxJw.5JuZHYrqV98y4aut.WZIv0f4XkNS7SCLv1cFdfmuei9A4xUlXGV95FxaL1wiKpCfrjHKCj3M41ltniaewLYIu63bXcm9Urj6gf0N9ItV0tczFitaCZmEuBbh7TfzFHoz89pLwRtocN4YK9PJwR8vpmTcK-f6PNCWgVZ6a8FuWC-ZOSoqoIe2DpB1EooCeFcZTHReB0NWtERNCcYtxqyrIASkhrl-N3riy3T_4.dufGOTHNYiWInzSi828hRw; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6NzksInNlY3JldCI6IjdlYzFiMjYxNzRjNTU2OWU0NGNiYjQ3ODhjZmViOTI4Iiwic2VydmljZSI6IlN0ZWFtIn0.eURBqs9abpPJpYSQ0hGQC7yHmggAXMxRcFjH2igpKrE\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-disposition: inline\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ndate: Sun, 31 Aug 2025 06:16:19 GMT\r\nlast-modified: Tue, 19 Aug 2025 09:18:20 GMT\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6yQU2uhR9BrIzR%2FAMJAGxhm9VMI2xtQqtBIL56yVQ15BYPisSSbppE%2BcVNZpU3gBA1EVuPXzAMQr9DTRY4mK4OhI6gCa8bBG\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 977a660359dcb51b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":258551,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f2e6ad803bf88fccbb72961e43ff429e","sha1":"56db95479f7810e9f542e83e4377cabe81302695","sha256":"b861218899fc72b61ba992e171c944d7ac565eee89bc63ed07478b012e052bcd","sha512":"58e558e0e8c1c6d832aea879f4a65528172e692a7fdad4182adf525f2230fd59ddb7ddee9c6544dddcc4e01ede6c03b5af0209d2ac650b19331d239964f38b60","ssdeep":"3072:IF28YS9B8IXmtDaMMaIEwRp2ZZ2+tNlVuOp5JapFssb4unk2jSw3mK+k:IMu9B/Rp2ZZ2+tNl3p7oZkQLP+k","tlshash":"0944974067c0a85c239b9b7a771fb4e9f42a05af3d89494fd101fc506aaa607fef9530","first_seen":"2025-08-20T14:36:50.101551Z","last_seen":"2025-09-08T00:38:20.00241Z","times_seen":41,"resource_available":true,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-31","alert":"Sinkholed","trigger":"navi52.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"steamcommunity-a.akamaihd.net/economy/image/6TMcQ7eX6E0EZl2byXi7vaVKyDk_zQLX05x6eLCFM9neAckxGDf7qU2e2gu64OnAeQ7835Fb5GLAfCk4nReh8DEiv5dYMKE_qrwwQf-7gP3Ep1E/150fx112f","fqdn":"steamcommunity-a.akamaihd.net","domain":"akamaihd.net","tld":"net"},"ip":{"addr":"23.36.76.123","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://navi52.com/731c2d502f0355","date":"2025-08-31T06:16:19.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"a248.e.akamai.net","organization":"Akamai Technologies, Inc."},"issuer":{"commonName":"DigiCert TLS Hybrid ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 18 Mar 2025 00:00:00 GMT","end":"Wed, 18 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"51:B3:16:11:9C:44:F0:40:BC:CE:8A:C0:3A:1A:D3:BB:C6:47:40:B3","sha256":"BA:56:C4:EE:2A:1C:8D:B7:10:BF:E7:3A:1F:A3:E4:B0:AD:3F:29:0D:01:92:58:9B:8C:71:DE:44:99:61:C6:96"}}},"request":{"raw":"GET /economy/image/6TMcQ7eX6E0EZl2byXi7vaVKyDk_zQLX05x6eLCFM9neAckxGDf7qU2e2gu64OnAeQ7835Fb5GLAfCk4nReh8DEiv5dYMKE_qrwwQf-7gP3Ep1E/150fx112f HTTP/1.1\r\nHost: steamcommunity-a.akamaihd.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nLast-Modified: Fri, 01 Mar 2024 13:11:27 GMT\r\nServer: nginx\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host ;\r\nContent-Type: image/png\r\nContent-Length: 11908\r\nCache-Control: public, max-age=554716\r\nExpires: Sat, 06 Sep 2025 16:21:35 GMT\r\nDate: Sun, 31 Aug 2025 06:16:19 GMT\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11908,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 112, 8-bit/color RGBA, non-interlaced","md5":"710f1df326a62cafaeb1e6994632a403","sha1":"31f550d00c428c1c0ab9b8e0d19c7981b4b0144a","sha256":"ee399026403294f66ad7145c853181e04b90a4a8dafd047797eaed23216629ab","sha512":"98cb06650077d1d7143bc6108a5986217048f3e1bcb39dd3ba5db22b28f7296f82b932932e78e03da1181c69fec8942907e804347ae4455df0d733830548fac2","ssdeep":"192:+FGAEphc2RNGh9/J1Mkxb0ls183oDejY0j3gBo8jNZNPm6+QRZMKXiB7x+/6hnec:+YMwobJ39es0j3j8j5CTa6ZeUUAbKKL","tlshash":"1532d08af212ab15d271914ef0333826e74b15721d7b36a0cf48b59e8d9f725a1c04e0","first_seen":"2025-08-31T06:16:44.342336Z","last_seen":"2025-08-31T06:16:44.342336Z","times_seen":1,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":80,"dns":48,"connect":1,"send":0,"wait":42,"receive":1,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"navi52.com/731c2d502f0355565240305c41537a0a5a520a05","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.16.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://navi52.com/731c2d502f0355","date":"2025-08-31T06:16:20.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"navi52.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 00:10:07 GMT","end":"Sat, 08 Nov 2025 01:07:23 GMT"},"fingerprint":{"sha1":"57:04:9B:DC:EC:A3:99:85:87:B4:12:BE:2B:07:32:A7:E0:C5:05:A3","sha256":"B4:FE:4F:5D:82:27:67:68:5C:23:82:C9:17:58:36:93:40:E4:02:C4:1E:B9:E6:87:80:A8:B2:37:D7:9B:29:AF"}}},"request":{"raw":"GET /731c2d502f0355565240305c41537a0a5a520a05 HTTP/1.1\r\nHost: navi52.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.-jSrxFH7vZ1HGXphCPFTRuWss04hCxJw.5JuZHYrqV98y4aut.WZIv0f4XkNS7SCLv1cFdfmuei9A4xUlXGV95FxaL1wiKpCfrjHKCj3M41ltniaewLYIu63bXcm9Urj6gf0N9ItV0tczFitaCZmEuBbh7TfzFHoz89pLwRtocN4YK9PJwR8vpmTcK-f6PNCWgVZ6a8FuWC-ZOSoqoIe2DpB1EooCeFcZTHReB0NWtERNCcYtxqyrIASkhrl-N3riy3T_4.dufGOTHNYiWInzSi828hRw; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6NzksInNlY3JldCI6IjdlYzFiMjYxNzRjNTU2OWU0NGNiYjQ3ODhjZmViOTI4Iiwic2VydmljZSI6IlN0ZWFtIn0.eURBqs9abpPJpYSQ0hGQC7yHmggAXMxRcFjH2igpKrE\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EU4insOCPBDRFStSUiuCHFXaZhQYL6HAWDdZ7w7lzXSo%2FnkNMIli%2FWJvl7W9c9euPPWECO71ei3cm%2BKiKhqO9BLTHLvcBsSg\"}]}\r\ncontent-type: application/json; charset=utf-8\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ndate: Sun, 31 Aug 2025 06:16:20 GMT\r\netag: W/\"123-DEOgOo50eHx8wgLbaNxd8N9vWlY\"\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 977a660529e7b51b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":291,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0b4f1f9ed1a5b117a508c42eef3757f8","sha1":"0c43a03a8e74787c7cc202db68dc5df0df6f5a56","sha256":"54ac5564df61054dc854fd1d7aff0b7dd1f4c0f25bea5bfafb33a43c9c30787b","sha512":"544a1dace28059f7842a86d7db5b9e228d393aa7c7ea9ff2d47b52a169c412a3de760f6fa819546f1d68af1bee9a1d23e859d4d80326b60d964d2f0443433fcf","ssdeep":"","tlshash":"1ad0c212489c946adb005100414a7f0f95bd1a2344c4b92e75ac5f3298fc2eb6105d6f","first_seen":"2025-08-31T06:16:44.345891Z","last_seen":"2025-08-31T06:16:44.345891Z","times_seen":1,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-31","alert":"Sinkholed","trigger":"navi52.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"navi52.com/731c2d502f035541565306635c455011","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.16.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://navi52.com/731c2d502f0355","date":"2025-08-31T06:16:24.037Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"navi52.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 00:10:07 GMT","end":"Sat, 08 Nov 2025 01:07:23 GMT"},"fingerprint":{"sha1":"57:04:9B:DC:EC:A3:99:85:87:B4:12:BE:2B:07:32:A7:E0:C5:05:A3","sha256":"B4:FE:4F:5D:82:27:67:68:5C:23:82:C9:17:58:36:93:40:E4:02:C4:1E:B9:E6:87:80:A8:B2:37:D7:9B:29:AF"}}},"request":{"raw":"POST /731c2d502f035541565306635c455011 HTTP/1.1\r\nHost: navi52.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://navi52.com\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.-jSrxFH7vZ1HGXphCPFTRuWss04hCxJw.5JuZHYrqV98y4aut.WZIv0f4XkNS7SCLv1cFdfmuei9A4xUlXGV95FxaL1wiKpCfrjHKCj3M41ltniaewLYIu63bXcm9Urj6gf0N9ItV0tczFitaCZmEuBbh7TfzFHoz89pLwRtocN4YK9PJwR8vpmTcK-f6PNCWgVZ6a8FuWC-ZOSoqoIe2DpB1EooCeFcZTHReB0NWtERNCcYtxqyrIASkhrl-N3riy3T_4.dufGOTHNYiWInzSi828hRw; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6NzksInNlY3JldCI6IjdlYzFiMjYxNzRjNTU2OWU0NGNiYjQ3ODhjZmViOTI4Iiwic2VydmljZSI6IlN0ZWFtIn0.eURBqs9abpPJpYSQ0hGQC7yHmggAXMxRcFjH2igpKrE\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 201 Created\r\ncontent-length: 16\r\ncontent-type: application/json; charset=utf-8\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ndate: Sun, 31 Aug 2025 06:16:24 GMT\r\netag: W/\"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA\"\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0C0GhRvN%2FrW%2BTBo%2BAPK6VMtT87cLM8xS3kVnPn4MLParFDB0PzvO8xzfpEES5xfAnb7Pf9B9JE7egBFza9YmsEbLQB0YRDOu\"}]}\r\ncf-ray: 977a661e3abcb51b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"201","status_text":"Created","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"7363e85fe9edee6f053a4b319588c086","sha1":"a15e2127145548437173fc17f3e980e3f3dee2d0","sha256":"c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97","sha512":"a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85","ssdeep":"","tlshash":"f0600003000000a2c000220002382e202080002280000008800c20088a20000208300a","first_seen":"2023-04-05T04:17:27Z","last_seen":"2026-08-03T23:16:26.939033Z","times_seen":179735,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":159,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-31","alert":"Sinkholed","trigger":"navi52.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"navi52.com/","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.16.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-31T06:16:18.963Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"navi52.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 00:10:07 GMT","end":"Sat, 08 Nov 2025 01:07:23 GMT"},"fingerprint":{"sha1":"57:04:9B:DC:EC:A3:99:85:87:B4:12:BE:2B:07:32:A7:E0:C5:05:A3","sha256":"B4:FE:4F:5D:82:27:67:68:5C:23:82:C9:17:58:36:93:40:E4:02:C4:1E:B9:E6:87:80:A8:B2:37:D7:9B:29:AF"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: navi52.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 31 Aug 2025 06:16:19 GMT\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bIwr1JaM4YiETr5UFPpnhB6IdMKBeuDxv3xzTfUGeZzZleSCresGfi77Sh7tBb5T9VCAW7uN6klrn1gszQjzXyl9Efx4l7Ep\"}]}\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\nset-cookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.-jSrxFH7vZ1HGXphCPFTRuWss04hCxJw.5JuZHYrqV98y4aut.WZIv0f4XkNS7SCLv1cFdfmuei9A4xUlXGV95FxaL1wiKpCfrjHKCj3M41ltniaewLYIu63bXcm9Urj6gf0N9ItV0tczFitaCZmEuBbh7TfzFHoz89pLwRtocN4YK9PJwR8vpmTcK-f6PNCWgVZ6a8FuWC-ZOSoqoIe2DpB1EooCeFcZTHReB0NWtERNCcYtxqyrIASkhrl-N3riy3T_4.dufGOTHNYiWInzSi828hRw; SameSite=Lax; Path=/; Expires=Sun, 31 Aug 2025 10:16:19 GMT\ntoken=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6NzksInNlY3JldCI6IjdlYzFiMjYxNzRjNTU2OWU0NGNiYjQ3ODhjZmViOTI4Iiwic2VydmljZSI6IlN0ZWFtIn0.eURBqs9abpPJpYSQ0hGQC7yHmggAXMxRcFjH2igpKrE; SameSite=Lax; Path=/; Expires=Sun, 31 Aug 2025 10:16:19 GMT\r\ncf-ray: 977a65feab3f7131-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35352,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (34858)","md5":"d53297500382defaefaca803761bdb67","sha1":"fad0456d1e0c6ebd5380d0f1247799a3d7a22605","sha256":"654c36916ceeacb369d2364cb3fa39c9f1822f1bded0b8805255f23ed109af10","sha512":"7390bd2346e8bd1e29ec782670ae87126204644c491d3c99538aac36501bffbf07acb49952c714d6cd91c935e679d4ed08df001f2b1cbbe06509aecf4e60b5cc","ssdeep":"768:YxDf9zDjAFZYzxf2205QXId662jnXSZae6kShZ:YxDf9zDjAgf2cu6pSZaelE","tlshash":"7df2a447646ae37682f210d6c21a25d3e649ff713d1ca51bb7936d0ef34ce80d7a8229","first_seen":"2025-08-31T06:16:44.350468Z","last_seen":"2025-08-31T06:16:44.350468Z","times_seen":1,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":18,"dns":1,"connect":1,"send":0,"wait":206,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-31","alert":"Sinkholed","trigger":"navi52.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"navi52.com/favicon.ico","fqdn":"navi52.com","domain":"navi52.com","tld":"com"},"ip":{"addr":"104.21.16.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://navi52.com/","date":"2025-08-31T06:16:19.410Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"navi52.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 10 Aug 2025 00:10:07 GMT","end":"Sat, 08 Nov 2025 01:07:23 GMT"},"fingerprint":{"sha1":"57:04:9B:DC:EC:A3:99:85:87:B4:12:BE:2B:07:32:A7:E0:C5:05:A3","sha256":"B4:FE:4F:5D:82:27:67:68:5C:23:82:C9:17:58:36:93:40:E4:02:C4:1E:B9:E6:87:80:A8:B2:37:D7:9B:29:AF"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: navi52.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: session=eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0.-jSrxFH7vZ1HGXphCPFTRuWss04hCxJw.5JuZHYrqV98y4aut.WZIv0f4XkNS7SCLv1cFdfmuei9A4xUlXGV95FxaL1wiKpCfrjHKCj3M41ltniaewLYIu63bXcm9Urj6gf0N9ItV0tczFitaCZmEuBbh7TfzFHoz89pLwRtocN4YK9PJwR8vpmTcK-f6PNCWgVZ6a8FuWC-ZOSoqoIe2DpB1EooCeFcZTHReB0NWtERNCcYtxqyrIASkhrl-N3riy3T_4.dufGOTHNYiWInzSi828hRw; token=eyJhbGciOiJIUzI1NiJ9.eyJvd25lciI6NzksInNlY3JldCI6IjdlYzFiMjYxNzRjNTU2OWU0NGNiYjQ3ODhjZmViOTI4Iiwic2VydmljZSI6IlN0ZWFtIn0.eURBqs9abpPJpYSQ0hGQC7yHmggAXMxRcFjH2igpKrE\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jtwcf1Mi%2Fkxu10uKRLP%2BaDXu%2BXbk2NV%2BzxoI5Y6QIGrvKsU9s2ysmrmsNeGqlehXxnlQGMmyMQ8%2FWJfkL6LKChbDBxOuLbzg\"}]}\r\ncontent-type: application/json; charset=utf-8\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ndate: Sun, 31 Aug 2025 06:16:19 GMT\r\netag: W/\"41-0AeMVzV1pApYTMktTMxeiuYqqUg\"\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nvia: 1.1 Caddy\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nserver: cloudflare\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 977a660149d4b51b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6688d59f1d0b9e116ceca1708a113d0d","sha1":"d0078c573575a40a584cc92d4ccc5e8ae62aa948","sha256":"cacc3c09d432702d237265c156358a0430dd08938afbceaf4a444d26340b25e8","sha512":"116612441c802eae5cdfa4441c5757ee48298f865e1ff4e164ae1ba9ab2a0856c7e2e5c023864eee6963eda1bb89d6edcc7951c4b566eca2aac989a66ef510a4","ssdeep":"","tlshash":"b4a0020c084b7aad4f52c4bd75cd7d3488564ac015a119615189d438825464e8845588","first_seen":"2024-08-02T16:52:12Z","last_seen":"2026-08-02T15:58:47.917211Z","times_seen":1820,"resource_available":true,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-31","alert":"Sinkholed","trigger":"navi52.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.postimg.cc/LsbTHNxz/photo-2025-04-13-21-16-25.png","fqdn":"i.postimg.cc","domain":"postimg.cc","tld":"cc"},"ip":{"addr":"46.105.222.161","port":443,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://navi52.com/731c2d502f0355","date":"2025-08-31T06:16:19.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postimg.cc","organization":""},"issuer":{"commonName":"E6","organization":"Let's Encrypt"},"validity":{"start":"Sun, 17 Aug 2025 02:47:56 GMT","end":"Sat, 15 Nov 2025 02:47:55 GMT"},"fingerprint":{"sha1":"20:6C:66:66:68:F7:B4:5E:C5:99:09:F7:0A:73:95:2A:A3:88:22:EF","sha256":"A5:63:1D:6D:11:2D:26:7C:BE:F7:F6:A9:F4:F8:3E:22:50:5C:25:D9:66:3A:A5:C5:08:CC:5C:C7:9E:29:4E:ED"}}},"request":{"raw":"GET /LsbTHNxz/photo-2025-04-13-21-16-25.png HTTP/1.1\r\nHost: i.postimg.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sun, 31 Aug 2025 06:16:19 GMT\r\ncontent-type: image/png\r\ncontent-length: 283627\r\nlast-modified: Fri, 18 Jul 2025 06:20:05 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":283627,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"f65e1337ab953277c7d91ba679b83fce","sha1":"6aec00352466d6803fe3daa6e5e220618cbe8866","sha256":"48e2af51a6293b27628f06ff865d25dc56c9afb6447fe9d4d6c9a111bbd0e5d8","sha512":"b0849c13104a440b5759a13ea06cdfb914c51b13230ba51ca2d3339451bb0394cb78d4cc5c507e791c4896d66e1e3ce80e9078ff002dbc169689615121e3d2f3","ssdeep":"6144:hyazlAVDhLe7mRy2i3OFKg3PpZAFE209/eqYaVloO94QJCRLS:7hAVlC7mUTAKAPpZAFEr9/e7694QwRe","tlshash":"2f542393bf414deb8a9815bb58367f0a757b2359d23756b9b1b5fe0eaecc01a2c410c0","first_seen":"2025-08-31T06:16:44.355683Z","last_seen":"2025-08-31T06:16:44.355683Z","times_seen":1,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":112,"dns":56,"connect":24,"send":0,"wait":27,"receive":109,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/8/83/Steam_icon_logo.svg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://navi52.com/731c2d502f0355","date":"2025-08-31T06:16:19.740Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 Aug 2025 07:58:25 GMT","end":"Fri, 14 Nov 2025 07:58:24 GMT"},"fingerprint":{"sha1":"00:6B:23:79:C6:3F:3F:33:1C:96:A8:58:E3:42:75:58:02:2B:84:D3","sha256":"AC:53:65:9E:C2:DF:AA:6F:9B:55:55:44:CF:4E:94:5A:41:C1:12:6D:4F:EA:F3:3D:EB:5E:40:17:00:3A:2E:26"}}},"request":{"raw":"GET /wikipedia/commons/8/83/Steam_icon_logo.svg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 30 Aug 2025 15:45:47 GMT\r\nserver: ATS/9.2.11\r\netag: W/09ba266e4538393140af3dfb119ff316\r\ncontent-type: image/svg+xml\r\nx-object-meta-sha1base36: 7go8di59cnejdk93eduiqlkajwmwind\r\nlast-modified: Sat, 11 Jun 2022 14:14:26 GMT\r\ncontent-encoding: gzip\r\nage: 52232\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 hit/121\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=gpUw-mGgeQUVrUp-lT88wgJgAAAAAFvdTeIPC_W1Q91cLasuOeYJEctTreLr6kk_;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Mon, 31 Aug 2026 00:00:00 GMT\r\ncontent-length: 773\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1589,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"09ba266e4538393140af3dfb119ff316","sha1":"3fe402adcfc131c7f2428799fec5703a96a42c69","sha256":"f9dfd02f603715cb12a8b0530e0c4dec21ecf4104c053bf62dd8139f19ea47af","sha512":"cdc1ab1c8bcd05659af4040146a3ee06c4cc8c2a026acd02e420b12f534789ecc306296553981580475c383bbe103fb3a5358044deef8c04b422972e98ca6399","ssdeep":"","tlshash":"df3153db875c50bdc116c62eea24a5a6c75f606b38c183c969bcdf2a4447383e903e88","first_seen":"2023-06-17T20:17:01Z","last_seen":"2026-08-01T23:32:49.442128Z","times_seen":57,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":59,"dns":7,"connect":20,"send":0,"wait":23,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}