{"report_id":"cba1258b-4ab8-4602-807b-7f11683e1854","version":0,"status":"done","tags":[],"date":"2026-09-22T18:32:26Z","url":{"schema":"http","addr":"theracology.com/","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"104.21.69.52","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"theracology.com/","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"title":"Shop Canada’s Top Department Store Online \u0026 at 500+ Locations | Canadian Tire","dom":{"size":564149,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (36497)","md5":"b72bc0705b4316da1f70f40c3162f354","sha1":"1b9ba683105db4b6c8a53f26be65d837d988ac72","sha256":"ac22bd965a2e66212ec50167f5e6c5304df94b84b6e7dcd54a22ef5e8404b4a5","sha512":"11f78b6ad39398fd825d1b55fc5035242703c582c07d57958de92004bbea303c9321cc7e60098a675875647075d7189e930e8c6a7ec48d35511d6eeba0db35ee","ssdeep":"6144:6mCLvOoCLk1FF2gD5ZKHgmOscm6pszn8BKK:7CLLCLk1F5mOscm6pszn8BN","tlshash":"18c4d763e0b1527a91df7399e162278875139b0befa31bfdf48c02684f89b954c1768c","dom_hash":"domhashf0f3350a624f1d8c847e93108edee246","first_seen":"2026-08-07T21:29:27.289682Z","last_seen":"2026-09-22T18:32:36.664967Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"theracology.com/","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"104.21.69.52","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-27T18:32:26Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"theracology.com","ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-05-07","domain_rank":0,"first_seen":"2026-09-22T18:31:57.610169Z","last_seen":"2026-09-22T18:31:57.610169Z","alert_count":416,"request_count":104,"received_data":8053114,"sent_data":60738,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"Adobe Experience Manager","description":"Adobe Experience Manager (AEM) is a content management solution for building websites, mobile apps and forms.","website":"https://www.adobe.com/marketing/experience-manager.html","common_platform_enumeration":"cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*","icon":"Adobe Experience Platform.svg","categories":["CMS"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"theracology.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-23T05:50:57.843664Z","times_seen":437855,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/clientlib-base.lc-546b4668261f2eeea2d170b60c8e6b15-lc.min.css","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.142Z","timestamp":1790101912142,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/clientlib-base.lc-546b4668261f2eeea2d170b60c8e6b15-lc.min.css HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zMuv4f7B1LFAAH2MEfxuKRHpo%2BCMAg9r3%2Fen3Jv2wk0YEPm%2B%2Bmqf8gN2MbUKzPg7CqAlpw%2BAkg5q4a0UP7kSaHoMQxVFFAkQCTGSsJ%2B9YBGzKtMR9bryJQQQwEJeQz%2FKvb8%3D\"}]}\r\npriority: u=2,i=?0\r\netag: W/\"6a6764b8-21b118\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvary: accept-encoding\r\nage: 173\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36396eb8d5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2208024,"size_decoded":234058,"mime_type":"text/css","magic":"ASCII text, with very long lines (346)","md5":"0c0fae644e9c4c28ed8461353cbf8920","sha1":"053188d16474316cd9fd226feb0b1e68cc938bfb","sha256":"c58cab4e8da109781fde8ba633aff02466d73fc7f92cd4ecaf64cc5ff26f440b","sha512":"00c0a1affa91175548826ec9e3dbfbf8980ca3186be3bb5695a5627902bc4ad04bf3a442ec1b52bcc2f226ddcee61f1e80e19b59505d202a87a409d9fce3d899","ssdeep":"24576:uhpiBf5oORHLv1+LrcwAUuVJEQipvh0biMrYBj8Mk/DSvJ+:Pv1c+JEQipvh0biMkBwxDSs","tlshash":"672520a3d8b215a0d16f487b71c837ec232cac87a13275affc569997d9cb615830634e","first_seen":"2026-08-07T21:29:27.501311Z","last_seen":"2026-09-22T18:32:36.665821Z","times_seen":3,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/css.css","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.144Z","timestamp":1790101912144,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/css.css HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uDbdUMOVDlBNjCuQ8gRUdxGDP4KeQ6MuB0nHN1HbLsRZXcKiAPKmLK8WAgHLEdd01Tenzwa6%2FGBNJvHNGBKSuWym73JhGucAGEIdIYVLgY%2BEIm%2Ftg7LxebyS5%2Fafk9z3ogA%3D\"}]}\r\npriority: u=2,i=?0\r\netag: W/\"6a6764b8-1d8c\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvary: accept-encoding\r\nage: 173\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36396eb8e5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7564,"size_decoded":1342,"mime_type":"text/css","magic":"ASCII text","md5":"d65b461fc35f4aab49eda5c6031d0fa6","sha1":"adeaa5ffe4dc6886fc23e681d7fe406b37ddb332","sha256":"5de41dc0ae0cd2d922ad8685f4108084e3834aa39c6e7e3528c6c1680a3cb877","sha512":"aaeb028a68850af75dd746f3f3db3e3072cf996aa77b715f8245815e90b726ac05cc3bba0888762b613e0d33a92fe3cd9dbb8c77ac3b3d09a90c4990be214714","ssdeep":"192:43pW33pzn+B3n+DOR3Obr+E3r+Mx+i3x+bpROp00IFK1AUMq66O:43E31+p+DOi6g6MgugbKy","tlshash":"fff16a90086f6604d7931dc127ca3e32ff5db29164499a34afff1098bc9bd699362b4c","first_seen":"2026-03-25T15:03:28.946368Z","last_seen":"2026-09-22T18:32:36.666898Z","times_seen":7,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_L_Laundry_TriApp_ENG.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.441Z","timestamp":1790101912441,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_L_Laundry_TriApp_ENG.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-6f2\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eDeXyo1uHCGRLHaEfZlbi1LgsvQ5km5ORjyn45jlYRWPGKFjzUP6TLWSiSVdGeSE%2FoSTzkxO%2B5rrJxI%2FPUrMefKcnOkhb95cNYqjxTcV5E3z7QGvJU0oEJQkpRZ43a00jKo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398cbe65691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1778\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1778,"size_decoded":2548,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c210d5150acd37ee1a7298b1babe8b07","sha1":"2d0da6516e63b685717beff294f19d9bc37cac0a","sha256":"59a485856e47b81ad38cc2c704d3f735378cda0be0fd7f89111db6ad1b45ab31","sha512":"8a4064e3f370f767cfda34b4ddc63159ff9bef535570b542cd136b4e961ac0e5b10db8041c56109cc2cf0cd2a83e6b2906462765b58b7c60f2e2f6f4c9752d4a","ssdeep":"","tlshash":"2831eba2c326de8d2f4b7a1bad6740951485f1a445dc8a1cc753740f27dc2c4ed3968f","first_seen":"2026-08-07T21:29:27.498254Z","last_seen":"2026-09-22T18:32:36.667903Z","times_seen":3,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/tr-sg-backyardshelters-triapp-eng.png.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.447Z","timestamp":1790101912447,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/tr-sg-backyardshelters-triapp-eng.png.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hFzRMiIrFYKFa14L5YXx0xo8S%2Fs5bt4%2FQIxaJe6WsA5P0i2R55N%2B39v0ze1ECFWNP04ZJFmN2XTTSdF8kGjo79sBggap7jlE%2FqpvlxxQ0188ZRng7%2FJ%2BCoWh4toS0QA236I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398dbeb5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7942,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"d0de2384098c3ca7a8042b3ef10da848","sha1":"a79f933aaafc7dba3dcf2591143df4c49f25432e","sha256":"d9bacf20cc441a19ab513f1e7c56ad5518ad924111118a54ed66b63e9b450b90","sha512":"3babff4d8154e86a616f6b65fdf47a6f2a2982d0784e86e516fbc7de85d7b0dba06fd0e107a5761df94be4478ebf80f126d73a8a527003891aac017cf7302a1e","ssdeep":"192:Vj9jhjOTK/OaaUl8Pz2zLk81B8967vlCeNA:z//Fb9A67vlCeG","tlshash":"35e1ba63f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.668836Z","last_seen":"2026-09-22T18:32:36.668836Z","times_seen":1,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/10-5.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.700Z","timestamp":1790101912700,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/10-5.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=au6JwRTJcWi3xL3sEVs0q6AwJfIdPMwAZrWbAw9nF9pTSD0H%2BbZO7Oxjc%2BDCAofViNIXliZmcXGyiks9uC6DLUIdrXTCBJEdt4%2FXq34phxGvL9%2Fxsk4OOKeYV5Nc43bpH0s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=4,i\r\ncf-ray: a3f3639a6c205691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7938,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"6e40ddb2bf36d4b97780339dca985dd4","sha1":"40924b8d564ed6e8c8987902d5fa934a3e88c409","sha256":"4fca75386b93f074c14be18bfe4f1bd6f85322321e677db795082913c4f1468f","sha512":"df01e34f875a300d60e08d45ec606eededfc2d5ef86838e851d10532f3e92a34d480aac6d3f49548cea3637b1c9b7af648b0a72b096423522011fd611dbe6667","ssdeep":"192:Vj9jhjOTK/OaaUl8Pz/zLk81B89sy7vlCeNA:z//FM9Asy7vlCeG","tlshash":"68e1ca63f9f825fe1097827230aa7b193de48013ea6704a576edc1720f8ef84ed07245","first_seen":"2026-09-22T18:32:36.670513Z","last_seen":"2026-09-22T18:32:36.670513Z","times_seen":1,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/CTEastmanRoman-Bold.woff","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.813Z","timestamp":1790101912813,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/CTEastmanRoman-Bold.woff HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://theracology.com/lander/steps_snow_generate_programming_algorithms/clientlib-base-critical.lc-517b76004a51e58df9575fd748c1ac81-lc.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mATYbs5jwyeOO2R7eH3pXvf6hQsqTTcgbnZYe%2BbdFSoWgjspjJncKkBhQc%2FkBlCvIR7NKbmJGrOrQvE60VB7C04EPicN5fZ1HmFOLAc%2BhVls3Tw95nPHqxbyscLJwsu1jxk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a3f3639b1c325691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7939,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"42290dde52799d857373d2a7a706e95b","sha1":"d9cac63f18418391b2c3adecaf1d57e1c2da347c","sha256":"44adfe2b3b2748748edc761685b55f722b1c44377c7efeec1c5875c42011de00","sha512":"440a170b9d835aefd8098d182857d19e92309e31eec611e38b67c0ca29a690a66c9b89242eb9203d4412129197cd00db894ed0f057a4ab0828786300e8d338f1","ssdeep":"192:Vj9jhjOTK/OaaUl8PzEzLk81B89I7vlCeNA:z//F19AI7vlCeG","tlshash":"dae1ba63f9f925fe1093827231aa7b193de48013ea6708a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.671883Z","last_seen":"2026-09-22T18:32:36.671883Z","times_seen":1,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.170Z","timestamp":1790101912170,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Thu, 24 Sep 2026 18:31:52 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ydsZz%2BtRap4fpuGZnwe4IHcunu5xVYrpneHLGO%2BiZdG9K5CayCMx%2Bdv5bUqU9LTssqxlypPsG8Z%2F5xM61Lw27s3wnaXnEtzbO3Dj3Ec8HTUD%2F6fHGY%2Byxlz9MvmZE04RbXA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nserver: cloudflare\r\ncf-ray: a3f363971b935691-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1296,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-09-23T05:50:57.843664Z","times_seen":437855,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2026-hp-freeshiptohome-slimbanner-v1-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.176Z","timestamp":1790101912176,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2026-hp-freeshiptohome-slimbanner-v1-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-f1e4d\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 173\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yRTWkcj0cxKmRx%2BU2TAW1%2FVe8pXi%2BnQ4POf3Z5qq4pmMcfrh0CgV2teaszvppwzX8xXS76X7bdeMl0aw2DXj8wVVoKxhaiTVe4Ix5sKGn5rtueJbiTdGPaQkOvV%2BEEglMRo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363971b945691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 990797\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":990797,"size_decoded":991572,"mime_type":"image/png","magic":"PNG image data, 1172 x 500, 8-bit/color RGBA, non-interlaced","md5":"54e111bf5b5fb9b117997aa789ffaf02","sha1":"daa85cc58cc9ca577feea9e81d7a47d5ba33d407","sha256":"7fec6a6cc8bfe74001f5582e2afa4293b70a86fe29e5414576874336fdfdb9ee","sha512":"9052b54235ada68aa0f52d89de79ac040f4f8bdd64427de0d7df9d868eed826a412f078e2589dbe78a05eccc23325f0b2263dde6ffd48cd777c981e9df378017","ssdeep":"24576:/e2hVMlIBgG7O3reEhjjkyNCVh5c7KTUhJcAdopt2C:/EsTiSwnkyA758KAhJc8cMC","tlshash":"eb2533c27cc78afee4d952a05718b81b3bb0dfd41dba2c421b9b8b55a8c6dc91f39105","first_seen":"2026-08-07T21:29:27.374671Z","last_seen":"2026-09-22T18:32:36.673622Z","times_seen":3,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":269,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_2_EN.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.403Z","timestamp":1790101912403,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_2_EN.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-24852\"\r\nexpires: Fri, 02 Oct 2026 18:30:15 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 97\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6wKw8NX%2FJKwmjEh%2F2Nv6riQCKtkMuwlURhSandOkDN5eg2D84k8KsNxPERRI1a3xGlA8d%2Fwp22Z8tFCMzCS3aoRLM7dNfLpTpOiMGjMcURPKEBJbaNAXVSQZ0Jo2hZHIKvo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bbe5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 149586\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":149586,"size_decoded":150358,"mime_type":"image/png","magic":"PNG image data, 696 x 312, 8-bit/color RGBA, non-interlaced","md5":"e530f6896b4d645ca0540509c2f91eb5","sha1":"bdb4b1125251189111eacb58e662f2024270d529","sha256":"d22ea4a88cfa2208e3fb93722edae94201d35a0c88c26254cd32ec182b9ff64a","sha512":"dcec6020b1dbfcbf8a581c562b8d3c5da646d730dee6b8d05d06a52e6785140a6024d05595f1035cbf635dbb8a3206d1575872dbcecec9d7cbd33a52b4c97c87","ssdeep":"3072:NXYOu+fUffyxk2K3OIytZkiK2gnRXe/QZCMY:JYB+fvxVtzKxde/QZCN","tlshash":"2fe31245d62bf43eb392f35071681e6d406f6630ef1ea86d838a9499205d047c79ebe3","first_seen":"2026-08-07T21:29:27.454078Z","last_seen":"2026-09-22T18:32:36.674261Z","times_seen":3,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_furniture.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.408Z","timestamp":1790101912408,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_furniture.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-8503\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S7iiWr%2BzdKWiYYNZElIYkGCF2B3zXU4qbNWM5kovQxUtVgOydN5DB0bVz5OBsK42kosP8gSwiOpvq2Bp42w%2By%2Bha0jv4ljL4xq5s2wIgBAN9ErqJBm9stbFbqBjpAiBxX9M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bc45691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 34051\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34051,"size_decoded":34823,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"679a9870876a8432d6a771908fd11852","sha1":"8ce1fc60628a623dff595c33ead05403132048aa","sha256":"5e0735fda26c02a083c279ddfb4d7d1bdffadf79e03a5f4e869c4dd20650e52a","sha512":"569f58c8db4690bc3043e28520cccee0861d4eec481a4bc53f482989b034062364e97d6a7b98c23c6488a499860391ac857b0321a800176e6c030793f787d16f","ssdeep":"768:o0cCnl69nFoytzPZFsyF//i1/kSjTsfZI/lBD+CMxg:9KFVZOqXi1/VcZI/f+CMxg","tlshash":"7be2e06eb191505899f2df3cddfee10590daa8f592b5c24d7acc0cc8ebe55af4a40680","first_seen":"2026-08-07T21:29:27.410758Z","last_seen":"2026-09-22T18:32:36.675126Z","times_seen":3,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_insects.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.414Z","timestamp":1790101912414,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_insects.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-8bc1\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eMHRwv8IIo0q6PEGcbrEyGQCMSwKIqczppA%2B0OcwbLeyZsFY8Q9jPfinn%2BjidD87tVVYxI1Az94uOiW5maftwYd57K2S%2FAfwPRCzFlo7pNwRiH5Kt0PMfcbBQLrX6M9fxMw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bcb5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 35777\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35777,"size_decoded":36549,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"8f1ae8c5d112097cb2b83d544ad39220","sha1":"bb353982c140b36b5940d661c94c6ae653584f77","sha256":"0d340199595fee82f0e6a810a1f4bda81e95fcf2e23451e8767e3e309e97a91c","sha512":"f437b831741857fe9b91963df75c066791f209b9760f19e54f89104bcf60e7b8ac1495ecda286ab2222a732c544cef556dc4de49dce3baf523d337284a6ff3e7","ssdeep":"768:AtG86Er9+d+2xLzhna3t+0LmLL7Xc9KaybU:vJU9+d+2xLNa3t3LmL3XcAaybU","tlshash":"4ff2e0e3f99b50411529c1bc8e2de30a725ca2f15d39da2fb22d4ec4fbe64434ac5922","first_seen":"2026-08-07T21:29:27.446092Z","last_seen":"2026-09-22T18:32:36.675703Z","times_seen":3,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_cycling.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.415Z","timestamp":1790101912415,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_cycling.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1c951\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gU6MNJbELy3Z3fcC5jztdRQtNMbU8kG9T5oVRfSSSaoJz16MAq4Z%2B2ZlAGbEt7lS3Z5dlBk79zJRL%2BO3GMeBo3GcFAnNHeHoiNVqPW5k61WD22e6blQW9KY44gvZgoBNvzo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bcc5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 117073\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":117073,"size_decoded":117845,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"89ebf7cd62332a5a4bc1a14be07c48e6","sha1":"c1289b1d0acff277a712d19b87a3f7be0dd06b1a","sha256":"34f547edc481e8c4f400259815c05f3ff5b9d4dd4e0207afdb09ff62f86f50ce","sha512":"59867c7d65ce0d2a86c69e568ec4e32ab52b5632dba6bc8c85bed1dff4e2b1727e2690a9877bcac787deb78d3f1df9695dce33169e8cc550d7f679947c8265b2","ssdeep":"3072:v5/xOUgEm14pvF3tJTatz7hu9/QPjpL+LVNKzdcVXJlVD1qlAaO:h/IU/i4pVGtz7e/kxgKcV9mw","tlshash":"75b312059a213bd3f5a0a75b83ade38e5fc04211fa5519ef5850e5a53c28ea68bbc033","first_seen":"2026-08-07T21:29:27.417215Z","last_seen":"2026-09-22T18:32:36.676277Z","times_seen":3,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/10-3.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.701Z","timestamp":1790101912701,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/10-3.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CkermifN7wSfz%2BgyCK5ZYgBsOxOjffqZ%2Fom2KJ0uegHpLvmwDm3UaBPtKsfjavpI375IX45RlD57FUSofXwwtL4o0xAW%2F9QdUKCbOeWWJNmsontsUkCl0df%2FUxkluIr8vvc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=4,i\r\ncf-ray: a3f3639a6c1e5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7938,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"a4b94655dabe0a22b09f95427735239e","sha1":"b11b7e603df5e6ed58a9289528a0ca1f536f1328","sha256":"05b6e6100dd9bf8c2dc284100bc9e37b79511ceb49e176688425eff6d5020848","sha512":"f948069dc78f205f36e380093ed3f3191e1f92656bd6d00a3ead9c9ffb5b33975e92c78a41f2b39a86981f4d0f7dd9dd19887138d7ed8352b7afc95d5e78a321","ssdeep":"192:Vj9jhjOTK/OaaUl8PzHzLk81B89T7vlCeNA:z//FU9AT7vlCeG","tlshash":"80e1ba63f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ee47245","first_seen":"2026-09-22T18:32:36.676829Z","last_seen":"2026-09-22T18:32:36.676829Z","times_seen":1,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/CTEastmanRoman-Bold.ttf","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.835Z","timestamp":1790101912835,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/CTEastmanRoman-Bold.ttf HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://theracology.com/lander/steps_snow_generate_programming_algorithms/clientlib-base-critical.lc-517b76004a51e58df9575fd748c1ac81-lc.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Mm2FV8g40rI1FunndWUziuVGXMe6A0bYuNCkXkyETrpn0psKODDeSbtcfzK%2F%2F8U1tqJLgPe%2BW%2F7ocA7%2BtPj%2BcFagX8oFhJpDg2zp5IJh6uyn9MUNfuywxe6BOrN6xI95Pfc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a3f3639b3c335691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7945,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"eb26504c951682eaa83a19afcaa54ae2","sha1":"37fa8ebc53b7c9d85c5841193f14b485cdf449b1","sha256":"aaf7713586673c5dce4d6d51b00a355fca4514d40fed8d2c3db389ca143456ba","sha512":"3d24163f9ddc80baba4d052854c1ebc98a2762efab96e1e4f872edab61a0fb30d18cc0abfd7ad35e4866cc4f625ffda7e0d3d22be4b3ffd9a572d611857dd940","ssdeep":"192:Vj9jhjOTK/OaaUl8PzTzLk81B8937vlCeNA:z//Fw9A37vlCeG","tlshash":"21e1ba63f9f925fe1093827231aa7b193de48013ea6708a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.677744Z","last_seen":"2026-09-22T18:32:36.677744Z","times_seen":1,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_6_EN.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.405Z","timestamp":1790101912405,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_6_EN.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-216e1\"\r\nexpires: Fri, 02 Oct 2026 18:30:15 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 97\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=63%2B9iZsJsAdLLiXk4LZklb0UKGlzLNUSWe68m%2Bl8ZRe4rVwyq%2Bn4rTm8iQppvn07yxloquOJLXeJGuhnSl9PN9f%2B0q5Fd9d04oTmUdXBF4OChrxgE9WsE7lDWjcchzngqRQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bc05691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 136929\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":136929,"size_decoded":137703,"mime_type":"image/png","magic":"PNG image data, 696 x 312, 8-bit/color RGBA, non-interlaced","md5":"b26700ab8868e804661a53f6310ae5c2","sha1":"936d060b9ac18b97d44156d6d499f5b88593f5f0","sha256":"be05201a90f1e87726ce06686c55365eb4ee8c63b604f0520402891f41839051","sha512":"d5f913eabac3772af84519ac1c6342e744de0691dd87e060e0fa9a2cf2add904959161032aa63f5b8ed05b5c04111c10fdfa801f41294542fa083d2ca716e8d9","ssdeep":"3072:RaiMBtWY1igoJHa52qZEPTSdBlq+tT/YAYHV/ovrr:kNBtWY1iLHa6uddLY5mP","tlshash":"c2d31374d27059ffac106c8fbe9306678583aba2f91047179271091c0fb17ae67a716c","first_seen":"2026-08-07T21:29:27.42848Z","last_seen":"2026-09-22T18:32:36.679629Z","times_seen":3,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_tents.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.408Z","timestamp":1790101912408,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_tents.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-156d1\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GaAzCEDa8BNRTO%2BYJHzBTzkjFX%2FgEDmCAs6cNZeHjuZSLg1IQoFUO3SPrE2mN8ikdaBIrRryvFK3la0KwqPshuc%2Bh5YcI7Hn%2Fnh0wxH4J8yeE4FEVfYey8Lhc%2FNdUUhh9xk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bc35691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 87761\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87761,"size_decoded":88538,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"f957a04af0526edc792b8d3e827c297a","sha1":"a67374a72f104977e26bc84678545c2c0c34f08b","sha256":"b7c2512a78eb7e5c3bbc9cb8b89ab9cee4d1ee07d675613439fad0034d215c1b","sha512":"0e15f4c415d92c0175bd823088fab8aa5770630af69df995bf16ab9be5ac0560bcde640477fad5199df9340beb7bf10039e5425a327b41c621bf8fcc54b8e931","ssdeep":"1536:ionJb8trpQio0rZwYF0F9qekFdi90vAox2E/YoGtk87KkWWHoFf2KuHoE1FHDlIJ:cLQR0rZwYWjkLi90vAoYE/Yos7nHuV55","tlshash":"138312cb33c6458dfa06d2fc6d4132604c062d876ea6d1da7d6580cea9e634e2f3ec61","first_seen":"2026-08-07T21:29:27.387421Z","last_seen":"2026-09-22T18:32:36.680363Z","times_seen":3,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_322_hp_wodp_shopsmarter_dealsonessentials_en.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.419Z","timestamp":1790101912419,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_322_hp_wodp_shopsmarter_dealsonessentials_en.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-59a2\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6STB%2F2NyoqCvNYn6hqSTTrWcJ7vko6ngdmgGgVyH6C2wN7VqZz1aHu%2B1fZkyieMZ7z8WyHjcEVKZoUgufqBtzjqhmEcIjjI7YlsLKYw8KuFL3UbJLjn9z%2BPl0dWSIuguhNc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398abd05691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 22946\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22946,"size_decoded":23718,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"45570a20763028e6633848163c09333a","sha1":"89f1af65f74cd3efdcb5436ef913a2df19510833","sha256":"55e3b2686bef5063d92f1e7521483d75aa7988fe8b151fea5ed949921430996c","sha512":"b36ba2363adcb93aef3216d52a8db163aeaaa89d3d9ed11a24fbdebf387adaa43d4cf3d099575bb18ef19fb88bac4d25ea9d461e07880f840a6553ff1ec383e8","ssdeep":"384:PH59d1TX1mM4agC2NtKHRFyMryU4rwVfNJAgd3tTNGAisZVh/sVaCzI+j3V9:PH59dLUFFNtK76wVfECZZVh/ozZ7V9","tlshash":"d6a2d07a3b528b41fb9dcb30921bbe80789750207325eb99d2452b1be4879d37e2c588","first_seen":"2026-08-07T21:29:27.430039Z","last_seen":"2026-09-22T18:32:36.681119Z","times_seen":3,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_L_PetFoodAccs_TriApp_ENG.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.442Z","timestamp":1790101912442,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_L_PetFoodAccs_TriApp_ENG.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-bb6\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CXRyxnrLmv6xiC70xtxlo%2Bfd61Lrlt320%2Bs4jIB7I4NTpv%2Fj20WMm16jgb7%2FQP5%2BRZL4ezBDc42XOjmuQmQPhfK6OflmC6UO1fRNM8hOH4Q3LBnSQl0A6%2FF70NURDc3Qwjs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398cbe75691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2998\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2998,"size_decoded":3774,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b724dc65aef72016271fb3a27ebbd8a4","sha1":"649da18f24742b32425bb7e491d633ef8f6cd84d","sha256":"a4936103c28ba21c6d446d020541603422f0a3de297779a08a6cf8e2bab303a0","sha512":"788f3c16802ae6d6e9d32a2441da3cec3811314b582340e109918eb0620697e4e3455ed9508ce3c2c318d72e713530b8d49cd2955207fba15feac7213a3967fb","ssdeep":"","tlshash":"91511c7c59b8df430b7a39d9728048a97c889bb1f4133344b0959ec6f735691b0994ad","first_seen":"2026-08-07T21:29:27.303008Z","last_seen":"2026-09-22T18:32:36.681889Z","times_seen":3,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/3-ctm-offer-badge.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.466Z","timestamp":1790101912466,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/3-ctm-offer-badge.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jV%2BZYmpUuFQOridHcSB8s8Sumd7PdOxeXdfOlTI2o4ALiBXed%2B%2BQFMOBJuL2YHMGsNnKmGWLQH2kNuAmJkKqqz3bpRdsVgv17%2FKtxhrsuhR16zwA9EueEpyQB6TmWFNYxpo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398fbf95691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7938,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"55114a85ea7267fd8e82421cb38a98ca","sha1":"1bbb2a2dfd4eaa7d02a79cc87163a610eb8d9487","sha256":"7ce45b4faf5ad73476044f2784c95f3e16aa2bc30829d7ee0869160b0dd0f8a9","sha512":"56284bd4d36487059b8b8e1596e97d1f5c91df9717b396ffc0658c9b29c2d427132acf475c3b33a18bcc1d38e966d5c47f4e32f4f0b7847fb1c21ad701a1318d","ssdeep":"192:Vj9jhjOTK/OaaUl8PzCzLk81B89y7vlCeNA:z//FD9Ay7vlCeG","tlshash":"27e1b963f9f925fe1093827231aa7b193de48013eaa704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.682654Z","last_seen":"2026-09-22T18:32:36.682654Z","times_seen":1,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_SC_Footwear_TriApp_EN.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.471Z","timestamp":1790101912471,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_SC_Footwear_TriApp_EN.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M%2FDfQJoQfhvB2ozQ9VQp0Xt6k%2FWWcyFomnC1zJDkWvyj4M%2Fxjn8EyzHiSgd9E3lpB8OdAGL%2FzFpj4Z%2F0ekcmz2uRPxlqDSXel9iolB55V4TqwvpnYgylJWI42GRpgU3E%2F%2FU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f363990c015691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7944,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"62f708d131d35be8b5329da848c7a374","sha1":"0c1287bd97018c6d20547bab9c210e4ae897e503","sha256":"35c15913eb47151893f5ce55dd48e18d4b6a1f5d6185e791c4858af085d36f16","sha512":"362c5578ab54260d615c529412a35a25206b12af903ba218c484dfcef4554233f9a89179afa8702de393a1ed90a8a2f06df01e93482e622c984430efa1e3c144","ssdeep":"192:Vj9jhjOTK/OaaUl8PzyzLk81B89i7vlCeNA:z//FT9Ai7vlCeG","tlshash":"00e1ba63f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47285","first_seen":"2026-09-22T18:32:36.683964Z","last_seen":"2026-09-22T18:32:36.683964Z","times_seen":1,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/S6uyw4BMUTPHjxAwXjeu.woff2","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.811Z","timestamp":1790101912811,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/S6uyw4BMUTPHjxAwXjeu.woff2 HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://theracology.com/lander/steps_snow_generate_programming_algorithms/css.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Iu2nSUJAHxYHd0a5%2FR2vaqeVwUrLWvKQGHIQBfg8dxdSSWRtZQca1fHLS0pZX0lC9zREOJjajR4HQ6hhIX23fj2U3%2FZao7Ln0tTNHdgg5gGFhHzXWo%2F1ZhSMpvwoaRHEHuU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a3f3639b1c315691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7939,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"924633dcec1eadc3df90d17f79ddeae5","sha1":"197d141b45e9215762a67a49d574681d46cd4c5c","sha256":"bedd37ed56181dca1d862423981f80b32de3c70208bca3f7c32d05cbaa5d03b5","sha512":"bd89fe3046c664be7e7f14da7ac0a10e9e6de107138474a38d0ece1669d5cedef378bce7db1462baa030cfaaa62c730005d1954269a8aac1489a0f94b6c45db5","ssdeep":"192:Vj9jhjOTK/OaaUl8PzPzLk81B89/7vlCeNA:z//FI9A/7vlCeG","tlshash":"e5e1ba63f5f915fe1053827231a977193de48013ea6704a576edc1720f8ef85ed47185","first_seen":"2026-09-22T18:32:36.685159Z","last_seen":"2026-09-22T18:32:36.685159Z","times_seen":1,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/GAS+_App_Image.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.468Z","timestamp":1790101912468,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/GAS+_App_Image.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-7fa\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mQNVGPht7%2BJq3lyZPPpk8IF4OJgnHtwCavqZVvmNveoXCDyU%2FkIKR5A4y3teSmo%2BjnX1slpoEd%2BcTCv9oytsgFJkRnJDhyag3T6zk3hd%2FqA3uavmXizq6oyKylxR6z9z%2BHA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398fbff5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2042\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2042,"size_decoded":2818,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d964732da022fe32fcbfaf694ff74b1e","sha1":"5db23d11f9b99e0e38bae8954dfbc8c847ed7175","sha256":"702ad59704dd21075ec2b058bf38155d63545ea85c6bb6eb660cbc6c4d1b691f","sha512":"ecc22f71c31d645e6ff572126213d42392d53fcc6614591a9c8ba3e4c104c36b9f3ec59d121ffd0965adeb45242d9153767dbc0617b8584f9fdde4f3ac41a2d3","ssdeep":"","tlshash":"6841fa49414cb824ee9c9a4cd7807d708d75558eb241fef7995695ec6c52ac03731439","first_seen":"2026-08-07T21:29:27.334131Z","last_seen":"2026-09-22T18:32:36.686274Z","times_seen":3,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/3240_SportsExperts_TriApp.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.470Z","timestamp":1790101912470,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/3240_SportsExperts_TriApp.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-6ea\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c%2FV3bxU5mFOwPvbjvwK1BCcoj4jA98Bu20t2L0k2o2FSoVqmw8MtVKWtzWf%2BUWbKWuX7kbsMmQEipcFUozFqkVsQ%2FqRlCGOnphmOOI1YQXa0A0qZQssfDYH1cv5GlZwpdf4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398fbfe5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1770\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1770,"size_decoded":2540,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"20a241cbde5bd41a5c657465775e7880","sha1":"ea85e47950fee90e6abdbc1858b7278175369a76","sha256":"9c384067eab52d75794b156de1e45fc8b3705fb524fcff3dee88c95d9b930d65","sha512":"d143660a76bef33f9f7ccc648e02c141f5c67752ac4874c2bba060f0688e42fde086f1da932cdeecf55dfc6c4a5d04d551f817006a65a7af418d4b2863605dd7","ssdeep":"","tlshash":"3e31c7ba190694481861ed031c050da8fadb2b36da45c731ff4e0f277386a6da9d8821","first_seen":"2026-08-07T21:29:27.35874Z","last_seen":"2026-09-22T18:32:36.687083Z","times_seen":3,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/a20ac9b3267ab4fbb406fb532f36076e0a4aa0c0.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.179Z","timestamp":1790101912179,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/a20ac9b3267ab4fbb406fb532f36076e0a4aa0c0.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-753\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 173\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zK5BAuFe3QYaIgnFG9%2F0uS4c%2Bufdva0FHXmW5r%2B%2Baq%2FkAlTL8IQLwsD5VPnWHfpguSxVOiHkqPqV7g0%2BLrSaj0DYdabWBCiZFROAH4M1sQrDRtSBficNW9Q%2FE%2FCbOCTKvYE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363972b965691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1875\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1875,"size_decoded":2654,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced","md5":"4f3ec4c94b35cd1a41b5be9cfc1346fa","sha1":"a20ac9b3267ab4fbb406fb532f36076e0a4aa0c0","sha256":"b29e0d89fc88e1fcbd22e896432927b9439d985405ba81822e578d858ed51765","sha512":"e35d28cc39134a00d5bb5ec0dfa76babe5b2a16e61a18824f0bc8fcf5b8df9f89a4115d3a67bc2e2ef3c14f1c277b940193ec68dc4b5ad792349118b41baedcf","ssdeep":"","tlshash":"bb313ba5f554ecfeca8d4461094426ea1ff7f7b1ed1110f5b19a34c0a9743587c109b9","first_seen":"2026-08-07T21:29:27.456184Z","last_seen":"2026-09-22T18:32:36.687751Z","times_seen":3,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ct-brandmark-standard-primary-rgw-pos-hex-5f6ce5ad-aadc-44da-9d55-a06d4c6273bb.svg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.394Z","timestamp":1790101912394,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ct-brandmark-standard-primary-rgw-pos-hex-5f6ce5ad-aadc-44da-9d55-a06d4c6273bb.svg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2Hy%2BVus%2BUlbzTomyPC4sYMQLdUZuqpmjWeU4rmvQoKzqxHQ9qOfUIUFEp6Uw%2FiNeZGDTWMIlYdCWyb8bli4hbyjMqPEDYNJy1yhswFuPNUS1xSMvvXevm2wnB3Wukh%2BsF0c%3D\"}]}\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\netag: W/\"6a6764b8-d73\"\r\nage: 174\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a3f363987bb45691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3443,"size_decoded":2279,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c9610cca6442e757fecdac7eae58434e","sha1":"e8bb70c5592c7ee2482b93c2b47d97611c5a84a3","sha256":"00fce154ecee0850da96bb875a59b24f139605fdc93459258c1ca926cf1cdf24","sha512":"f432cab223607888b1180e46e890159b023e1b1d45984208ccded5efea831dd7350f760cd319e395b2aa43225f23a33fbf3999f8399927f3421688b599cc078c","ssdeep":"","tlshash":"4361045b43059feaefad9138da44148976a0e4c79070e2d4fb6b3809d0da4e5bd8c3ed","first_seen":"2025-01-20T21:47:49.667213Z","last_seen":"2026-09-22T18:32:36.688433Z","times_seen":14,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/triangle-7459-ctr-westjet-featurelist-en.png.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.425Z","timestamp":1790101912425,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/triangle-7459-ctr-westjet-featurelist-en.png.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-20a37\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h5iMyrRgXDHAn9CV77zz%2FFLSWUjiKoVjcnsviWMQ9h%2FwkXt5IPC3Ner7RXC%2Fnwxt749zYWUP66jAPZsTy%2F9RzRcCvsuXSW9Cnw%2B%2FaLGFYoPhQ%2BZiwX2sszfAdkoCpElHIjk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398abd65691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 133687\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":133687,"size_decoded":134469,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 684x800, components 3","md5":"57d116399193f84cf06ac99dece0581b","sha1":"285170dfbdf281a91085525d009d4ad303219b5b","sha256":"c9b3dd098492b4d0ce790cc486cb8933e5e3a34609834174362bb8296e55341d","sha512":"ec315c8d4195964fecb8fbb99a6e0ec98baaa297b527f50fc14d3f3e439109d0fd3dde7b0b7685a5f7f4a391c1a6e58de88c4967dcfc8674430d7d8068305225","ssdeep":"3072:wtLLzLRI27TlKKNjmZ3pGkd60x12XiP6SqVXWS/p:OLzXrjqXd1XMa+JWSh","tlshash":"35d3121215374a87c40263321315a7d06b50fc69e47fcbc71a89ee8d1cf967eaa8e4de","first_seen":"2026-08-07T21:29:27.321759Z","last_seen":"2026-09-22T18:32:36.689082Z","times_seen":3,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/tr-sc-athleticclothing-triapp-en.png.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.478Z","timestamp":1790101912478,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/tr-sc-athleticclothing-triapp-en.png.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C4MSqC2rarzftMZnzNy2O9lzOlIXLJi2I2u7xr7Li%2FRQ6aAuAcMPJB27KecUiZeU%2BqHr640sgNnZeH1%2FJxPSy75bLbHP%2FMl93KSf3PESQb6vbH%2BjPfiVbgoXSNl1%2BSSXCkA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f363991c095691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7942,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"b4ac5d23dfb452657c44dafd2ad35801","sha1":"f546804fb43f1518d8f2965b68b79f0e739319b6","sha256":"03fddffa15a8a877ded14ca02d48d8da5dfdb0ad539bd9200ac33ba7e10062a1","sha512":"093151cb9be90df1d3cea7513244fe9d515bd72a675b701af2bda9ca59becc10ac06dfd82f308af27bca860a073a0a2d3bcffba3e8c11f0dc4c9be8749b6414f","ssdeep":"192:Vj9jhjOTK/OaaUl8PzNzLk81B89l7vlCeNA:z//FK9Al7vlCeG","tlshash":"0ae1ba63f5f915fe1053827231a977193de48013eaa704a576edc1720f8df85ed47145","first_seen":"2026-09-22T18:32:36.689671Z","last_seen":"2026-09-22T18:32:36.689671Z","times_seen":1,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/10.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.704Z","timestamp":1790101912704,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/10.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=74K1wA9zixGpmbfdYN08vzt1cqFfBoYzU0fU4bUtNoL22ktvTiZ8HN1amiRDcbYiZb4dOv%2FXOlmmMI4ksf76xIjlhrnYgrUwy%2FI%2FWioYbfK2PyYX3yzCrIkHQGOz%2FwKLTs4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=4,i\r\ncf-ray: a3f3639a6c225691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7938,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"58b1f03c9ed9433d6b0f299e3915e790","sha1":"1a715771391633561b2c93e874326818fae66aee","sha256":"4f49be30760e22796bb7e52876db03ece03351140e40c5aa6680a3659ae63c44","sha512":"a43d35697355d9fa6a799b221fc78dbe115ab69abb4a103a083f7dd57fac1202f3796a133bd29d1657b9403d2026dc492c661300a7ae3422ee97906aa1eca579","ssdeep":"192:Vj9jhjOTK/OaaUl8PzBzLk81B89t7vlCeNA:z//Fi9At7vlCeG","tlshash":"42e1ca63f9f825fe1097827230aa7b193de48013ea6708a576edc1720f8ef84ed07245","first_seen":"2026-09-22T18:32:36.691019Z","last_seen":"2026-09-22T18:32:36.691019Z","times_seen":1,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/S6u9w4BMUTPHh6UVSwiPGQ.woff2","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.713Z","timestamp":1790101912713,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/S6u9w4BMUTPHh6UVSwiPGQ.woff2 HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://theracology.com/lander/steps_snow_generate_programming_algorithms/css.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k4bweIgvDH92W7NgjsUnA68898ymRhv1%2BKmRndo1aP1DNbiH6yb8tQG5RdrqvaJNuVdUulhMMm5RnjIo%2BviXo5SD9ZpKcAmsZ3x0EHA6CPg6jyN5XXnc1aldhJIN36SQDrc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a3f3639a7c255691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7937,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"076673eb8d7389587d6ca2b24a7ac276","sha1":"db22b7f30ceafab10ecc7cb8a5e28d9052cb2256","sha256":"2a14426a096621c404481b11b8f4daeab50560f5117770e8c8eb6c05d0c0f406","sha512":"64fb6d5e62e19c441ec60ca6f6f358d2baad54b660d4149be729bf16779145f3cd73aa33ca01d7a5a6df34c411d916feeede81826d39208fc1db740d53f84244","ssdeep":"192:Vj9jhjOTK/OaaUl8PzZzLk81B89x7vlCeNA:z//Fe9Ax7vlCeG","tlshash":"39e1b862f9f825fe1097827230aa7b193de48013ea6704a576edc1720f8ef84ed43245","first_seen":"2026-09-22T18:32:36.69233Z","last_seen":"2026-09-22T18:32:36.69233Z","times_seen":1,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_sleep.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.411Z","timestamp":1790101912411,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_sleep.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-5e59\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W8p0gkIJBwoiKnDqW1U3ZFApPYIguwRwJk1zXR8VnwdbVd%2Foevq938jM5h6TJKjsVzYJlEZOv3XYDXLTGNKjVHUmilNnGw4Pl9Qe3jLQGqen6ZsuGPcsBHNIlQmWKFbFnOw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bc65691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24153\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24153,"size_decoded":24921,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"bcccaf2363c10c6ba944dc1b187a4411","sha1":"f583ab28406daf1044357c07f8aae2adbe01b2c8","sha256":"d27bb70ca8539b5b37a9d6978d7289a6bf1b4e6e305ee8ceed16f62ebebfdf58","sha512":"34182572a232ff3a8ba155ccaadfa7aecbf61be6ca1a44e57d493a3e989ae1f351fed7e82573440c3a6a488e43b377556766c99d658c7ee73d8ad744fce32234","ssdeep":"384:JSnb+6B+q9vK5Wye5IuKVK98TCY0yLLGwSD7agET+a1lxSC3gA4x5w2h38MFhu43:Jy+6BvKMKVKCCY0yXG01T+clxSJXph35","tlshash":"25b2ce80b4411ca9b8a7c23d28b95815113a12fc5677e46e3e2c9cc1e7d7bfb1f42a92","first_seen":"2026-08-07T21:29:27.350827Z","last_seen":"2026-09-22T18:32:36.693435Z","times_seen":3,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_header_camping_en.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.406Z","timestamp":1790101912406,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_header_camping_en.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-7eb1\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zv6mXFqw%2BG3RczcS4FGs7%2BvKDsKSK2ePbK1z5cr6tBc0DxkM2CYeuEfnoJtkf89evf%2B7NTfj4eoX3amBipvXoqh7tIWnrFgiPZi0RTmuER3Xt9tZR9npykRlo6S4%2Fh%2BuRwQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bc15691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32433\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32433,"size_decoded":33209,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x134, components 3","md5":"1feb261792be102d1ec42c56de97d9cf","sha1":"2eec0dee19410aadd7a296130f85677b70b75e1f","sha256":"6b138f9dc4181dc24c3a55b4829382bb3755bc1bb3e9a25f10c87cd9303c759d","sha512":"d4972cd8c3f02e354a3cbec83949fc6a97cfb5e848ac38e47fb7ce2e8d4f3218406078a9054c59883089ba8e79d471b2bf5b359128a7f2f76db0842e8b1973ec","ssdeep":"768:qnwlkgxVbS1JXbK5yQqvx1OVyhHftUg4MRu4LwUh:qCkprKAQyh/cMz","tlshash":"54e2bfc6ab02ccfeea2cd53b50953c1d991168b53b98cffcc202ee5cf17762099660a5","first_seen":"2026-08-07T21:29:27.493026Z","last_seen":"2026-09-22T18:32:36.69406Z","times_seen":3,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_327_hp_summer_tile_v3_en.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.417Z","timestamp":1790101912417,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_327_hp_summer_tile_v3_en.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-f6af\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2ue8WgxfUwVNw%2BKCn%2Bfig54%2FLIs9jgFazrx%2FxNWAW2HPBjpsIaa6N%2Bhkl2n6RGFiYnKYyvrMPNfdnu%2B8lzwcdkLRIQjEIfzXm1ldIyI%2FyWplLfUR8DUuudvjwjgLvwDfilw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bce5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 63151\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":63151,"size_decoded":63931,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"a06197c948584886d1260949cf1f3e51","sha1":"ce9fc9b82a392a41b7ccefa1baa6d838fef4d26b","sha256":"04dbf146413302e4efa0b6c898f6d0d89db9b6557a603cd5ad7b346c5da3432d","sha512":"221874002d2d16fe8e60b1336d9c6d666bb3c8b16b869b0dcb4c20fafa19081a724063c57c3d12fd99428921b1938ea7b23961a2bf012068926f79428d7dd27f","ssdeep":"1536:YWK3S8sfvtVI/5xM21hSK27vL+SeFoes4j8sJEiOv6VarZmC:RK3gf1VIhXSK2zyFpPj8rrv6XC","tlshash":"5c53129438e7f46f8487a732d84142f9bdb6200fe21668af6fa458dc89740c1bd9c872","first_seen":"2026-08-07T21:29:27.482935Z","last_seen":"2026-09-22T18:32:36.694664Z","times_seen":3,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/7646_tri_app_interface_update_4up_brw_en.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.426Z","timestamp":1790101912426,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/7646_tri_app_interface_update_4up_brw_en.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-13851\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a4J0YUw2BZU85HMnYk7UE7jGuwuwGeG0vXl0NKGWIuFPluK%2BY4s5YoJxe07y9hvvugurxq0KO6nrQfkNZQlq%2BsXt%2BKxU4gPlsqJ85ksGBRUWMMYb0v6Mkv0Rt6ftrv646Bw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398abd75691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 79953\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79953,"size_decoded":80726,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 684x800, components 3","md5":"ac874879b154ebf9d5cd21faac810663","sha1":"16039a81120c1aeb7d2d1db2f5ee340cac35fb6e","sha256":"4e5d5de66d07be75cc8766f3f135f9c9ed48a2aca7ae5c07af9ba8d905068027","sha512":"1b72d2f58fe54b7a389dbbbd058236f7f2796d04f7f20495a1e5495b2d076707308ce6a6ab841886b28927029bb94eb76afbd24ee43b5cc515105d367c778a85","ssdeep":"1536:a9lURGjLudam4whI5B07G7V4TdyGmmm5qL5jCLuEr2zsyFRg3QC1EeX6:f9dt4r8G7V4Zvxm54U/r2VQA0K","tlshash":"2973e158fdb2c86e68e2913d5cad151257c00afde132e19ab31ddceac3c728b8780765","first_seen":"2026-08-07T21:29:27.420088Z","last_seen":"2026-09-22T18:32:36.695238Z","times_seen":3,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2025-hp-4featurelist-giftregistry-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.429Z","timestamp":1790101912429,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2025-hp-4featurelist-giftregistry-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-fb88\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IYMtnTkEBKw%2B%2BH%2BzgmDqW5tKmAOvWmgqehV1tPrAnmrIoICQlpj3K6x7x%2BfFtOeS96ZUyyat%2FhR0r8SobdsXX%2Feqnr2CFNNFB8YKtgzIwBdgrn4yWMKJ0xu91N7xbOmB0Ww%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398bbda5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 64392\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":64392,"size_decoded":65169,"mime_type":"image/png","magic":"PNG image data, 684 x 800, 8-bit/color RGBA, non-interlaced","md5":"ac8efae19898db9e65c81b4c2f946fe2","sha1":"2978a6b13dddafc468db6f47e3e0d697d88b021b","sha256":"19db9483b6e308c98aacaf9932a1a9b3c24be2711fa8e892ac44d305f8e9437f","sha512":"6565ee70786dc7ebcb018d1dab572543a64062356515ee226aa02fa6f6ebe2d25f00f06db0fbd9ea07be8678be4c91d2ca91543510571b7da1456cdbfa8f6e36","ssdeep":"768:mQTcjEkhltLroVPHTTZqg6G6nm4QysQIgEcYbCBSKcEAe5PqhR9oesduIZwvpNJ5:FHkTJMZ5DMCg7sCoH5eRquMRTep94YY","tlshash":"b253e08be109cb429c4ca8f97a5ecbc1c9ba7e6f1017457634d3a0a6a2df250f14ddc9","first_seen":"2026-08-07T21:29:27.460573Z","last_seen":"2026-09-22T18:32:36.696093Z","times_seen":3,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/sport-check-desktop-offer-card.svg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.458Z","timestamp":1790101912458,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/sport-check-desktop-offer-card.svg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Cf69x1HzCkP8nzQxxp3sLi%2FYtbO7yvaOGZ90a4mbx2vDYw%2BicH1tR79vR1hnf7Ji7vqVtR3la6DDo78%2BMoi6DL9EnvuhNMZXMtk5oXuxkBfTcJnTppGJuWJNQKFJNT5D%2BsU%3D\"}]}\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\netag: W/\"6a6764b8-1a2a\"\r\nage: 174\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a3f36398ebf35691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6698,"size_decoded":3099,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a68bbc4c4c2eec5e76d12e8920beebf5","sha1":"4a25a1ed8c41559aa67f91df4696511dff7a012d","sha256":"760769167b067e92c4c9704b1cd2b19e70832285828c5bc9e8fbbc1bdcbc6d08","sha512":"6760451890903f1bf6585a34ef4f8b2a586f99ff68ac40e109e2dde13c181514193e7ae02cc99edeea25868bcf1f1210a62309a259612b9835e52348906164d8","ssdeep":"96:Vvs/DjvWvssiyjK8388xja9nP1gpQP2960wSLZPgEHUiyaCR:2NVZm8QWNhe2EHMR","tlshash":"bfd13fb611b48ec1b8401b519fd8ad9c132de38af27324c4775e14b31f612ab35bdb6a","first_seen":"2025-01-20T21:47:49.776895Z","last_seen":"2026-09-22T18:32:36.696617Z","times_seen":6,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/3240_SC_web.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.460Z","timestamp":1790101912460,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/3240_SC_web.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-902\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XS7cq0G4E0GEcJDDtlEse%2B1iVUgq01KfbYdSRORUofhOYHlwryIbcMJie1D1VvSkhr0%2FWrm5y4hkk949ScILhP2LY6muO2rZ%2F3O%2Bi%2FjAIhcwMrFmsRfuLIsLzpLRvo1BdwE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398ebf45691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2306\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2306,"size_decoded":3080,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"6e6d85620551547e5a80d2c02c1b092e","sha1":"218b6f445b91c1fa2338a8adb43d85b906f9d41b","sha256":"cde65cdbadf7d6eecf227c2ce9d1a9794baccc5b07f6ae6199bd746700a63511","sha512":"3d60b38a6a098f80927470e8095cbf33c152fa0402da923f23f00bc4c66fdad5fc71b964be59cab1d6c90594cea66e2e0c042a7ff2c746f7740b9bd717aca9c7","ssdeep":"","tlshash":"5e414b4f5735aaf449805ebf38e8ac4980ccbadacc12360703d2b5a2af5a64f8f1d104","first_seen":"2026-08-07T21:29:27.313659Z","last_seen":"2026-09-22T18:32:36.697347Z","times_seen":3,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/Atmosphere_App_Tile.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.477Z","timestamp":1790101912477,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/Atmosphere_App_Tile.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uqm655yjQQ4cOUHcSZ1mU7lmPkC1JXXDvo7XRSbkipC%2BUQsZzwh4CH9HpFgS8zcrBYfZC7CW4Vl7QRBohel7RhmQRz14CTU9FXBc4O2FOfVfDAXWHkAe9dA%2FhKM1%2BwNHLR0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f363991c065691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7936,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"836f1f75a791b5ff3436531ee2f8e381","sha1":"9b8dec30553b2a516e7ee7f2235491caccf9ff75","sha256":"728f03556d31078f9ee7652a033d84cf49cc37ab6613651e56eab1caf890662e","sha512":"f3d76f5db4bb977d4b61beeff600a79e3caa213fb8f2ade285d7badfb31c8bd9c774f580bcaacee15c4037584dc2e83d6f05707a5344d5fde3f8fe3fc49ff9a5","ssdeep":"192:Vj9jhjOTK/OaaUl8PzyzLk81B89O7vlCeNA:z//FX9AO7vlCeG","tlshash":"49e1ba63f9f925fe1093827231aa7b193de48013ea6708a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.697874Z","last_seen":"2026-09-22T18:32:36.697874Z","times_seen":1,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T18:31:51.732Z","timestamp":1790101911732,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4ZOWSHDXqhpxqZP62pnZO5%2FDSYutIRBSJQqL5K%2B1VLq04xUb8fHzbDmCjGMyREmdShZrqdAtEA7P7CkewxuQvERini%2BYBeE5PZd%2BVzXLTI1PkQ3YxVxEGW%2FXdASHpAD3oSY%3D\"}]}\r\npriority: u=0,i\r\ncache-control: no-cache, no-store, must-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Tue, 22 Sep 2026 18:31:51 GMT\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a3f363949b695691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Adobe Experience Manager","description":"Adobe Experience Manager (AEM) is a content management solution for building websites, mobile apps and forms.","website":"https://www.adobe.com/marketing/experience-manager.html","common_platform_enumeration":"cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*","icon":"Adobe Experience Platform.svg","categories":["CMS"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]}],"data":{"size":564384,"size_decoded":91548,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (36497)","md5":"0eba2ea4b70eff4bed45833e48142197","sha1":"fc23323bd2506d850eea79df234861ea9c8437d3","sha256":"b3aa4a7d9c36242596e8df65b22a6227f1515a548e83363f4e2a76a3b7574f9f","sha512":"4157477436a79b4d8d3e3bdeed3ef195e6fe4a12503112d3223ed714fb3b2da5346ca2ae9d74e1529aff3913a312ca52b4b683d5b7e307e167ecfed56aebc43e","ssdeep":"6144:xmCLvOoCLk1FF2gD5ZKHuiOscm6pszn8BKE:gCLLCLk1FriOscm6pszn8BP","tlshash":"62c4d763e0b1527a91df7399e162278875139b0befa31bfdf48c02684f89b954c1768c","first_seen":"2026-09-22T18:32:36.69902Z","last_seen":"2026-09-22T18:32:36.69902Z","times_seen":1,"resource_available":true,"data":null}},"time_used":187,"timings":{"blocked":-1,"dns":10,"connect":25,"send":0,"wait":148,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_1_EN.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.399Z","timestamp":1790101912399,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_1_EN.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-222a1\"\r\nexpires: Fri, 02 Oct 2026 18:30:15 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 97\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Vrrji149Uxo531MJ%2Bcu%2BJSV%2B975vOFos612pydxly30yv1dP0Uo8B0krQv%2FEmyWx8oi8J2zB%2FwrOUBSXbCLvJZqRDBRU8FquWh8%2BOwfje1A2Kpyp8dTL4xWnYRq7mlmllr8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bb85691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 139937\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":139937,"size_decoded":140715,"mime_type":"image/png","magic":"PNG image data, 696 x 312, 8-bit/color RGBA, non-interlaced","md5":"e72cb1dff9bd07f01c13d0c0419a22ad","sha1":"19c65f035bf83e623011133c8004554c48e82b75","sha256":"8a06a5aae179cb21778bf2166fcb9b40e713b9ebb211935542ec7ddee9a02d57","sha512":"8244ee3785045ff1ef5f3396731e8d9d73d771d06e00ebe6c5b759bed99bc3070a7846f8031acfcf55a89596f5cdd9abe924a73d0439c79d601ab660671cebcd","ssdeep":"3072:+ET+JGy4qljUJI6rjeX0maxdjRvlE+vb3mnX923lCvP0/mAv7U65:X8Gf0FYyX0bpvlEaD8P0/bwg","tlshash":"07d31292319d87ec21876c975824cfde1dbe2d2a929df63f4ed1502933f39223ac0656","first_seen":"2026-08-07T21:29:27.475084Z","last_seen":"2026-09-22T18:32:36.699945Z","times_seen":3,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_322_hp_wodp_shopsmarter_hbc_en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.418Z","timestamp":1790101912418,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_322_hp_wodp_shopsmarter_hbc_en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1dee\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FL4upNJ0Q8kFCCMcusalvOBjtjC4BlA3ooakMAhUAK0Q083ZxHgc3dL8QQMXkN9IQHX8qqXdMXoyRzduS9yOQ00vAdF9neNnxeZHdAcxe1z6STrXZ4HvgZ3DVOzYdjfV7fA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bcf5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7662\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7662,"size_decoded":8428,"mime_type":"image/png","magic":"PNG image data, 440 x 550, 8-bit colormap, non-interlaced","md5":"30510763bee784b79f3367c6aaaf301f","sha1":"db20ba5f556049099390b0daabe9ea393df55633","sha256":"24c0bd8dc737374c955ff14d48cceabde9900fca9033644dfca570550f546085","sha512":"dd550bc213d0e11635e2405a523b11398c8ece934fd45d1adb2fb03fe8850ce1a5970aaa4d9ca2da09fc2bfe5d5e28b0d027ab37beca25bd698593bbeb2361a7","ssdeep":"192:fDHsXrGV96L932so6v2XRnUb6JLgH7UQ9ugf:LHsI96x2sXY6OJLgHoUf","tlshash":"fcf1a8fac4543d5de23d4fc849d88395def12cc82c7239a5e112be297e3ab51053a8b5","first_seen":"2026-08-07T21:29:27.294286Z","last_seen":"2026-09-22T18:32:36.700494Z","times_seen":3,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-ourservices-featuredlist-obo-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.427Z","timestamp":1790101912427,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-ourservices-featuredlist-obo-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-13ba9\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jp4Jwz3%2FuQJJdQx%2FyOpHw5zP%2Fl6qvCtG%2FiYYkPxu4reVfM90iUEc9EVH%2Bsc1Gs%2B1ZoaI1RYKzq8zHU90quK0IBzzJjmbznwJQKSPoLuDj8HUQCSdMPFQ8lhgG9HK%2FK6lVUI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398bbd95691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 80809\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80809,"size_decoded":81589,"mime_type":"image/png","magic":"PNG image data, 684 x 800, 8-bit colormap, non-interlaced","md5":"16924f907a05cd0905916ff9d3ae2a4c","sha1":"0e0193578268af8851b5d5f5ce5cbc07f394af3e","sha256":"10e33f297c1bc01b204491ec69932a1f86f360e0e9e03322e083cfee3070a4fc","sha512":"b1d6fc1f3b789ff4da30eff9a2d1bd0f30fcbb1f715670b0d33fd9febc7395f582cba921c6d379e0bec5632980a169c19b8d8e857a1c7bb19098684674dd24f8","ssdeep":"1536:Mnmtx6S57XAsd6mxDL+QJLYW68yA1lEVzlMWc7/PwuwvGgSs7i0mD0xJjv8+t3jj:dLn4mh4WzyA1wWX7/P0+FIyYnjv8+9jj","tlshash":"d383f1c3d524dc22f17f0582dde2c9b1c8ba976dcc380aa95809d37eb617a4e036a965","first_seen":"2026-08-07T21:29:27.337964Z","last_seen":"2026-09-22T18:32:36.701004Z","times_seen":3,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/20x-offer-badge-power-ups.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.437Z","timestamp":1790101912437,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/20x-offer-badge-power-ups.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-635\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FulMKa%2FAE6rlbp4Y0SVsTkSlPNjyotFXZR%2FY8%2BEBJ%2FOcRzz3TfzHVe1i58TST%2Fm22YP4A41nT0OIfV6P%2BfqAPwDX7Fo%2BGd33MeElR%2BCzfX7Yb%2BlQSib6A2nNxL85td%2Fvv24%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398bbe25691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1589\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1589,"size_decoded":2374,"mime_type":"image/png","magic":"PNG image data, 96 x 36, 8-bit colormap, non-interlaced","md5":"0bec4e9ae7de0911a0a80eb71f1b7719","sha1":"8007d41f62b4526f7e5e144ee3f30e464820dee2","sha256":"c5c50b084c492aba387e6b43170ab828e7d81a8e0c4931d03748292bbd6bd3e8","sha512":"37c94e0fe8919700b19f0bad04d1ed34aa0afc5aeb6216828e8be02bc9c25d2ce3492410923a2d3ad92cb88e84c6bc13254e751d7d4115539104a09581f68af1","ssdeep":"","tlshash":"c731e84d43833d6c9282cb4706aaa0c6aed0a61678a41a56234ff5e5bd2649253f6f0a","first_seen":"2026-08-07T21:29:27.408955Z","last_seen":"2026-09-22T18:32:36.701534Z","times_seen":3,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_A_AllSeasonTires_TriApp_ENG.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.439Z","timestamp":1790101912439,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_A_AllSeasonTires_TriApp_ENG.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-b54\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DjxyPrTwTp0TjjzBtD1OSb7wAimYg%2Fb2C8r8Bp4Q0adFfyGzqfnDTF%2BCRg4SlO01Kpq%2FXuTc2yIqCU4MSi7Gq6ZyYgDMbLX4Jfm8qsgjOeYPO4hE4iHOGoJ7WXQtHeYk2Lk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398cbe45691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2900\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2900,"size_decoded":3670,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2e8041bbb5674d7176cf274ac1f86592","sha1":"c4cb0b56925be3e8d91251b926d03d9824e2b9e6","sha256":"38dc2807cca82844b474dc6c88e8ef95ee374c3d6fe95ea5242988852b8dc46d","sha512":"f2ef3ff4ea7c12a9f0aa8c4f5766c2fc75821aaa7615c81808b7ff967e774473cb8f64354f326c103f51a90fd7b49b150f13c21a10be4de6b3e5ff2422f8fbe3","ssdeep":"","tlshash":"c3514d54522ef75811dfd29ee9dc59ae01ec20ae774337b87b68387862e718343e252c","first_seen":"2026-08-07T21:29:27.352803Z","last_seen":"2026-09-22T18:32:36.702052Z","times_seen":3,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/10-4.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.695Z","timestamp":1790101912695,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/10-4.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XAZq2Tzz7lxyi9ti6DuYIRADuA0cSiIutdDPyOeXYdtUqhfppCEXTSKSo0VnxWIAyXl1ke9gFlAhLLnFOq9%2FFTGXYWqRoq5LdzGGnHX4n%2FWu2QM%2FfW%2FAs7ZmxCWQrCP8T8I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=4,i\r\ncf-ray: a3f3639a5c1b5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7938,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"452c35139083375b18aeebbc78fc81f2","sha1":"1bb345e145e35d91a69223e3ddb5d5f71fc8bfff","sha256":"6dc71dda4254c9fb671abefe994c7bb63cd12f6c87ea96c1310f57702d55c79d","sha512":"2d79039dc874e759e404108b53f28d7d6a82bebe72215df450da273babd958cf6a6d2cfcc2b23c04839198d5f4bc90300f7fecdd2fc8efa3ed68f7edff6288ec","ssdeep":"192:Vj9jhjOTK/OaaUl8PzlzLk81B89B7vlCeNA:z//Fu9AB7vlCeG","tlshash":"37e1a863f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47285","first_seen":"2026-09-22T18:32:36.702655Z","last_seen":"2026-09-22T18:32:36.702655Z","times_seen":1,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/S6uyw4BMUTPHjx4wXg.woff2","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.712Z","timestamp":1790101912712,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://theracology.com/lander/steps_snow_generate_programming_algorithms/css.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WX%2FFwioFmuXXEKWDmS096ZxW%2BBxGmXASSBoTkLBq1%2BiTjqGN89ZB3vJ%2FaAmUxKm1K3ALeWqz%2FTbtm6ru4XlYfcw7v8UNbIDcBdgEkRquXyHSJUB%2BB120EfXyW1rxyqd25CA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a3f3639a7c245691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7945,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"c89bd86902831e700b80c703d72c7431","sha1":"3c102b1d9f07e93985cac49a9994ecacd85bab38","sha256":"a0b78229846833576b674f670c0f73439c1468971f6b4a8dad4204fe284fdf62","sha512":"5346ff73fe39b961ec18cf2b74be9fc395ab89cc3dabef2cf78fa722f4c49f4ed5fe1ac20e773936c2351cd694a2bea8c6e40290fa22b560a9811e4aae3281b5","ssdeep":"192:Vj9jhjOTK/OaaUl8PzMzLk81B89I7vlCeNA:z//F19AI7vlCeG","tlshash":"33e1ca63f9f825fe1097827230aa7b193de48013ea6704a576edc1720f8ef84ed43245","first_seen":"2026-09-22T18:32:36.703755Z","last_seen":"2026-09-22T18:32:36.703755Z","times_seen":1,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/clientlib-base-critical.lc-517b76004a51e58df9575fd748c1ac81-lc.min.css","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.140Z","timestamp":1790101912140,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/clientlib-base-critical.lc-517b76004a51e58df9575fd748c1ac81-lc.min.css HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gmrKIWzI3GvML%2B893JPkh%2FcZxrRLVA78cqCx%2FDdBnTDQjqjeHjQJwmvsbKHZ9UETOVDPQRRiLbncae%2Fw8ZDPGwQ4d5tbkbe%2B%2BTECVrf90MBIfy7pioZapVF6HfQsxGCpTo4%3D\"}]}\r\npriority: u=2,i=?0\r\netag: W/\"6a6764b8-d3b0b\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvary: accept-encoding\r\nage: 173\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36396eb8c5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":867083,"size_decoded":77451,"mime_type":"text/css","magic":"ASCII text, with very long lines (329)","md5":"87f147602dc703283b9e6f00522f728f","sha1":"f7a40715244e9b266fbcd493d8616fa2693dbce6","sha256":"dcdac02a45e5bdda580f19bf7ae64795fdc665a6c1e65feff42643c915c721e1","sha512":"be45a8342ab2853adcf4d5bf8dbb2f98892970295996d0c103af74d164ce54bcf62ac564f0f81763b33af496fa747ea6f5eaf77e0c5c12779f92356691554bfb","ssdeep":"24576:YBpKhe4mJvoZPe9EfyAJqpgRzbrw4cg/VRrUYzYVQXa0I35DqCOnsNaKgEFETgQ0:YBpKheAViaKkgQPlM/cBDvgNdMq","tlshash":"89050e46ea301aa8e1e7467ef0e535fc671d746bb5ae74b3ec03528ac8875851321f0e","first_seen":"2026-08-07T21:29:27.414909Z","last_seen":"2026-09-22T18:32:36.704737Z","times_seen":3,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/Logo_CTC.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.480Z","timestamp":1790101912480,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/Logo_CTC.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bQVzq1KxMuPqPCLn%2BVLHbCcJoPHCGlFt48pqxO4UbXmYDW9DaPIHUhbJ9zVhIfAB2gX4kpFQ4n3F4l6%2BeuyM5FB7SWwYVfj25DvG4K3FymnuM91dIoqYS180%2FKBB0kb5c8E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f363991c085691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7936,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"c8bbfb45cb149b725b6243e8d723595f","sha1":"8856a7d0c18f26d3297a0173f97e7d845b24cfe5","sha256":"8071bebda340bfb688078e9c45622cfabc27b08346855db329c269c412b2a018","sha512":"0e4dffc270fa0b0c7d3ee551742335fb51ab76d48232801052673d2b35097c31d4fd6ce536859c5c73f9d05049921380fb1e4aeaaabce2296a947e7e86b58cfb","ssdeep":"192:Vj9jhjOTK/OaaUl8PzwzLk81B89c7vlCeNA:z//FB9Ac7vlCeG","tlshash":"a2e1ba63f9f925fe1093827231aa7b193de48013ea6708a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.705253Z","last_seen":"2026-09-22T18:32:36.705253Z","times_seen":1,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/CTEastmanRoman-Bold.woff2","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.716Z","timestamp":1790101912716,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/CTEastmanRoman-Bold.woff2 HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://theracology.com/lander/steps_snow_generate_programming_algorithms/clientlib-base-critical.lc-517b76004a51e58df9575fd748c1ac81-lc.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U5fgRJ9DuqWgaxBriAw8Wu5eI1Jis%2BevWQmemcunkvvZ8TOW3ttkXPpZALJ3xQAMwkxuUP28fgC7h5SQRLiSz0x6BYd2a4m07m8v8oqPJiecaiX3SLzoJJJdm5DQxHZxv88%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a3f3639a7c275691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7935,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"7c7852382638c6023a3b7337472dd330","sha1":"fab4a3b0a0c3d5abf7cdac14fb5d6a02f5698cce","sha256":"8d727ffc46a5cdfc55880f267e3474e0d09c7ed6cc9105affb24a587d1449ab9","sha512":"a980e68cedb0cfd232e04a9ba0b2a63bb808dc256ca2fa5f87b06542e382035ec5a4914516c68d937eef781a0a043b6c31e3906229677d09df2432ebf56bc23d","ssdeep":"192:Vj9jhjOTK/OaaUl8Pz3zLk81B89/7vlCeNA:z//FI9A/7vlCeG","tlshash":"28e1ca63f9f825fe1097827230aa7b193de48013ea6704a576edc1720f8ef84ed43285","first_seen":"2026-09-22T18:32:36.706736Z","last_seen":"2026-09-22T18:32:36.706736Z","times_seen":1,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/android-chrome-192x192.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.790Z","timestamp":1790101912790,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/android-chrome-192x192.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=plDdAZmK11JbgYrxZfwsVuHqKQxab1lzr3A0WuO%2BTQGLer6Zzey3xJ2XepiXJsgtnsc1o%2FBePdp4HAaVdkuWi5vai7wEi0hRx%2FhRcXv1Yvt2P0%2FR9G9BDrDnjEgk6GAnbaY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=6,i=?0\r\ncf-ray: a3f3639afc2c5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7941,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"d15f3d5ccaf6f930f12790c183a6084a","sha1":"362b3302a4d946d64f089e57a866e331775bb015","sha256":"c9471ecd1ab7b6e329430e3ae378a1ab270313be44f53fb5ed829e5b5c34eb34","sha512":"f3a1cdffcc3fe1a3f053f2d98869bb233f208b5f9c8e12a6d36daa5211ccfdb585d877ce9ed835b13f3faedbdead8d8f994ff5754399ccb70653751ed95078f2","ssdeep":"192:Vj9jhjOTK/OaaUl8Pz0zLk81B89k7vlCeNA:z//FZ9Ak7vlCeG","tlshash":"72e1ca63f9f825fe1097827230aa7b193de48013ea6704a576edc1720f8ef84ed03245","first_seen":"2026-09-22T18:32:36.708554Z","last_seen":"2026-09-22T18:32:36.708554Z","times_seen":1,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_Aspot_EN.jpeg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.151Z","timestamp":1790101912151,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_Aspot_EN.jpeg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=3,i\r\netag: \"6a6764b8-2a9e7\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 173\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZbMWTzHooGlMqOao38bIS5HmbysJo8fNjqUPa%2FP4Li%2BZm4OaDD53WxWJycb7dpRbCbMKhIX89vhs6ZTXh9SIJmePyk1Xx%2FR8l93AGcyKBcTfO7RDdQgNbD2HesJVeL%2B8YRE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36396fb905691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 174567\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":174567,"size_decoded":175343,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 2048x499, components 3","md5":"f06a3b5ccfa8a127f2c2174a7fbfad7e","sha1":"ec9c80839229c764262f17701470f78452127960","sha256":"182a0fb4a2dac6ea8414126b8fa221f2a9da121080877551f2d97925ee085198","sha512":"c7ffa1b86bd0bc69e27d69889eda9a45de49dbc619543530eb1f076a2d26ca374f82524743fdd5a49b367c74ab319cd903609663d6d3fe046c0c327cfc5e5d9a","ssdeep":"3072:5rDrjgLb9PEGDM623IKucbvZ8aVP8JkssMxBUYhGh8sESmVUk8EBQE0YnUkXa+:5rrgLbGGu4gbhzVaNqYhGh8sRdEyvYnb","tlshash":"a40402b9565ddb42f86632a09e2b3d37e151660c56f4732a28cb7ca48e7094ce37c0ad","first_seen":"2026-08-07T21:29:27.504703Z","last_seen":"2026-09-22T18:32:36.710212Z","times_seen":3,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-ourservices-featuredlist-autoservice-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.427Z","timestamp":1790101912427,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-ourservices-featuredlist-autoservice-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1a900\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DFJOh0oqn9Hd5EXEUFLCmdjCod09ei9nFVthYoFx3k%2FXWmnm1AlDeyNIUU66mxt%2BK0eCdSxhI3lg7zHeUaLY3oAw0UWHpKT5IfTtIH8Kmgk7YA32BoXRqItHCC6zjILl8Dw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398abd85691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 108800\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":108800,"size_decoded":109571,"mime_type":"image/png","magic":"PNG image data, 684 x 800, 8-bit colormap, non-interlaced","md5":"670e3d307324e9ee82d308ba5507476f","sha1":"bdc13c450a1f6f9b27bba4f8992b58bf29c3a198","sha256":"4b5c25917d087cdebf53af7be187517cd9dfdc8a6cf26ea8489f23029981c8b0","sha512":"414cda020a7d1ce50ca5a59032800f458b80eb9b243b212bc00f3a38d354d476c56d53dc020a689ff5e48d95ef17cc0a3902c3ca4ff1bbfeaa0bdc9e0f056eb5","ssdeep":"3072:gexAWexyXzUWEVwLDvBEZ+W8Wt0vDkPGD8htv:gexAWnXYgDvBE5CDMGDyv","tlshash":"0cb30227da47ae2a43fd9d5d75e3f1b2aa5320a35608df2b443c954d7ea5c1c2ece080","first_seen":"2026-08-07T21:29:27.4964Z","last_seen":"2026-09-22T18:32:36.710825Z","times_seen":3,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/tr-sg-lawnplantcare-triapp-eng.png.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.449Z","timestamp":1790101912449,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/tr-sg-lawnplantcare-triapp-eng.png.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QEaRkKU6k6niaBhX83EGXvaodIs43Y%2Fb%2Fx1x71iVvt2U9ia14J6uo34F%2BKk13nDV3eW2eXVpFew8ezPEUcuIpfpjIunz0XXXkPewcFbmjVGE1Y5Rm63ViDnYHGV22Qb509w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398dbed5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7936,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"b976389bb2724e9024e4267b1e97ba8e","sha1":"4cef01edd19c23ad9f9b55529c8bb0903e8e65d4","sha256":"2f1f6c9156ecae0333ceb4a3e16271da1d8ee3aad305f0436a2210dd443585dd","sha512":"c887cb32627ff5b77c54f8aa9f63c93070eff57708e6561997e41d2581b552e7bcb83395eb9283af2a3093b0ade07e1e17fbd56cfe4833b28f1ad43cd34fbdac","ssdeep":"192:Vj9jhjOTK/OaaUl8Pz0zLk81B8947vlCeNA:z//FF9A47vlCeG","tlshash":"bde1ba63f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.711399Z","last_seen":"2026-09-22T18:32:36.711399Z","times_seen":1,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/tr-sg-plantsseeds-triapp-eng.png.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.450Z","timestamp":1790101912450,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/tr-sg-plantsseeds-triapp-eng.png.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f8Iv%2FNC%2FlbljYY%2Bl8o%2BEa3oaDAnqveAFv1DBMNG9%2B7RGHqSd6a71MbnnXppbNa4tqXMUbdMA4xAKw%2BPQ2ZId0JFZkexdnX2nWXItUCu1mvrOx7XYSKz2v%2FYQCwHcXlIg%2FY0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398dbec5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7946,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"d55b5f238ff6411a2924f4f5c8f80a1d","sha1":"72bd525d79b302125046ee2aff000152d5f5c0c6","sha256":"c795af2c3767d7a5a2816f21c400b6a234b9168185f2f30096c2f648d7bb2be8","sha512":"62c9a0e2f4b2e06ffdf857eb77065a31adae0267e5ccbe082a85b0b617aca0cea1c602e3ddd639135a3b75ccb55e8d21f100666d67b069eece49f554ded5849e","ssdeep":"192:Vj9jhjOTK/OaaUl8PzTzLk81B89r7vlCeNA:z//Fc9Ar7vlCeG","tlshash":"71e1b963f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.71346Z","last_seen":"2026-09-22T18:32:36.71346Z","times_seen":1,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/marks-desktop-offer-card.svg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.456Z","timestamp":1790101912456,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/marks-desktop-offer-card.svg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Tj%2BCN2dExqSyCZ931bQWPDCvFrh89iwoX4VdpqE73r9CEECHgN%2Fjtiz%2B3hRvkgBjR67qkZfomiLKHw1152caX9YeHjPbTivtceK3xTy4wLBCUhq8d4%2B0%2FzzEhd6aDQ0y0T8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398dbf15691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7940,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"672686a01968a83fe4bcbf05ce0e38fc","sha1":"ebb28a822eb9c2ee9cc8b9e20ee0769eead2b5f3","sha256":"286368afbab746d150e40dae948fea7eb3faf3f00c14998b53831836c74b8714","sha512":"8a6c1588329ab0b1e9cbdc57d4ed22eef70a03ec2f4584a4ed6bc6ec730280ad6684d6ad4033ebfcc2af8eeda410935d2f34ad7fb95ed2fefc74f60c73298289","ssdeep":"192:Vj9jhjOTK/OaaUl8PzAzLk81B89s7vlCeNA:z//Fx9As7vlCeG","tlshash":"e6e1a862f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47285","first_seen":"2026-09-22T18:32:36.714653Z","last_seen":"2026-09-22T18:32:36.714653Z","times_seen":1,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_Marks_MensCasualClothing_TriApp_EN.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.473Z","timestamp":1790101912473,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_Marks_MensCasualClothing_TriApp_EN.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sy01Q41qRZUVrqEDHmbUNZNw8iiu%2BqQXP64INJquhdsUnocGW5iMPK9S%2BTfJ1NwA80C4ToJKcWAb4%2BwFiBPdehtuNWFCgJyFknSuJjKGeOt9uEKkbO9WOZQjEBg7%2FtCxXt0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f363990c035691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7938,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"d8fac63874b293572fc6f036dc8c92ef","sha1":"1b2e3bff0011ae6978fb03a3c4f25750e7de0393","sha256":"5dd01bb9302a745bc43dc2c90e7859409e6c61144c53766e20047cf6f98d8cc4","sha512":"bf8dafba9109a8bea184b3f3950f1dfd4a7469c9b431a151318879dafcc7ee61dfa58859c9b2f70b396e3029e92d2599a1cde7d4ca23caeb50e2f8fd0ed3d784","ssdeep":"192:Vj9jhjOTK/OaaUl8PzkzLk81B89c7vlCeNA:z//FB9Ac7vlCeG","tlshash":"4ae1b963f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.725843Z","last_seen":"2026-09-22T18:32:36.725843Z","times_seen":1,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2026-312-hp-featurelist-services-support-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.431Z","timestamp":1790101912431,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2026-312-hp-featurelist-services-support-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-acad\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c2dziNSDkUJIvtIinONpfrBn%2F9nuFT2Zuzl9zs7CAuWIArdmsRXz5AGz2ERB4YCJnJ%2Fgh%2Fz3V66qBQFLZhSTPhb%2FTVji34STbjND9MFppQHqPwsFo4UQO4Il5wgVqdXP7i8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398bbdc5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 44205\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44205,"size_decoded":44978,"mime_type":"image/png","magic":"PNG image data, 684 x 800, 8-bit/color RGBA, non-interlaced","md5":"07a38e2afd59fa46045d294b640e27d7","sha1":"bff62b7b73b4d465c2a966f37593d4d80f6145e9","sha256":"245a787e49dbfd519d5f5042f2c1d4f72972471d57dcd9de40af79bcbf1bd6d9","sha512":"437ee915f3743f6cabfc2df152b5c87f9bb64be76de1b64f8fe7b694b6969fef81dfbc3a62f74997ea909cea44faa993bb088cd0feb078f0ae3064d4de4d5a2e","ssdeep":"768:NO0Nhm75B3Z9WEdKkZZkCdY1RKm1Y363DEJETQDwmW1/ikTg1vBCDuOwEvBd+9+y:N3s7D3WEYf1RKD3UCEYwR/iBDCDuOwQA","tlshash":"6513adcafb4edd528d88d001812c6cdc7eaa9ab1b58630b534ef5f73d96a113e14f209","first_seen":"2026-08-07T21:29:27.325134Z","last_seen":"2026-09-22T18:32:36.727207Z","times_seen":3,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_L_BeverageMakers_TriApp_ENG.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.440Z","timestamp":1790101912440,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_L_BeverageMakers_TriApp_ENG.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-adc\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1ZWwxptQUPycDKHOp2W50CpgEq8U%2BkwNY40Iy%2FtK1waaBWB4JN0N%2BX1KCf3uKviIO4dcoOrQPE0SSrab6g8d72zZZFjqbWG7Z1dTR1s9wm9mqEOykFY24YgI3qvOfrReRP8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398cbe55691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2780\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2780,"size_decoded":3550,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7febc89f901ca2fb3d90342ea5d2d0a3","sha1":"4cd031e83ad5c3297d6831543f896c8baa68cef3","sha256":"13ef8335bde0bad78b46359d3a12896d19d4140e38e1d41c5f2712d481c53885","sha512":"93a3f6c7f4201a4799c513f352442490a8e13535cc0b43729144a28f886d8e65965cc4a3307cf61472f4a9d291cfd707981c54ff72aa8b15883f8c539ace2dae","ssdeep":"","tlshash":"0a515c7a4e9fea0ec908ffe1315a03d99b9cd1012ee52512590058316ac97eef603e00","first_seen":"2026-08-07T21:29:27.300391Z","last_seen":"2026-09-22T18:32:36.728152Z","times_seen":3,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_324_hp_desktop_cat1_en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.398Z","timestamp":1790101912398,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_324_hp_desktop_cat1_en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-570c\"\r\nexpires: Fri, 02 Oct 2026 18:30:15 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 97\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Itss2yR56H4Q3hd1E1ub3%2F5v0fRF%2B9vHiJLuamJ4H94gz16U%2BJis3Kdj6wB7rKJwgOwEINcPmuKJDSQsx5t%2F7bKGdnIm4As6AuQHf%2F8aFUiTLR3qpGnyg3xPUdzoxJ57%2BeQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363987bb75691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 22284\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22284,"size_decoded":23060,"mime_type":"image/png","magic":"PNG image data, 696 x 312, 8-bit/color RGBA, non-interlaced","md5":"a6854b837a6e979adcfb9d8d4d6f9650","sha1":"c468848743bbb6e5cfa9aed345e33b1fa89a4ff0","sha256":"ec39845ef9c0fb21918b77e80fbe0773d38524bdefe6d5d28414aea9cc145c2d","sha512":"b9d0a4c2a02f0abab5741512682673b5aafa61852dfb7809bdb77672df6fd2d3c94a4f69cbfac4044e475d7fc814ac7d62b5e64a05970eb6a4660f67d7164f5b","ssdeep":"384:mCi4MTyFPvAn8ovsGnMixgGcRUzmMYrF+hnUCRzHmYFLnoJIb4VA:OvyiHUqMsmQYJ+lUAmuLnaIb4m","tlshash":"e8a2c08b2fab45aec53f0eb61c3add8a74173f3112e250264fc9093146edb4a0995d37","first_seen":"2026-08-07T21:29:27.441655Z","last_seen":"2026-09-22T18:32:36.728817Z","times_seen":3,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_4_EN.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.401Z","timestamp":1790101912401,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_4_EN.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-2f823\"\r\nexpires: Fri, 02 Oct 2026 18:30:15 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 97\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ByemrFKCefycxkoX%2BQfrIf4Ih0MPvxwJtFRkeOShxcFJ%2B%2FS25lSMI9st49LlHvRE94Nu6SbzNcRSR0W4BLB6cz0T6uMwmGeTzm%2Fgw0yhY2Xk94dw21oeD9S1xtt6fvwLKpo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bba5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 194595\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194595,"size_decoded":195369,"mime_type":"image/png","magic":"PNG image data, 696 x 312, 8-bit/color RGBA, non-interlaced","md5":"7c04813cc47a6a4004b555a2d86e81ca","sha1":"67d65a6f58eab0c1d32bd353325fe242e48409af","sha256":"79575f3208b0d4a8cc529550863053d555cde306404c33acce35cf7cb2590e4c","sha512":"b127e1fd3846924d4f5b37e30133748438c8507f770feda406c1ad0d0e1eb01dfe02c1b0a99b5775b3c16e883de99747628f28526650dd1b2ec7b10404c24c23","ssdeep":"3072:K37NqgjzEHAGlL5urDOAj78aHcBcYDUBZRZB+daeHT3OM6NfHbG8vvJGse9bL:E7AgjzEHP5urysJ1DZB+z3x6NfHK2J8l","tlshash":"b61422338dd46ce3c11a6e59100d95a7c98e612c7fab16027e1f5b0afe1720174ebe97","first_seen":"2026-08-07T21:29:27.477955Z","last_seen":"2026-09-22T18:32:36.729475Z","times_seen":3,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/3240_PartyCity_TriApp.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.464Z","timestamp":1790101912464,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/3240_PartyCity_TriApp.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=l1Kf8an5USMpHhVcYgL6XawkaU3QBqkTgzZbyTpOhHtMKjhlTrlRJwH7w4D9K1k4RSo2ezzDPpdcpmLIu0nc%2FYG8HrScRQSYlTWlXVynXVBb8rmA%2BuTa7uF38ta5aqVAopY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398fbfb5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7934,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"4dd54f7571df2cbc87dc35594ba5d4a4","sha1":"27f7444487e2964459fdb29f7ea517dcd1c5a63d","sha256":"5368d201cc2f37b2324fad77cb754a6ac1b61ce3163f18b02bbbcd2250a39e29","sha512":"c25bf8da5968bb4aac9d1324ddef5336073800b0537fd41906fd3ce81f0726951c873b1b5ba7fb9c93bd66a32f32db3267120cfea5e45459973412ee2e6daf84","ssdeep":"192:Vj9jhjOTK/OaaUl8Pz5zLk81B89N7vlCeNA:z//FC9AN7vlCeG","tlshash":"40e1ba63f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.730175Z","last_seen":"2026-09-22T18:32:36.730175Z","times_seen":1,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/10-1.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.703Z","timestamp":1790101912703,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/10-1.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hgmEHW%2FERCR6PG5wZevya5A9ZTyEpfN%2BXAWOlmIpTQMx81KLQBDI0cJNrMiQ3UQJjvuH9fLgCTqOGkaNmnamQAcGHLX%2BnscA2QHtUS5WujrSTlJE9zUlde4r8lHIcIa2aUM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=4,i\r\ncf-ray: a3f3639a6c215691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7936,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"75365479f43fe55d3d48c41884145f7c","sha1":"6462c29aa4698072f4a56c85ac024a78c4c00129","sha256":"23a2fd4bfa6b713fa66f6b8eee1420382ef927efffa61b579095b9991ddff944","sha512":"a87450ce199f0d1897585f02a3ef8ce5b67fb52320b64a11cf51dd5129b177a9205485451018e1301f4be64f243d5faf9950d632c99521718de0d43a117e79ba","ssdeep":"192:Vj9jhjOTK/OaaUl8PzCzLk81B89K7vlCeNA:z//FL9AK7vlCeG","tlshash":"33e1ca63f9f825fe1097827230aa7b193de48013ea6704a576edc1720f8ef84ed07285","first_seen":"2026-09-22T18:32:36.7316Z","last_seen":"2026-09-22T18:32:36.7316Z","times_seen":1,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_5_EN.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.404Z","timestamp":1790101912404,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_5_EN.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-2591c\"\r\nexpires: Fri, 02 Oct 2026 18:30:15 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 97\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Vqj%2FuM1YkDuyx%2BRaSIi4rriae7qzVcmojYVZfXFw7EsQynDgcTCLQjlwQc3LSGWg2POwMztDHsm9Jiifl6DkjD0uKtjek27yVAqrdTkbB8JKyDRXXq3O8qHSSkvC931r8xE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bbf5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 153884\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":153884,"size_decoded":154654,"mime_type":"image/png","magic":"PNG image data, 696 x 312, 8-bit/color RGBA, non-interlaced","md5":"4eea1566e6028ad363f02919b5439c93","sha1":"92e19553e3288802e041a69dc1d9c23e93196284","sha256":"3156f74f99db3c5486f813cc5eac46a545f2979659811882b7aa04be0cf1685d","sha512":"397448c60fe75357f12b4bff1e635aa0411302a79007469bdc235270e3cf8afe762024f2cf2b4661e1aaf58cc60f64f56f28e5d4c83e1fb934e9d88222e60a73","ssdeep":"3072:By8YQ19gO41zAVnsMUMbbE0l/yHLSmQUrzsl+kQL/8IQFag5/SwigV:BYQ1yTJAVns3kbEq/yHLZQUrwFQLUIQN","tlshash":"3ce312a7ad4bbe50d7ba0e551ed9f402e700a3e2518634df887e8e825483cad5f47c87","first_seen":"2026-08-07T21:29:27.377988Z","last_seen":"2026-09-22T18:32:36.732739Z","times_seen":3,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-wodp-categories-greatwaystoshop-shopcanadian-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.421Z","timestamp":1790101912421,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-wodp-categories-greatwaystoshop-shopcanadian-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-18f0\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QU4lzv%2Ff7ldkNQ5Sj8GPeCFgb6VdTWhSU2kPTXwtj65U4XhmJ3Z4bdZ0iQ%2Bw1j30BKwj9MniAga17MC2s%2F9uoN7IyHlZ%2FrxB9miEve0cF7VqpIOpg4HLgyA7n1KSBhu8Sus%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398abd25691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6384\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6384,"size_decoded":7156,"mime_type":"image/png","magic":"PNG image data, 440 x 550, 8-bit colormap, non-interlaced","md5":"628dc52a1b11305a7af5dffa2abcc17f","sha1":"39fed2d03270dee243e4bc1c6f31e1d76b87eab6","sha256":"ed16766be89e3951686a05eebf752f2e91e58b254936ce57d5048470e5bd6422","sha512":"7e848ad0b608844d9f7a36a129268772ff1afbbe3f79aa456a6f6668c112bc8582a7ed6bca052d07db7bdf763fb8a01683ae32fda37469603281c4324daaf809","ssdeep":"96:kXFcKnlVOOOOOOOOOpsprKUq8xi680n9xG/Qj1YZneMeOOOOOOrjp8pctxK/TIoD:2F9nlBWUq818kL1YZeM0jpP87H1JHf","tlshash":"6bd1f6ae9802f296116f228f412b95fa2e5262b700ad4e0c73cdb37b3f1905455417b8","first_seen":"2026-08-07T21:29:27.433021Z","last_seen":"2026-09-22T18:32:36.733401Z","times_seen":3,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/8-ctm-offer-badge.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.435Z","timestamp":1790101912435,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/8-ctm-offer-badge.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-5e3\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BeRWDW1dub9lH8z%2BStnC5Xj7pkXnCfdKQcNVuwdb9tK%2FP%2BskyoRN6r0YcIwppiw7zLeszAu9CEmitjjX1CVsYy2rnTi%2B7IRYr2BV6dcEPhEZlOoGTYl2rx2SIiRt7318vpE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398bbe05691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1507\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1507,"size_decoded":2278,"mime_type":"image/png","magic":"PNG image data, 96 x 36, 8-bit colormap, non-interlaced","md5":"769085a2fb4f7bd4e387e6f45564fae8","sha1":"d6b8586d67b3baa9803942446f5a182046b8a2ea","sha256":"92d52c2f12a1ac7aebf96fad9d6c9f625d81f725414859bd2e591296a22fefe7","sha512":"d113bf5b5e56feae80885c406f6c3262321cc1cf13d250c09fd36d3cb5cd988140d91037fe941b5426109f3474392a5efa90ec980b54a1375cbfc1e93a6e8bac","ssdeep":"","tlshash":"7531c7a813e1ee3d67c4dc7a4a78b5d004242391ecd09c967a9f64d4a62060a73a277f","first_seen":"2025-01-20T21:47:49.773859Z","last_seen":"2026-09-22T18:32:36.734071Z","times_seen":4,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/party-city-desktop-offer-card.svg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.461Z","timestamp":1790101912461,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/party-city-desktop-offer-card.svg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1GdZfwOEaGnGoqj5iz4pH5GTCm9i3Et2%2Fe%2FUdqnWbEg8tLSFNC3TI8%2FvilMdAQbIYqC1PK0crWnnWN89oR0qWVuvFP5svPrDed39ZqOEOv1fYthSMYDYNHwqRihD6a%2FsEiU%3D\"}]}\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\netag: W/\"6a6764b8-cee\"\r\nage: 174\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a3f36398ebf55691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3310,"size_decoded":1967,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e9ac230d8f7b4f34af1929d19cd17270","sha1":"c65f1fc3e9d81ad4a194c1f291320511eab01f9d","sha256":"567cd002f6d061e9585b5bda02c7d1abb661298707ef3afa4cfccd65b2ae077b","sha512":"2a43b2e953b1a6a66e307540dea535d5fc6c36b5dba2033b732f16505b652097b2331960fa7a2d36b9b98085721a798882da9be7e6cc1cfe2b6472f87c2d2c1c","ssdeep":"","tlshash":"02610ff529a484c198d05f809fd49d98a31ef3cb71b214e4731d28e94ff01ab517da6a","first_seen":"2026-01-21T19:46:25.739104Z","last_seen":"2026-09-22T18:32:36.734743Z","times_seen":5,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/global-icons.svg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.706Z","timestamp":1790101912706,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/global-icons.svg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BwD%2BNgHKpEyCFIjZNVzNoc%2Bm5I%2BZoGu8lrJ3MJZJWrsVOB7Sju%2BgCZldvgU10%2FhyucFVwpY2kHlfPczc6KCagTYJ4eGd6KE2UziBxliLCdbBmsPQCb0M%2Fc1pX%2F1XVR9Daww%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\ncf-ray: a3f3639a6c235691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7947,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"2f12141c2256b8cf00e37c3ff1559464","sha1":"bea11e4e6f28dd4da011fd1d6a188c4168fee878","sha256":"08cbb094c7c2219aba10b787cbcb4d2ebeb364918ad3926dad60284644b508d7","sha512":"6c0a2e6d8320bc7c5255805329e3c9f915d5c8711b005c993c83e39f9f42fd599d40a14871535c4e2dac4edb660f5aa6c6431b40f4bd4a5f793ee45586c285b6","ssdeep":"192:Vj9jhjOTK/OaaUl8Pz0zLk81B89E7vlCeNA:z//F59AE7vlCeG","tlshash":"23e1ca63f9f825fe1097827230aa7b193de48013ea6704a576edc1720f8ef84ed07245","first_seen":"2026-09-22T18:32:36.73539Z","last_seen":"2026-09-22T18:32:36.73539Z","times_seen":1,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/favicon-16x16.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.792Z","timestamp":1790101912792,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/favicon-16x16.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=01o3Dt8nOPNnynjK1Auj5mCRWb0bv5YRuMshmA8j%2FOHGAS1zPcflSwf4%2BSA1L0mzkADodhHRbAOB3mbAC6YyTItFBy%2F0oBhgiShYebvey5XKf63M%2FZeTvu9vVuDMlJrNGFk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=6,i=?0\r\ncf-ray: a3f3639afc2d5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7941,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"2efecb570a5c26f5df6deed1c6ea8f9a","sha1":"cb40d9c467ee0c19d7d0d6be89ddad3bf038f910","sha256":"baae92647e0cb041979491d35cfe471f4a9828ddbfcfff2b94e57c59d2850034","sha512":"44fa0f766002d6af26b3ffb386fb23b3fd044b6410ae2f057b2e1e79fd3b738cc38f74a616aa97dd7901cbf253e84f89bf4b335195f4d2ca3b34627e31d3ebbc","ssdeep":"192:Vj9jhjOTK/OaaUl8PzTzLk81B89f7vlCeNA:z//Fo9Af7vlCeG","tlshash":"9be1ca63f9f825fe1097827230aa7b193de48013ea6704a576edc1720f8ef85ed03245","first_seen":"2026-09-22T18:32:36.736509Z","last_seen":"2026-09-22T18:32:36.736509Z","times_seen":1,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/akamai-viewer.css","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.146Z","timestamp":1790101912146,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/akamai-viewer.css HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dKO0xQB2NpqDBuBa%2Bir0XUxgxN9ri6ZKdfiq34KRMzyAq4FPJNBBsv2x98zxbfeIETHBR0BMXJlcjyQQBK6nMLLhCyw6v2ggKTyMquu%2Fimm05y83XCUeOIazSM0Z1gH7o0k%3D\"}]}\r\npriority: u=2,i=?0\r\netag: W/\"6a6764b8-4560\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvary: accept-encoding\r\nage: 173\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36396eb8f5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17760,"size_decoded":4080,"mime_type":"text/css","magic":"ASCII text, with very long lines (17760), with no line terminators","md5":"ea73ce20716aaadc2fd92bdc729b3e4b","sha1":"2903ebeb7ae9ef7858fee054784758df314f9864","sha256":"e0b68140bead6f3b690b78e7d51e5d872b0f2db91cffedc1765a0032b7a22bf4","sha512":"482eddf4f829134761391ad60de0629251c8bc46908f51a930377155416d8f3ec36749c7dc991525d34bd8cb4fe8957610ca564be13093cc328879e315eb06f5","ssdeep":"192:RXvzZ28ynXEy9NiWabqWl4ySjz55zushgpqW+sd6gaNU7w7o7i74Sug:RX7Ty5PaI5zmA","tlshash":"158232a43d49606fd427d72f66e053c86119e263ab471a5e2ff6a0344e3dccc327798a","first_seen":"2026-08-07T21:29:27.458204Z","last_seen":"2026-09-22T18:32:36.737712Z","times_seen":3,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ctr-canadasstoreproudlycanadian-lockup-desktop-en-d9b59d46-12a2-46d4-88d4-af23169a3c0a.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.178Z","timestamp":1790101912178,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ctr-canadasstoreproudlycanadian-lockup-desktop-en-d9b59d46-12a2-46d4-88d4-af23169a3c0a.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-2c54\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 173\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lAQ%2F%2Fi1%2Bj8HczPT%2BOyI7kK4Yat0ITvf3kva%2BIfUz6JHYsTpc%2FSIwV6NruT25VmBL4sm7XwZNUPSQkrwU9pHAffeqVeGINKqxCLxYWmnfgrH0N1xwAwAbJ2pxBAMLSBRoqbw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363971b955691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11348\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11348,"size_decoded":12125,"mime_type":"image/png","magic":"PNG image data, 694 x 80, 8-bit/color RGBA, non-interlaced","md5":"e6ac2c894bcd65ea77598c231b958d5e","sha1":"2c94eb78ceadadc02488dcd1e01be68effe579c2","sha256":"5b168ac90043d0e92ec33f6f6da8257571dea4638a436fe0bc2e3a57217ae06c","sha512":"c7070ef69fd16a53b397a56036102931a89459fec72ec758719991e36ef8fe173f06aef3a5e1e048034c3dae141a3e02c85cc0156d0aa3e4328079f17d7d3bf6","ssdeep":"192:D+MGuYudF0FBtBrvSRkppZhu0FiBJPlgqm29Cnt3kj+dNYZa0BNdVk:SgGFBPrvSRkppZhnkB9Wqm2At3i+diZG","tlshash":"0e32afcfa5b21565e6901db78a4a4ca2fb70bb73b1660add14897437280b974032b1b7","first_seen":"2026-08-07T21:29:27.365694Z","last_seen":"2026-09-22T18:32:36.738764Z","times_seen":3,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_3_EN.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.400Z","timestamp":1790101912400,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ODP_2026_330_HP_Desktop_CatTile_3_EN.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1d10d\"\r\nexpires: Fri, 02 Oct 2026 18:30:15 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 97\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FtsaozEETAdyDkmgF3au1TkLErra3uBYr4a7O1gmaogKj62hmWCCslq6kXtbTA0%2FBLN1JT8A1DYAxviEFKr7QHIkPbXESMwJWmWc8apYIpFDpWKBF1h6gnKWTYBJCtzXz3k%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bb95691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 119053\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":119053,"size_decoded":119823,"mime_type":"image/png","magic":"PNG image data, 696 x 312, 8-bit/color RGBA, non-interlaced","md5":"701aff91d531bac0d231f2e4e788bf84","sha1":"f667784ae82040d955f5dd5cedbfc0a8be4d6d34","sha256":"905d528b0fa724c00759599eaa5f70253feb24d6abdf481acfe1eff80df6c46f","sha512":"846021fe62aefd7efb850e7d01e3cbdd1ba642ec6534df58c1ba3f85a4d3e765b0fc226a95f1b00e761d7a0fc0b5abea315342cc20172f65d0de939039bce98b","ssdeep":"3072:Y5pti0NP4i3L+gOeT9iKfD6rIl+1/XS2eN1g2fLayglg3zMezhC7:Y5G0Db+ETb7wIl+NS2e3DqUA4C","tlshash":"78c312f1e9d54882f8183ba63d149e7d6f61a8dec5c807709d4791c3861cb2df7172a2","first_seen":"2026-08-07T21:29:27.30882Z","last_seen":"2026-09-22T18:32:36.741805Z","times_seen":3,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_coolers-1.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.410Z","timestamp":1790101912410,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_coolers-1.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1495f\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bLgFoqhN011Q5hsLwB%2FAdWiVT9mAb8QBU7jzjnReL9iZLO19TSU1Ghv3qGnuHZ6EPac3jf8jafGalDm7OmwkvEThICxzScbb1cfGb0FDqD0ichUJ68jHNNz7eYZ9ZiFq5Kg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bc55691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 84319\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":84319,"size_decoded":85088,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x551, components 3","md5":"1243419b0925b66f5c6c29a3764e504b","sha1":"f26f99aa1258be46319dbbbc22e966542b18725f","sha256":"8fc83d91d7cca012fca4a5cd1f84be3f02ee6745263dab53003465fd94c70aec","sha512":"c56c2ad76bab7ae8e5ec62c2d239b340c2e441c708c02b5b409c6d239a6a034290e5a7507aa47cc11cd3f853abeab6ad14f18e8b028c4db2cca8b0bb608a0cbc","ssdeep":"1536:NohwXgdqxk+hJK6yB10is4i4fh5fzv86vq6T7AxUjK63LXJo8:EwQKZ8b24i478yZExUjbXy8","tlshash":"dc8302623c3b42d4c318c536e227bad485a231565f593e1f82ebbf35b271de68ec5242","first_seen":"2026-08-07T21:29:27.310872Z","last_seen":"2026-09-22T18:32:36.742453Z","times_seen":3,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2025-hp-4featurelist-trianglerewards-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.424Z","timestamp":1790101912424,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2025-hp-4featurelist-trianglerewards-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-22e98\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bgr3d22i%2BNTvc4kFlLYQUR5gXXg0Y6zqkD1qT6lIjsDootGFipGEl5vdy09GSnsV5VET%2BXPbtNvVgSoAEn%2BNOgJ7CbW%2FGgE%2Frfvm5YMfoibJtG%2FNJKDQci2hNJYDJYvItoQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398abd55691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 143000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":143000,"size_decoded":143779,"mime_type":"image/png","magic":"PNG image data, 684 x 801, 8-bit/color RGBA, non-interlaced","md5":"f1064b8ed8e5986e5dcbb4e14d761057","sha1":"40d976515d555f739f59e13b41f039711b1e1baa","sha256":"0d8494a724eb15f80a171da425225434297872e9fcc48661f1e22d66d522ee53","sha512":"7a400a152814b5c57f7550cc8c6f566adfd0f4528af0f964dbef35fd22d284d3c21b42978080bd4a5d4e48b2509b45d05ac09005d34e9228d41d329ad620a9fa","ssdeep":"3072:+YcwKhJigRanoCdt0Cx/HaNHF3pYsUHV6rp2P:+YcwKhJPantPhYF52HV6rQP","tlshash":"fad3024d56a4e45db6a61d2e4a48c2235be0f243d022f79cdad2f116dc2c6bcca5dc2f","first_seen":"2026-08-07T21:29:27.38069Z","last_seen":"2026-09-22T18:32:36.743024Z","times_seen":3,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2025-hp-4featurelist-ctapp-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.430Z","timestamp":1790101912430,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2025-hp-4featurelist-ctapp-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1fb3d\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4gg9d9jb48jJKoq2YgRrXd%2FVAMDSLpatoUAd966XfFrOeuNNEYCDden7%2FLn9lQbNdaAw0wqGNjzh%2BSlYl0TwXZPBHUPZIMrS10fefsmvF25UdIMAENHNavbisaNKVUTeeuo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398bbdb5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 129853\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":129853,"size_decoded":130626,"mime_type":"image/png","magic":"PNG image data, 684 x 800, 8-bit/color RGBA, non-interlaced","md5":"0e70a34d31c9264a5b090afbff6aefca","sha1":"8f9df05e09e6fbf3593054fe6081b0b433d956a7","sha256":"e2d015c11125c4f4c59ab15414ff1b7899fe1827b82a347fc63d2ce8a92d6d9c","sha512":"6e6d7e7fddc34a9f08066fd6995b7c6c43913d208799998e3c6050ae40c421ffd3e58bc565b65134d8e9eac52cb05a460d51c88dc3744ba062c29542666b0820","ssdeep":"3072:9zb0ISQ2/YA+8e96/+YvGm9pzyW4jNJ9EbxFscwqtGKfq14:9/0XB/YADe9wfiNk3MKfq14","tlshash":"19c302a837b5f067f64fb5f224525ea61c2725c3ca70562a50e57cacc500c8f3a71eda","first_seen":"2026-08-07T21:29:27.323431Z","last_seen":"2026-09-22T18:32:36.743605Z","times_seen":3,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_F_GeneralHardware_TriApp_ENG.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.444Z","timestamp":1790101912444,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_F_GeneralHardware_TriApp_ENG.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OYfEozr7XH4BaI8cVW7FNwjle1yRml1Fmi8ZpxqVwHS%2FZv3Zf%2F4Hi7iMzZAdOpfdc3kwQGQBPKyoUvh7I%2Fgj%2BQ5vzuuArRrmYVPJLW%2BnAoYEZR4wPAEMUh9n03oATEMlR24%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398cbe85691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7940,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"34ed8252bad12e8a925d3614cae7b10e","sha1":"329f93c728cc58a9c84b4a83a15b7326791418c5","sha256":"5f3e63ddd759fba7bca59db5be88e1219785efe9b8d8eed18359aff2f21e1ae0","sha512":"40770d703e0a3d8e21c66115a82ab23ffe374f9a95a6cdcf1a1260c87ed12b812044708b3f064b50a863468bbe825d7613801f158b584e7a70bc4bf2bb0b0120","ssdeep":"192:Vj9jhjOTK/OaaUl8PzdzLk81B8917vlCeNA:z//F69A17vlCeG","tlshash":"11e1b963f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.744197Z","last_seen":"2026-09-22T18:32:36.744197Z","times_seen":1,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/sport-experts-desktop-offer-card.svg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.469Z","timestamp":1790101912469,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/sport-experts-desktop-offer-card.svg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QJ6qmxOHo4PmnVOgCXU8%2FHo2Q7DdjJ9gpVP4BxjSK4WwhTZ%2FqMn7sXOj7pusRZ1wTWnOPLN%2Bnh2ats4haTWsKx19KljPMA7wm8wn5%2FlWyUJ240Q52fv0hPzHt8YDoVK1yYU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398fbfd5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7938,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"7310c662d1e3d1e9952ff25a671deedc","sha1":"010ad4fdcfe48dc8935f945a8ad68eaf6413d553","sha256":"42d29f57d9c9a4ff96113114be0819c47acda283bf92946a859bcabc8d72c05a","sha512":"144516627afa383645c69a7225dc158ef040d76dca6288be45d269156fc9a1b9bb93be391d404ca5825993c1e917810f4697b344aeeec162f27c7f164af09b88","ssdeep":"192:Vj9jhjOTK/OaaUl8PzLzLk81B89f7vlCeNA:z//Fo9Af7vlCeG","tlshash":"d4e1b963f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.745198Z","last_seen":"2026-09-22T18:32:36.745198Z","times_seen":1,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/ctr-canadasstoreproudlycanadian-mobile-en-33d361ed-cce8-4ff9-828c-3297d7730b1c.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.396Z","timestamp":1790101912396,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/ctr-canadasstoreproudlycanadian-mobile-en-33d361ed-cce8-4ff9-828c-3297d7730b1c.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-15c1\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8ZaY7sRbwxNmigV6v6pqwLwQz00sgPnhRU%2FGzl7AbeXv1AskZT3R620TVOtZQR5jCCqNSBhOsKAayIGY%2Brsw8N0pRfkkn6hNLTEnzytJjS9OJWLxZAh2lGsvlDClTTV%2ByCM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363987bb55691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5569\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5569,"size_decoded":6339,"mime_type":"image/png","magic":"PNG image data, 631 x 30, 8-bit gray+alpha, non-interlaced","md5":"a0e3976720893fe882bc5a19a4b89d39","sha1":"f82eb919d0a5d720ecd8e4dc76dc3b416ac4dec3","sha256":"3ae6497b4d8f20dadcee847b8680e38a23e95344d4d4eaefdf9649fe5fc59850","sha512":"3464e859256e5286825e7e9f8e967f2f200562db8e8c193f19eece7e4c98f14fac365bf8646d37b35da7f289d228b53c1d014785361e395dfcbb421306407572","ssdeep":"96:C5GZj3BJBFFaKLHEYmOctS91Nhvw5YZskk2a7wpr9ryB6UcZX5or8id5Tc:C2j3BHLzLkC2S91/wUx4wbeAUcZJQnTc","tlshash":"8eb18e8e26f028cb49f8b429d197f35fb9f4dab2514700f1862ff5464043e4aac91324","first_seen":"2026-08-07T21:29:27.439832Z","last_seen":"2026-09-22T18:32:36.746477Z","times_seen":3,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_cooking.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.412Z","timestamp":1790101912412,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_cooking.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1094d\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m4rv8VdYanfq%2FL9VsyiTwZA3oc7F04gQ%2F3PoRKY4%2FMGh%2BJ%2BSa8DvrEa6zYQta1ObuyIUYSL4NORokR8YhCQmEZCk0NWKbuL4rbEhaiY%2BV8h4Y%2B%2Fm9GZMe2WQgLpacpSSCeY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bc75691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 67917\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67917,"size_decoded":68700,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"036c69f503c810d3291249ca4380039b","sha1":"65c93c66ff246db0ca60ca85f59feca69e0c9271","sha256":"82f005ea73e33bbfe12144bc0fe5d64219bc15d41efd912e3e8d28a87c2dc2dc","sha512":"444bed476a037e5131932dbaff598966f36e5b3392619a86525c4c71a195d1ed9b2f220bb80c497820ccbe4125886e8748beef4f3b51694f79322bf7b8d9dc89","ssdeep":"1536:FPBE3TyK9ARVkJPw/eC5VKVC+cUdJ7bbLSavqp6TEPTXlsm:F50LCVkJPw/y5rvDQCEPb6m","tlshash":"8d6302c7b6d8e76470e0f8b1e62bddb30123467fa6516c5e0b8c1ec8a6934e562c2487","first_seen":"2026-08-07T21:29:27.335848Z","last_seen":"2026-09-22T18:32:36.747067Z","times_seen":3,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-wodp-categories-greatwaystoshop-hotdeals-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.416Z","timestamp":1790101912416,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-wodp-categories-greatwaystoshop-hotdeals-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1212\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C%2BLTjudm4pPgnTl4dIohUyLlnL48he3BKjXhj8%2FlYZLURjNsdKMGmKxI30lwb3TNVDtiXpuT6TtStz7%2FFpXrkV7psfJf1%2FmVFdX4G48jIUCqDDRdkfxFw9tV6H7I%2FZS28Gc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bcd5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4626\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4626,"size_decoded":5400,"mime_type":"image/png","magic":"PNG image data, 440 x 550, 8-bit colormap, non-interlaced","md5":"384a40331bbbe91a62441ab757a5edc1","sha1":"2c7ccfd779ffb9ec3d82163b1ed8070a0b0a7d49","sha256":"43f6ab4d98e3fca444ba8af508047ae83c0bbd016160ce7d31fffc2fa583335a","sha512":"a9ab7f5bf01825e50b79139224e866607e3aa3651fab505bb80a54d9e9b82ca92d56aba4858f3761878b9be6086befbeaa5c95b93a49aeddd0cf0db674a90a29","ssdeep":"96:ncIIGAbKBFrGUrGZTx5hnOY0Y6ZI5s4zEF2Ygp/IjwkvCSo:ncMA2DzGZ13OXfI5NwF2WTvCN","tlshash":"31916c0b0aa363bdc2b86169183170e56643a22c0f69ac125829c4fb7fd64478df8f75","first_seen":"2026-08-07T21:29:27.405182Z","last_seen":"2026-09-22T18:32:36.747592Z","times_seen":3,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-wodp-categories-greatwaystoshop-pc-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.420Z","timestamp":1790101912420,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2026-314-hp-wodp-categories-greatwaystoshop-pc-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-301f\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yqUNvp3ijT6PRxFgE9kB6QDYCtVdsnldGHuA94iBS3Riu5yJMpHETMZHCiyi4fvZno%2FIhRq%2FlyI2IloipEuLyDrY97CbW6%2BW%2FcumYY2jDft3i4gxDLBZc5nW%2F%2BHz1pkDLGE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398abd15691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12319\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12319,"size_decoded":13096,"mime_type":"image/png","magic":"PNG image data, 440 x 550, 8-bit colormap, non-interlaced","md5":"b68bf3dd3783e8377ca2e131ad6c37b8","sha1":"c50855bbccf270ea1c2fe1968209f8ddcf56ace4","sha256":"ef144130d6253a2fde4f5824331d87bbd84c92ce2022e40875dab9c35cd3b5c5","sha512":"d1b60146547666cd095123b95876328140e98a163df643bfc93d458559699eee320d743214fff56fb8e8f2ad51dda485dd370cc836805e623e2612046a54dd0d","ssdeep":"192:v1EFTE1PsQVlnLTd+xXgtuBQrTuyDdD4bEk6nDwn5q0O9JvoKkF7nZrnyoWX+:v1hLlQXanuyJQEtnU5A9JMF7Zr5Z","tlshash":"3742d0d663be20b98e8e32a45334724141cf9a7fd30a6409710c603279aee2837c9f5f","first_seen":"2026-08-07T21:29:27.431675Z","last_seen":"2026-09-22T18:32:36.748275Z","times_seen":3,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_329_hp_autoservice_banner_en.jpeg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.422Z","timestamp":1790101912422,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_329_hp_autoservice_banner_en.jpeg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-13c0d\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yilhhKnDIZsrnM2ffGBepbkMT0cCi7z0OSb%2FNeTU17oC%2BDApqTez%2FqCITJF7eLMV0vpjOSDi2EiYtFPvBNQl1Pd90jPhUTzIJbMqFTPOiHQGVmv8UnMkKE7DWI2VlFSZ2dU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398abd35691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 80909\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80909,"size_decoded":81682,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1172x500, components 3","md5":"d7d931686b9c6b34e4cc681022434631","sha1":"1a88aee0df8889ae96d4b9fcc1bff143f9da04b7","sha256":"8bb804f5786b8e18cf5bc54c9319fa3cce636ef64b55d6af37bfd9bbe8067b8a","sha512":"ebf1f47782b3113ae9f4ec941cb8964c16724357724535fc2603dbcb6e9fbf6b544f0e617f83b495b763a60db40c9e5e63666624f5535cf6091b5e61b0c69955","ssdeep":"1536:I+QtDVaKCF86RsXtOB0ewV8MtafbMhG+DLzJxUDREuQPY9X:6DVaKCvKXiOObitbPY9X","tlshash":"ff8302352ac48afdf56e8430070ad32bb7ad2527bb82d3c7569186f501e102f6db466c","first_seen":"2026-08-07T21:29:27.40715Z","last_seen":"2026-09-22T18:32:36.748863Z","times_seen":3,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/canadian-tire-desktop-offer-card.svg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.434Z","timestamp":1790101912434,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/canadian-tire-desktop-offer-card.svg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ud7kfydiWLuZLCzLeVfkDUZXYfyuev%2Fud3KDFYGlYPwsXcRz9lI31BGwSj0VtCMP00dK8Fn4vaRz8CdZXzc9KyvuXReKoeAshljv6CJeanROul9oNRmCOAXMnoSvd%2F1RyDI%3D\"}]}\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\netag: W/\"6a6764b8-1b06\"\r\nage: 174\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a3f36398bbdf5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6918,"size_decoded":2895,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7b952e42c206487d930dbd9764004f2c","sha1":"0c0a128c1606a96e0f7df901d9872ee578694b83","sha256":"348bc749bf8cf7d85032a0bf37b1923021f7d72f7cdf475e8f2f9fe7cbbc4186","sha512":"77b248c0f222e62c7a1ce0d42e41ccc371b33ef0796bc7a8c05b9624ddb7f15a8b2d5ea6ee5ed08baea802c3e274f24ec3d53a43c35cada4dc5a66185160025e","ssdeep":"96:+F8RQx2lomDTh22qQ3asX+0a0IyQ2tMZbbfN4aWLRClRM9PxzSd3xWsmu:dmcTh2QIyQ2tM33RMkpT","tlshash":"96e154b322a08b80c95593549fd8f94c922ef29bf6e785c07b5e3158cf149eb1d38244","first_seen":"2025-01-20T21:47:49.773121Z","last_seen":"2026-09-22T18:32:36.749501Z","times_seen":6,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/5346-owned-brands-app-tiles-canvas.png.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.455Z","timestamp":1790101912455,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/5346-owned-brands-app-tiles-canvas.png.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1c90\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ce8cXvFW65DGYwJxcTRDUNG2j8xgOFY7o43EDfbCc1hZfjSx7wyxiqggqmUGr29zECdIqcd6T4Mj4ytee8B4YtANHH3s4IWQDdaxmThNtC7zRIi2hkUT7EhAO1lS6PfaLkg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398dbf05691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7312\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7312,"size_decoded":8077,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x144, components 3","md5":"6fac9190844cd786296c617b6b2a1679","sha1":"383c2b83219e05012f109f94d093bc05c26afd4c","sha256":"a0d77d1955eeee1cda9d7f26984e8a1c005fef1904a17ac970b9c8236bf29bc6","sha512":"f268fd9910e7509be320a5bc0e3c4a16ae94b0002d87eda9bbbde20bfccce8f049ebdbbe5e4f9b583b4e5caed60dcde0a44158c180d8a2f1f83d1d1796ca9816","ssdeep":"192:JjDTLLL8xmttEEgNlP+rrVjrFnXv1+nRJMmv:J30mtiEEP+r9rF1+nRpv","tlshash":"d4e17e158d658362dc7f38f0396c0e229163e760ed6ed2c954108ad289cf7ea4e51eb5","first_seen":"2026-01-21T19:46:25.664576Z","last_seen":"2026-09-22T18:32:36.750155Z","times_seen":5,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_SC_WinterClothing_TriApp_EN.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.476Z","timestamp":1790101912476,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_SC_WinterClothing_TriApp_EN.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rUMPBoHxteOx%2FucTEUw9AuPSk8GFzIVXcxtyKj8Jo4WFjdeio%2FqyyDSdFi0dSjFlrGEffHMSTZrdWaDNNLB5Wv0yv7TmaNrRWSHvwAug2x30pHfP4kCWayvV3h5S%2FcWCaio%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f363990c025691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7936,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"3f8658065ef80ca9220a37f4894f659a","sha1":"c3adb993c664db08ed2b899e2ad30b1ede71edbb","sha256":"d4dc6ce7307edab20e1be856819746ae8d55618395c880111a1f9d63de00e275","sha512":"6f938a103fa96a5b64312133e4863444b04a7b1eeeec02fb376138f3efc60de4d2ea9e363834e124bf22d134503aee6d3a75ea3f5e92ebaa6fa8b1ce9516618f","ssdeep":"192:Vj9jhjOTK/OaaUl8PzxzLk81B89l7vlCeNA:z//FK9Al7vlCeG","tlshash":"39e1ba63f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.750688Z","last_seen":"2026-09-22T18:32:36.750688Z","times_seen":1,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_mobile_occasions_header_camping_en.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.407Z","timestamp":1790101912407,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_mobile_occasions_header_camping_en.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-a1e4\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oxPt%2FBjhhHaFMFGPp3WEGLJ6haiB0vGul7ydNnb%2Fa9%2FxK4gXWIPdOOfClSQJNNgPsFHrXLt4NU6kUYmNHUJGAM864fUFTiVx27hgYDgIAef%2F0Rm8MIxlhvJoG%2FZQ7QaIWy0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bc25691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 41444\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41444,"size_decoded":42220,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 750x272, components 3","md5":"20598abc924ff5170fe0bba9b9f9df95","sha1":"3077f8b34a743e6a1bbd4f5eec0184d5462742f4","sha256":"de2bb75a88ad2c229d81742d9c0d2c69c47bb75ba0a855806d99b25d97e608f6","sha512":"4fc88e367c8ed291f5f842f9d2ae31fb765ec697fc25d4c586df96306770ef24c439d070ff49cc6d1911e0d8ec6456b142ed0969875f8eb9b6608b67ac928682","ssdeep":"768:ByNMr5aHMBs9XTJWAD3wxEq9aR76ZWS28SDTd2uuRWEr21J4PiL3v9PWkFFcVxi:UN/MqxTUAD3wqU3Y/vDTd2uuRWEs4Pix","tlshash":"ab13dfa7a529df893bdcc33424fb17177b12ca37c8a7861460a3688515eb87c16374f6","first_seen":"2026-08-07T21:29:27.418744Z","last_seen":"2026-09-22T18:32:36.751758Z","times_seen":3,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/7526_2026_DA_20CTM_AlwaysOn_Offer_CT_BRW_BN_EN.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.423Z","timestamp":1790101912423,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/7526_2026_DA_20CTM_AlwaysOn_Offer_CT_BRW_BN_EN.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-14c18\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XCRAmU7ksDTpqo4Tj7nFNkBNJkhzbJs8f%2BzR7wKP2v1WgJf1EWOL6962aP0btTH8CISPUc2k5xZ5sDxU1ZoaMtOWaz0ayHU57q41vz34E3LF%2BaW%2BPB3kOjnPii7Zv8JpRJQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398abd45691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 85016\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":85016,"size_decoded":85789,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 684x800, components 3","md5":"9fdd79d17363a1bb8b05b4971b80dc19","sha1":"533979c9bd593ec6c523c1dbdcd5c83b3bef283c","sha256":"d98290450792ac4e2e4e7841e21407710d6d8c2ffa5ac4e61c002a0d57873c15","sha512":"aba5d12e10497008e0c360eb85d05f42d0b2423dbd3a42e0873b83e8888f10430bba29ae720f927157b08efdde11d3ac5417a8ab5f5f41cd30f7c7ac3838da72","ssdeep":"1536:qazjA197O/zYcBsyg5Sz8KHeHLw5DpqFA/x9x:qazjA1ZiJGf5SQKHOw5DaUx","tlshash":"6d83e0c36994cfc8bace9bb829d71b93718bd733196768c95903265125df2bf20035b8","first_seen":"2026-08-07T21:29:27.494843Z","last_seen":"2026-09-22T18:32:36.752608Z","times_seen":3,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp-2026-312-hp-featurelist-services-delivery-en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.432Z","timestamp":1790101912432,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp-2026-312-hp-featurelist-services-delivery-en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1a389\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZS8RYgvQ4b%2BhVZARO%2FCax4qXIKLtIBnA7%2FhBx9h9S7ma%2BoL%2FrHPzj5%2FXaVDkYBoh94RXVlaDkIrA%2Fhi03mD7ZJINNepdIWZ0JqLHxPQorfkUhXU01lbnPZspqlb7G0GAsKY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398bbdd5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 107401\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":107401,"size_decoded":108182,"mime_type":"image/png","magic":"PNG image data, 684 x 800, 8-bit/color RGBA, non-interlaced","md5":"65d7b535272d84e621a4fe2eadad7b7b","sha1":"886f8ba6d7128d307b4175640196288e396c830b","sha256":"e7b4dc87d11537a235acc07997cfb9af58405dc876be65b1c2fa3c36572dbcea","sha512":"5a5a506c9fe3916920c832593e901c862c044a853bc67ae9b3cc6b6801240f5b85c4cb24e5ab6fb6e0570d147cf5506922bbe3f344db17d43669e5187beda39a","ssdeep":"1536:V0q5sQlcs8a8hvEq3uEDnKAK6RYmmD+4okqiye019v2zb0E7iOmj44pQnp2rVRA:Vd5/Husq3uEDC4AxoUT01uk7p82PA","tlshash":"c4a3f11ee617c204ac995010ea3ed2084f79ee53f3a65af7762ec0b4c9d6150bfc9a4d","first_seen":"2026-08-07T21:29:27.485167Z","last_seen":"2026-09-22T18:32:36.753181Z","times_seen":3,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_A_SpendGet_TriApp_15_ENG.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.437Z","timestamp":1790101912437,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_A_SpendGet_TriApp_15_ENG.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-9d0\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n1U9W%2BGyJFwvB7vC8GuR5pEvmYiIquJTgTAoKdmWj5b51jA0nhqnX7YDswSj7VtC2qdMa9NcYSyoNazgzQLtSQ4X7gMFB8Ik1%2F6Iss6m8pp8%2B9XGPxN40OC%2F4oZoGQvegeo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398bbe15691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2512\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2512,"size_decoded":3284,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2cf92c2d7d04d888961820a27488a80d","sha1":"3127bb6f6c8360debefb6d3f651cfc30c919ac88","sha256":"28ee5545b254ac779a042e0f12c08da1e972f7cb611a32da3dc686ed3e9174ea","sha512":"099681f65f691f3672cb1adfe3a64c272d1473dcc47c673bcfd0bd416587f345d957bdf2b877f9084a52d08b9fb837c89951f3534fb57dbff11e45d242a3f585","ssdeep":"","tlshash":"c7512c2107bc93d47a86fdfd1a7e9685e03244b9351839c03e939ee3867179479c05c6","first_seen":"2026-08-07T21:29:27.297643Z","last_seen":"2026-09-22T18:32:36.753728Z","times_seen":3,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_A_WasherFluid_TriApp_ENG.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.446Z","timestamp":1790101912446,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_A_WasherFluid_TriApp_ENG.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-6d6\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p3bxVOmeKnv4MXxeinyB3QOfsKK%2BNdeyyB%2B5s4KeP%2F7pnuN%2BQQJ5hWkr8egI%2Fkq7stsa3X26mrFismB6SY%2FZQso1ZHh9AmMDUDcrubMReZNBMQCkqZBnNawI%2FcrkhGpBsuY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398cbea5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1750\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1750,"size_decoded":2518,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"85de267e8a81ec9b24fefa752b7ba62d","sha1":"ca2f80e2acb6cdf8c47e833d68a3ec23d3f3574c","sha256":"920bf9ef4a6c9e23affb203255f6861ac1a3a08e87419f1f2e8b4cc9a60cf20e","sha512":"f40e85b8fd400254641f4eeb81a693a4418ba89d0958761360d6b6405836d7d17854c372e8ad7d917caba3757255c66d6d9b21e1ea089f1fbb00cde59b26de31","ssdeep":"","tlshash":"7731088e8cca521ceea11dc647ae88c17c710236e696b522e6441ff19adec117501ef5","first_seen":"2026-08-07T21:29:27.463308Z","last_seen":"2026-09-22T18:32:36.754321Z","times_seen":2,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/4026-mastercraft-apptile.png.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.453Z","timestamp":1790101912453,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/4026-mastercraft-apptile.png.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ua7CYB%2BFxk8XpmjC0MKcd8iEeY4%2Bkg%2F%2BNs32iHbgXLe2xzexF1Ou9lU6M%2F4jr9FbiwhyHWl%2F5ulC7SQFRP9jYf22NgbiRQPAgGMPJkSADEE88Qz8Myyo7%2FY8xlf3LDpgEaU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398dbef5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7944,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"fdc94992e4de29ec6cea29050c89df6d","sha1":"b1b097a1579f48b8677f9d83ea2f29c19dec3d7d","sha256":"8444e41c71bd6124a77848939b7feadfc7f8224510233873ea8ebcd7e9f5e347","sha512":"544d6f0bd6defc23e9980a48f9110b1068ad1f2453b5324219aa88cef507a03aa79847347d552f4a2281b2b3b4c11db926be7f299b0ea494e984587969978a29","ssdeep":"192:Vj9jhjOTK/OaaUl8PzCzLk81B89+7vlCeNA:z//FH9A+7vlCeG","tlshash":"74e1b963f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.755597Z","last_seen":"2026-09-22T18:32:36.755597Z","times_seen":1,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_Marks_LadiesCasualClothing_V2_TriApp_EN.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.475Z","timestamp":1790101912475,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_Marks_LadiesCasualClothing_V2_TriApp_EN.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JEPvO%2FyywdJzofhuNMI7RGsGqS%2F%2Bdlj%2BPJxNik%2BSS25dMSYPe3r4y49lers54Y66qeRxb0HZ%2BeTrYqaS6g7TKFqrrTi%2BMmgu43Q2IbNEb0f9TT98vnhlVJCJI5145UTKYIw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f363990c045691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7944,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"df32752b398a65fe2f325c793949b2c6","sha1":"d81d736dd25e458409c57f4b3df0a0d3bfbcdb89","sha256":"9323df66a96ecf2b1ab2961e5c0c8785dff12500d0f1db58d0db57f6561a04f3","sha512":"db6c61c41bee9d49a7f8acd23b61030f5150a2726a3ac3d0e205f7e4692d772a9643c76bad823e6866e6933125ea1d4e3b94747d120ba3582024fd66371e0cd3","ssdeep":"192:Vj9jhjOTK/OaaUl8PzDzLk81B89X7vlCeNA:z//Fw9AX7vlCeG","tlshash":"4de1a862f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.756578Z","last_seen":"2026-09-22T18:32:36.756578Z","times_seen":1,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/powered_by_logo.svg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.481Z","timestamp":1790101912481,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/powered_by_logo.svg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9PbQiPfzZ5MWWCR3DbiTOxUpzYDyW1%2B6n0fPMFhD%2FHtmv5vNMzWdFU7CD6jyVEEi9B6hWYcAtzd7%2FF8PG%2B4JuotwycMlOCYEsj5LtmFqfJG74uW8opcfa%2Bft2IzbZBzU0v8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f363991c075691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7940,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"c132d0f93588a2ec718b16061879ecff","sha1":"d93b442e76e9b840f5e52cbcf196edd74655f1ad","sha256":"864f3c8f28772277d609423f9c65d62bf7d845179e31a7d350eb6c3a7497ee4f","sha512":"074cedd29ab589207ea09bb4ef6a3af1283119ed4aa4c45fa90796dd0ea20adf532c5af3c1dafb8867904cfc29499a87d9660c2a30db65d79a8ea8f8cd71ec6d","ssdeep":"192:Vj9jhjOTK/OaaUl8PzvzLk81B89/7vlCeNA:z//Fo9A/7vlCeG","tlshash":"5ce1ba63f5f915fe1053827231a97b193de48013ea6704a576edc1720f8ef85ed47185","first_seen":"2026-09-22T18:32:36.757817Z","last_seen":"2026-09-22T18:32:36.757817Z","times_seen":1,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/2026_odp_shiptohome_ultraslim_banner_v2_en.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.397Z","timestamp":1790101912397,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/2026_odp_shiptohome_ultraslim_banner_v2_en.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-dca9\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HtLLTWnNNBDz3FlPdToPFPD6Px09yaHt%2BP45TJFDhfmFU%2F3DYmcCTaQXNwwS6VnWZbHfZssuq8yFg98bAbWzkPKnGE%2FxkFtvrdpklRdlYHjTG8GbpTBQqoG19SS8aXRHcWA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363987bb65691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 56489\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56489,"size_decoded":57261,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x342, components 3","md5":"3b94ce2c8ece4dd3ebdc19d9c4d657d8","sha1":"6dd82fd16081efc7bbc205fa1390abebf30ea84b","sha256":"b88df8529f883474e1f5f6c8afa56d1b8689f5518df4229fc7b73c2c6171b75f","sha512":"3c5a992c1832cdf1623f38d283fe50fcce8dd079971898b4feeb66ea59cc19739bf8b47a1602cc210a0db644a7ee117c83aa8b73dd8bb8882823cce22e7316f7","ssdeep":"1536:Hl8Q4ZivenF+npHgB+LU9XCLZXCWq+fQw:Fj4gveIpAB+Q9MNCxaQw","tlshash":"8b43f107f932cb892389cabe2c4dea7678b661f19939d52d744e8fe2c7dc1234052724","first_seen":"2026-08-07T21:29:27.412914Z","last_seen":"2026-09-22T18:32:36.758988Z","times_seen":3,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_lanterns.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.413Z","timestamp":1790101912413,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_lanterns.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-7e5b\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FKqqzcbeOfMYpZl69u9u7799ChjYqIW%2F%2FOhFIriDcZ8rvyEs5HtR4i5IHS5FuWZ4RuXU%2Fji5Fo8RDj6znHHcLS%2B31iEQmrZgFz7F2bsZ%2FErwPr47TIS6GwyHp4dyyn6YUWI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bc85691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 32347\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32347,"size_decoded":33123,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"e45b5cffd76d01c047e14b55871e81be","sha1":"4a4feccfea14f609350ed4562d4c69d3a8506939","sha256":"d232c6aca04abe23a355d3600d26b92aa8ed8d01d610772d6cb76e140c3f4038","sha512":"19ff8024c224a789df16202a42259940d0d05eb9de8d70a42746941f993f98a921c9c43ee7ff874b2f539347a0a5bd06079b133322b3335c0001ca3b7850b77d","ssdeep":"384:tmJHSF6tAjceKtU5PfHsHTSNMPAQhAB+86HvyElldXnPCSG0IvL7sQ5FNSRH1+2l:oJt+5HlfHsON3GABUDlf3PCBxv758vl","tlshash":"41e2f10af537b52cd486463d0c8dfb0453c566f263bac658b34f0fd9d3d64a76066628","first_seen":"2026-08-07T21:29:27.48054Z","last_seen":"2026-09-22T18:32:36.759576Z","times_seen":3,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_marine.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.414Z","timestamp":1790101912414,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_326_hp_desktop_occasions_camping_marine.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-1086f\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E7u2oBq7HKi3ZXcQ5YTyLnGsF1rq2m5EvMOi1p%2BqX4k24c1C0JqyI9bN4RGtw2sPoiYPmLzumgeGJJ%2FjTmwPAfGGvhLecTAhy4JhyCGJoyyBdypdL2H1NdRW2v52c1uykzc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363989bc95691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 67695\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67695,"size_decoded":68466,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 440x550, components 3","md5":"d0fb527bb3773ba652b67c7b103afe68","sha1":"1a2c2af20b50260a5845398bb33781044b0719de","sha256":"c6ad722194eed0af9e888a90ff12d26301523e8f7b3ec40de02bc3415bf48247","sha512":"630413e85eeff1d22c6a3b39432d7e4810fbc125336d1ccf538761a84f26557447e290e58ef8b3cb97fcdbf9b395696240915efd1927249b90676822aeda418a","ssdeep":"1536:6E0Zh6FrH8jKHNVN6eY/pyrWzNhUh5FhLf8A8raV1llL+p:6EWAxH8kN6/mYVajllL+p","tlshash":"0663024260a72d31ac79d43f9cf225e70d748479182cac4d8b5bd1ea3be53e66f4902e","first_seen":"2026-08-07T21:29:27.31999Z","last_seen":"2026-09-22T18:32:36.760366Z","times_seen":3,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/trianglerewards-horizontal-en-primary-update2022-red_a532933a-f04a-4f6e-a92a-7216cec07a94.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.433Z","timestamp":1790101912433,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/trianglerewards-horizontal-en-primary-update2022-red_a532933a-f04a-4f6e-a92a-7216cec07a94.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-978\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dGk4j7ufXX3aVIUjdf2nypQWnYsr1KmuLD6OPH8ri8Iu2%2Bq9a2ZBhlMXM53JBxCtbtvFNrQ4jMOXCwM2X%2BKvcPZqxRZ0BovC4x7iK%2BezAtMV5xS1zJbMiiZV%2B6ivqmOnjz0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398bbde5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2424\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2424,"size_decoded":3195,"mime_type":"image/png","magic":"PNG image data, 320 x 40, 8-bit colormap, non-interlaced","md5":"29fea8a39df0ff4f306ec0ad2055762f","sha1":"e5b8e0fbc10c27f8c4bed179f7e901ecd0f628fe","sha256":"945daf9c166767ea082f0ad2eeabc33cd006ba20b7d35b280520301206ea6426","sha512":"2232023950abb44e5245e00af7e32b452e57894d3437a2126ffcc438d1f32ebc5e92b5cdf0ec73ca3903aa3d6f497ce302db4602071674d8d052e833639aaf18","ssdeep":"","tlshash":"a8413bd7ffac94915e1816a2f0ee8201f721101edd62441b2d486c44dacb88a42f6b4b","first_seen":"2025-01-20T21:47:49.771603Z","last_seen":"2026-09-22T18:32:36.76098Z","times_seen":4,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/3240_Marks_web.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.457Z","timestamp":1790101912457,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/3240_Marks_web.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TmrMTciiVLnZN%2FMTZvVhZ2OLNfpwjCuuxwe28G2Dn7JQqWH0%2FHThNdxecHxlgDD2Dn6ETOhc2XJ4YfqxhhECe3asRIfhPwIS5uf79EyhqKyIuvEbnIjrMMV8%2FpOjdIr2iKw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398ebf25691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7936,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"4e9d7344be237d4610d6dd21605e0516","sha1":"843a67bd1c3de75e35c927ea1a48c850e43f9129","sha256":"03025a376186336b1e8a20204ca43978bab862f60c897700074df9ec216b7ceb","sha512":"2768b85b7766661b08e99f3f16d2a2eb2bc1bbe78033693a07e167b6aaca419d84ea5af59fddabcbd61f82fc7010de04c30efea66e2a38b1fdce1a8c7b6a907b","ssdeep":"192:Vj9jhjOTK/OaaUl8PzMzLk81B89U7vlCeNA:z//FJ9AU7vlCeG","tlshash":"37e1ba63f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.761545Z","last_seen":"2026-09-22T18:32:36.761545Z","times_seen":1,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/gas-desktop-offer-card-logo.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.465Z","timestamp":1790101912465,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/gas-desktop-offer-card-logo.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rhjAcHTR2ZCDl3A4FKw6KPq5GpB5BF7TBJFuWAGv8LXawSXl5RUFdkGsmWpvle5ZwT9x8TtK0my9rz1Ax6WEnu8lp%2BUj6hLqWcBr%2BYzP6YD2g0jlj3BxU0YE%2FE%2FDnJJqJO0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398fbf85691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7938,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"c13c547240229d7a9e182f3b0b46f4a0","sha1":"4fec879682e2b5a19ab3c552482fd22f35aaa31b","sha256":"b330476e5a8bf5d794ca1e4d60b62fb68e22e24464d756c8a3d7d4fd783fa0e8","sha512":"f9e3b5077ce49b7ddd9e0538127b23db1fa3258957a8ebc37ef429478d762f7b28bfa82460597ab742b42a17c97c49c0311f2212079ee20d9206254a54f66845","ssdeep":"192:Vj9jhjOTK/OaaUl8Pz/zLk81B89Uy7vlCeNA:z//FE9AUy7vlCeG","tlshash":"5ee1ca63f9f825fe1097827230aa7b193de48013ea6704a576edc1720f8ef84ed03245","first_seen":"2026-09-22T18:32:36.762561Z","last_seen":"2026-09-22T18:32:36.762561Z","times_seen":1,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/10-6.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.698Z","timestamp":1790101912698,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/10-6.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eqSH9q8RNUx%2FPoYTmkVXw6vyX4MD66BULCJIhD722FOr1UbMiYG5eYILWTuaGqacOhVJQiUbj97TJKXwCUlI60d6FYlug9wFfPOqMcRUretFgAUgmU3vWLgdByyadCRwDtY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=4,i\r\ncf-ray: a3f3639a6c1d5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7932,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"ae345041b04da83bedd938cf05076a6f","sha1":"e65d7366050807cfc765fd2d1afd024779442dd4","sha256":"1b5a95f12cbac6d0e776ec2465f4777fe970f0d3692ea800c475add211d00586","sha512":"4d234b97f26512c829781f3edacd63fe0426bb0a862893d07525762d56bf0ef5e7c7e89a5c59c732cef968f740a49f2717365b52cdcfb89cb584d13138231bb3","ssdeep":"192:Vj9jhjOTK/OaaUl8PzqzLk81B89i7vlCeNA:z//FT9Ai7vlCeG","tlshash":"6fe1ba63f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.763588Z","last_seen":"2026-09-22T18:32:36.763588Z","times_seen":1,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/odp_2026_324_hp_desktop_cat5_en.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.402Z","timestamp":1790101912402,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/odp_2026_324_hp_desktop_cat5_en.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-6752\"\r\nexpires: Fri, 02 Oct 2026 18:30:15 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 97\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UgBP3h%2FxmK%2FHUTTnu6lURAlEHtTRKZlIB%2Fy9jxUt9KGKEw6eskoOiMqIpbfSSiQDz5aNnHbs5f%2B65QN9eClUKbvfIhucBPzZjpe%2B671joBMBnc7ZUVpCv59sX39rMSSaZzs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f363988bbc5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 26450\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26450,"size_decoded":27224,"mime_type":"image/png","magic":"PNG image data, 696 x 312, 8-bit/color RGB, non-interlaced","md5":"c018d6de296ad384688bcf807b5b0d72","sha1":"01eb1064dedc56a1e77a003e2eb41c94bcb1f0b8","sha256":"a19fcbef5dda42498b5576b689016d3ac2e200935ce9c328b70e6cc183292757","sha512":"027a1080f1e5ae3ef1e38850042855a4821a3abff575e9d9c06ca0ac6084776d114b2b1993cb3fd3ca3a45f13688bf5ead704984254903c0c85819aca654d49e","ssdeep":"384:4PLE+UO/SxTlwfLWh0SbFfStkH2wEuMFrYZdXQLHaDnzh3VLqCJ/mZwlHgAcNknX:n+vXcbIC25F0LgLMhVLAqSn9WqNdK","tlshash":"0fc2e1d1f79882a99e73de79cf2d801519a5d788f4edc50a2862b0fbc5844707cdb21e","first_seen":"2026-08-07T21:29:27.443733Z","last_seen":"2026-09-22T18:32:36.764681Z","times_seen":3,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/TR_L_MixersAndBlenders_TriApp_ENG.webp","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.443Z","timestamp":1790101912443,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/TR_L_MixersAndBlenders_TriApp_ENG.webp HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-aa8\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AufHirLXm6%2BnnxVxjYonHCXH4vKmAIE4OU19BSoxaNBrV%2F8r7GsbX5cNbCyRbIm77sOkr7%2BwiQKyqd9whwrPRtgrcKJwby8%2Fl%2FrVWGyrHpFC2Eu6te8y3%2FFZvIJ9Uqj%2B2Ow%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398cbe95691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2728\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2728,"size_decoded":3506,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 160x72, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"36ea1030066228e538a0f183e5657ed5","sha1":"71b12e1ba58e59a714eecfb9073e53c435f7f3da","sha256":"029b8defdfd94cb9fc423f1e6acdeaaff228914daf70faa57122f7b4bec5204b","sha512":"83ea9ced3f42cf48a46a3623820cecd1679d7b7d26922b2bbdc8f5c06887b058374f919150e4a54fa6be2b8ff76ce41d3641c7693ea7e0f510f5a7f533acb391","ssdeep":"","tlshash":"1c515c53fb3f0870d8d7ee860bc2434a78229f0a16fd1a362053585b559784e9d8a9e5","first_seen":"2026-08-07T21:29:27.327185Z","last_seen":"2026-09-22T18:32:36.765308Z","times_seen":3,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/5346-owned-brands-app-tiles-noma.png.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.452Z","timestamp":1790101912452,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/5346-owned-brands-app-tiles-noma.png.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sGVyvS3UYJqeZul30JxlFma81uhkgVPa3QQI%2F259nfB2YeDdchWSGFj5XeKK6eY0bUZvN7a7oFpvzqbIphGWFUdrGTwD8yQRyCvK0qTIygrOnWPrbwv3QCQ88%2Bf%2Bdeei6dE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=5,i\r\ncf-ray: a3f36398dbee5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7936,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"c7c0b853f9f5c59404b6b09a0a3a2ea5","sha1":"76c55fa63127929b93639bef6cf69a6b4cc322aa","sha256":"e166301b4f3484176515e544acc69d8be9cc09faf4145580ce63a968f36755aa","sha512":"4746616f00684f6a3538e45070352e80452e2021c7fcb15a17ec5ec859240f4fb1302c38217fa0e8e94ae018b6a629ed0e6683eaf106ac6be7dc08175e3612d0","ssdeep":"192:Vj9jhjOTK/OaaUl8PzBzLk81B89h7vlCeNA:z//Fu9Ah7vlCeG","tlshash":"91e1b963f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.765954Z","last_seen":"2026-09-22T18:32:36.765954Z","times_seen":1,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/5-ctm-offer-badge.png","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.462Z","timestamp":1790101912462,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/5-ctm-offer-badge.png HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 27 Jul 2026 14:01:28 GMT\r\npriority: u=5,i\r\netag: \"6a6764b8-5be\"\r\nexpires: Fri, 02 Oct 2026 18:28:58 GMT\r\ncache-control: max-age=864000\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\nage: 174\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w3gzzlujDXF8Q3RV%2FVFpj40K0ZFN3xH8kp3Jc1FAmfe7PpSxciVG1P0gjhQlOeGk7rtfJPPak58MxTbSkZrToG%2BSNvecfod2p6EZOkk6ja%2Bllod7GAWfcvZgh9dN%2Bjr2aq0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f36398fbfc5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1470\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1470,"size_decoded":2241,"mime_type":"image/png","magic":"PNG image data, 96 x 36, 8-bit colormap, non-interlaced","md5":"5fe925a8c7afc3f53b8f7fae9be7e402","sha1":"c430630df7bd7a12c2b3504ba61196a0346fdd27","sha256":"9733c2fe0366be1c29ec4eb4bd3c97916d4efff2f0f19008a8b177280b492bc6","sha512":"b3487edf39d539e05b664d390eafb3b1a4074fabcb2b7e431cc7a1c0920e18ab843db4ef3646012d8402dba47ae14fa2c7e6111a6cc3292a41a1babc5d98ca12","ssdeep":"","tlshash":"2e3119c832495dbfb74a8d0a0250e0c056dca6f2898029423a43b1c86c202c573c5f2d","first_seen":"2026-08-07T21:29:27.491105Z","last_seen":"2026-09-22T18:32:36.766904Z","times_seen":3,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/10-2.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.699Z","timestamp":1790101912699,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/10-2.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iYvLX1xxbeLM4qmuoq6keUDqt0E0ZYrsyKvfAYSBsn5P5d7YYnaTW5X%2FMGbKTWDOTClOJh5bh%2BQjy9k78h01N5RKhFXc8Mdtb95JyAB4q3vZVsAYnfJe1uouKYRpPfYASRI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=4,i\r\ncf-ray: a3f3639a6c1c5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7934,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"eec274c7fc3e05d66ccd037e3df102d4","sha1":"d0db054723725386265ba4b65b523b4980801d7f","sha256":"01f30ee6955449e50b0079fe7247f50bde4cd161da7afd80e68b5e9d97c06351","sha512":"44cd02800d293c5d9b3fe3098ed9892d34d87f1e564268e6688aeba872661ee2f290e75ce5211fd4436de857ab8ec0a36cb09cfe3fedfbb64a30a05f51c81c09","ssdeep":"192:Vj9jhjOTK/OaaUl8PzdzLk81B89J7vlCeNA:z//Fm9AJ7vlCeG","tlshash":"dae1b963f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ed47245","first_seen":"2026-09-22T18:32:36.767416Z","last_seen":"2026-09-22T18:32:36.767416Z","times_seen":1,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"theracology.com/lander/steps_snow_generate_programming_algorithms/10-7.jpg","fqdn":"theracology.com","domain":"theracology.com","tld":"com"},"ip":{"addr":"172.67.204.230","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://theracology.com/","date":"2026-09-22T18:31:52.702Z","timestamp":1790101912702,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"theracology.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 22:22:25 GMT","end":"Mon, 07 Dec 2026 22:22:24 GMT"},"fingerprint":{"sha1":"53:4E:FD:90:22:C4:20:3A:25:C7:5C:51:B2:76:D5:FF:6D:2E:A2:A6","sha256":"E0:C8:92:7C:A7:DC:A3:36:C4:1C:AD:E1:BF:61:FE:48:F9:7B:DB:08:DB:B3:15:8E:B8:70:B4:A9:85:D5:AA:4D"}}},"request":{"raw":"GET /lander/steps_snow_generate_programming_algorithms/10-7.jpg HTTP/1.1\r\nHost: theracology.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://theracology.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 429 \r\nretry-after: 10\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 18:31:52 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CxKIRmfvRDOzjXvFO01l9KgI2T1reqMAjmPKbAUX4CYbzCwdxUMRPwNQavrYBLw12NuadHZ%2BSmNDYmnCiddsHCKV1BMWcHHB1SiPZ5JnxW%2BsA%2BiJUAOh9Voz4myOnSIoETQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\npriority: u=4,i\r\ncf-ray: a3f3639a6c1f5691-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7184,"size_decoded":7936,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (507)","md5":"2e7dae7db60860438a30d194be1f8d96","sha1":"0dbf985711166963630bc233774c383116b9815e","sha256":"f80c65fcbc35cfa08ec6218e8728700bc2f5f102fa878ed4efa7395cd3d8c509","sha512":"a07175216551a7bd224178a7f3507e5a231c98312d6c8bef0ce47cd0b5b3a4703af2804c0208b88be022703b54d0b0836d7b7d486f27be435667e4c7ba6664ae","ssdeep":"192:Vj9jhjOTK/OaaUl8PzczLk81B89c7vlCeNA:z//FB9Ac7vlCeG","tlshash":"e4e1ba63f9f925fe1093827231aa7b193de48013ea6704a576edc1720f8ef85ee47245","first_seen":"2026-09-22T18:32:36.768228Z","last_seen":"2026-09-22T18:32:36.768228Z","times_seen":1,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"theracology.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}