{"report_id":"cdd9625f-6ff5-4204-98c0-18758a76c569","version":6,"status":"done","tags":[],"date":"2026-03-16T12:16:09Z","url":{"schema":"http","addr":"rblx.foo","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":0,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"rblx.foo/","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"title":"Kyxn Dev — Developer Platforms \u0026 APIs","dom":{"size":55318,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (52497)","md5":"7b8434106a2c738ee27b4ec099fca275","sha1":"8c03356682a6b447ccbe96a0d556a9c541669008","sha256":"4ce5df2e52c4c4328100307fb8558a360881d48f280013b5b2b1cf8b070fe441","sha512":"50be6e131194db729eb4c717dcbf059b7470f02d49be3d05cf17ca86ad1735eb462f0254bdf738948cbfaf9058771d3262b1d03324dc0e1deb728a46cdfcc4af","ssdeep":"768:vk0Gp1dwLRktNT3wf0gJNozREz5idUJbAahGC2xQbPBqFOry+419UfIm:Zigf","tlshash":"ff43f93163412c3d5327c7f9f6e2b738a1aad39dda578998f3dc42721bc9c44e922264","dom_hash":"domhashda06d7695ba6c5071ab3cef418ece2b7","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rblx.foo","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":0,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-20T12:16:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-16","alert":"Phishing Block","trigger":"rblx.foo","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"rblx.foo","ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":32,"request_count":8,"received_data":2950646,"sent_data":3417,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.251.38.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-03-15T22:16:12.279722Z","alert_count":0,"request_count":2,"received_data":115038,"sent_data":1074,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-03-15T22:19:58.945817Z","alert_count":0,"request_count":1,"received_data":10196,"sent_data":551,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rblx.foo/assets/index-BTLz5Ng7.js","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b2c4dab8a56531849ee66e0f236a21e8","sha1":"493ed7b3ccb0b3f4e37d1d39a8697aa46017b4e0","sha256":"cc6ce2c6443834b8831fd43a6a4bbf06a2e1a3cb1cfde3be2cf03282776c4a39","sha512":"7f6ac8073fd8f34e283983d47e85a23ee8ba74a65f14db6060bcf4be6757a4e26e2adf6c99be95d677e0cef1c12a1d748bc1c9f8ad1cfa5f114a09580af6978c","ssdeep":"6144:aG39ev5OS6Ic+SP4shwkbQs1/nTQ5k3gWgDZaGFo3yYdhnmjdw1d:dz+owUQ15k3gWg9tYdhnmjdw1d","tlshash":"57d47e44b152ba2dbbe34ae5607f4105b13e1e14f90d8866f17cacab2a60059b537ffc","size":625092,"data":"","first_seen":"2026-03-16T12:16:14.816251Z","last_seen":"2026-03-18T10:55:34.61256Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rblx.foo/logo.png","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:49.230Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rblx.foo","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 16:14:14 GMT","end":"Wed, 10 Jun 2026 16:14:13 GMT"},"fingerprint":{"sha1":"C9:F8:ED:C3:72:FC:52:5A:F0:35:35:6B:75:96:DA:1E:07:47:11:C8","sha256":"D9:BA:B8:72:F1:01:9F:31:64:13:04:78:DB:8C:FC:93:E3:0C:28:F5:71:C1:12:27:0A:82:53:9A:A6:3D:DF:47"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: rblx.foo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rblx.foo/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\ncontent-length: 740815\r\ncontent-type: image/png\r\ndate: Mon, 16 Mar 2026 12:15:49 GMT\r\netag: W/\"b4dcf-19ce3021f08\"\r\nlast-modified: Thu, 12 Mar 2026 17:04:53 GMT\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":740815,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGB, non-interlaced","md5":"e5aea88a3a26c6d2dc92f05a4811aeff","sha1":"c74d59ef33b56d1dcfad9a07a53bdaf2fb8b1c4d","sha256":"049b0a944d842273bb38049b412b58261955e6cec8bd7213e3a045aa9a4a8170","sha512":"81fa7a1660a86c45d3edf7970d5ee64c81ac12ca96d20f19f966f960646d880c5a57a193b782cd26ece5242a4a85660222489eef7d44ec718a85b8a57b434df9","ssdeep":"12288:HZs0ZouBwbGObnTRfHTLxKsme9dab+uu1UcJfqLcsRewPqz7XjLXkdn2BrSLLUtN:5JqgwbfDTRfzANm4BuVfqLcspP67zjmK","tlshash":"88f423a3badc07f317958879a795a17f78e9b94e13c34b188832d2c2a75fd01120e7d6","first_seen":"2026-03-16T12:16:14.801768Z","last_seen":"2026-04-04T07:34:58.697432Z","times_seen":6,"resource_available":false,"data":null}},"time_used":430,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":248,"receive":182,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-16","alert":"Phishing Block","trigger":"rblx.foo","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblx.foo/","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-16T12:15:47.525Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rblx.foo","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 16:14:14 GMT","end":"Wed, 10 Jun 2026 16:14:13 GMT"},"fingerprint":{"sha1":"C9:F8:ED:C3:72:FC:52:5A:F0:35:35:6B:75:96:DA:1E:07:47:11:C8","sha256":"D9:BA:B8:72:F1:01:9F:31:64:13:04:78:DB:8C:FC:93:E3:0C:28:F5:71:C1:12:27:0A:82:53:9A:A6:3D:DF:47"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rblx.foo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\ncontent-length: 2400\r\ncontent-type: text/html; charset=utf-8\r\ndate: Mon, 16 Mar 2026 12:15:47 GMT\r\netag: W/\"960-19ce3021f08\"\r\nlast-modified: Thu, 12 Mar 2026 17:04:53 GMT\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":2400,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"f1508a5c333e8272c14feb2466138964","sha1":"ede3c6ce7a55db0a83deaa8480422b19dea368e5","sha256":"0085eb11e355fe2de78a0a5478f53db1318cbad65d5c9e6aa46825ee153b20aa","sha512":"214f69ab597ac1e7e91fb91b22252446b9d69d18deed19a2f86b4a5bacfea88be3fd8c46c62810ac5e73b70eb659481f5d56476cdd61a807d66452a8296d5fdb","ssdeep":"","tlshash":"ff4187b79660d8191334826a68d3f0448d779087839abc49f2cc219e5fd2ad0c3f73b6","first_seen":"2026-03-16T12:16:14.804645Z","last_seen":"2026-03-18T10:55:34.606864Z","times_seen":4,"resource_available":false,"data":null}},"time_used":447,"timings":{"blocked":93,"dns":18,"connect":26,"send":0,"wait":260,"receive":1,"ssl":47},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-16","alert":"Phishing Block","trigger":"rblx.foo","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblx.foo/logo.png","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:48.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rblx.foo","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 16:14:14 GMT","end":"Wed, 10 Jun 2026 16:14:13 GMT"},"fingerprint":{"sha1":"C9:F8:ED:C3:72:FC:52:5A:F0:35:35:6B:75:96:DA:1E:07:47:11:C8","sha256":"D9:BA:B8:72:F1:01:9F:31:64:13:04:78:DB:8C:FC:93:E3:0C:28:F5:71:C1:12:27:0A:82:53:9A:A6:3D:DF:47"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: rblx.foo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rblx.foo/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\ncontent-length: 740815\r\ncontent-type: image/png\r\ndate: Mon, 16 Mar 2026 12:15:48 GMT\r\netag: W/\"b4dcf-19ce3021f08\"\r\nlast-modified: Thu, 12 Mar 2026 17:04:53 GMT\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":740815,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGB, non-interlaced","md5":"e5aea88a3a26c6d2dc92f05a4811aeff","sha1":"c74d59ef33b56d1dcfad9a07a53bdaf2fb8b1c4d","sha256":"049b0a944d842273bb38049b412b58261955e6cec8bd7213e3a045aa9a4a8170","sha512":"81fa7a1660a86c45d3edf7970d5ee64c81ac12ca96d20f19f966f960646d880c5a57a193b782cd26ece5242a4a85660222489eef7d44ec718a85b8a57b434df9","ssdeep":"12288:HZs0ZouBwbGObnTRfHTLxKsme9dab+uu1UcJfqLcsRewPqz7XjLXkdn2BrSLLUtN:5JqgwbfDTRfzANm4BuVfqLcspP67zjmK","tlshash":"88f423a3badc07f317958879a795a17f78e9b94e13c34b188832d2c2a75fd01120e7d6","first_seen":"2026-03-16T12:16:14.801768Z","last_seen":"2026-04-04T07:34:58.697432Z","times_seen":6,"resource_available":false,"data":null}},"time_used":551,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":168,"receive":383,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-16","alert":"Phishing Block","trigger":"rblx.foo","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcCo3FwrK3iLTcviYwYZ90A2N58.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.251.38.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:48.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:00 GMT","end":"Mon, 27 Apr 2026 08:37:59 GMT"},"fingerprint":{"sha1":"43:A0:56:D7:CE:45:C9:96:6F:34:12:13:53:CC:34:DD:63:FB:5D:20","sha256":"A4:AF:37:76:AF:D3:DB:1B:79:93:8F:E9:D4:21:4B:BA:43:54:3D:F9:56:DC:18:E9:5C:CA:1A:7C:B2:C7:DF:9B"}}},"request":{"raw":"GET /s/inter/v20/UcCo3FwrK3iLTcviYwYZ90A2N58.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://rblx.foo\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 72964\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 09 Mar 2026 18:20:56 GMT\r\nexpires: Tue, 09 Mar 2027 18:20:56 GMT\r\ncache-control: public, max-age=31536000\r\nage: 582892\r\nlast-modified: Tue, 09 Sep 2025 18:33:18 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":72964,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 72964, version 1.0","md5":"91247c94dcda6ff52b445d71d6bbfb81","sha1":"ad2f62363ed047b430b91f32afa31df51fcd7c5e","sha256":"6a3c3e024b31eeacbf1f19c3c7be78612d91c623186f64035a50038241dad4f9","sha512":"a12dcac84e9f9ae02df3aabe29d76994281cd1005edca471194605cfcd6a0456eec872fd28c63c72ae124804d0b47d8377048caae49c40b0a18b5d6be4d6213f","ssdeep":"768:zbw+rLBkMxbCkupj4Y69/Yr71+j9pWiKahMM6+AWEqXB0oGuNGku+QCcIKE205C7:zbw+iwuS/iZWeaO1zP1/9Esvf8fXnm1","tlshash":"8f6302244e3c50c2a54d33aa286940f6f6e79c75b2b79ba4a69c589cd410f329cdfdc4","first_seen":"2025-05-29T18:51:13.223047Z","last_seen":"2026-06-08T02:00:47.215604Z","times_seen":25830,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":65,"dns":1,"connect":7,"send":0,"wait":17,"receive":6,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rblx.foo/api/stats","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:48.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rblx.foo","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 16:14:14 GMT","end":"Wed, 10 Jun 2026 16:14:13 GMT"},"fingerprint":{"sha1":"C9:F8:ED:C3:72:FC:52:5A:F0:35:35:6B:75:96:DA:1E:07:47:11:C8","sha256":"D9:BA:B8:72:F1:01:9F:31:64:13:04:78:DB:8C:FC:93:E3:0C:28:F5:71:C1:12:27:0A:82:53:9A:A6:3D:DF:47"}}},"request":{"raw":"GET /api/stats HTTP/1.1\r\nHost: rblx.foo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://rblx.foo/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 34\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 16 Mar 2026 12:15:48 GMT\r\netag: W/\"22-yT1L48S+g8l0bwencjbZevq/DSU\"\r\nratelimit-limit: 120\r\nratelimit-policy: 120;w=900\r\nratelimit-remaining: 119\r\nratelimit-reset: 900\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":34,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f16575853e97d252447c7476648422f0","sha1":"c93d4be3c4be83c9746f07a77236d97afabf0d25","sha256":"3602d64b47c9461cc79704873c730223bcd9e7350dd434157c5d9ed3104436c9","sha512":"70596b8a035e29afdc224bb698e8a77c96ff10eee32adf697bdc7abb59b9e079fd2a50b5e5d6c73f5e87b9e992181becb041fdd927a6e03c25ec6cd4b2892fbe","ssdeep":"","tlshash":"4c80045540040550d5704500441177307f35557314053c5050fcd1d405100417005107","first_seen":"2026-03-16T12:16:14.808655Z","last_seen":"2026-03-16T12:26:08.395599Z","times_seen":2,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":183,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-16","alert":"Phishing Block","trigger":"rblx.foo","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblx.foo/api/pageview","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:48.877Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rblx.foo","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 16:14:14 GMT","end":"Wed, 10 Jun 2026 16:14:13 GMT"},"fingerprint":{"sha1":"C9:F8:ED:C3:72:FC:52:5A:F0:35:35:6B:75:96:DA:1E:07:47:11:C8","sha256":"D9:BA:B8:72:F1:01:9F:31:64:13:04:78:DB:8C:FC:93:E3:0C:28:F5:71:C1:12:27:0A:82:53:9A:A6:3D:DF:47"}}},"request":{"raw":"POST /api/pageview HTTP/1.1\r\nHost: rblx.foo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://rblx.foo/\r\nOrigin: https://rblx.foo\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 15\r\ncontent-type: application/json; charset=utf-8\r\ndate: Mon, 16 Mar 2026 12:15:49 GMT\r\netag: W/\"f-NQVRlQfKHCoInEbhALgECMonhCE\"\r\nratelimit-limit: 120\r\nratelimit-policy: 120;w=900\r\nratelimit-remaining: 119\r\nratelimit-reset: 900\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"28ec1eee5f4049e3c4f2135069c1d2c8","sha1":"3505519507ca1c2a089c46e100b80408ca278421","sha256":"edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b","sha512":"f71618e40ebaa14ab6d523a2341258c0da264b545388f8fffd14c31c64b35f94b21eb633316c4d77afcd864aade1db588ef6387ee0c4787e6f7770db0abc1183","ssdeep":"","tlshash":"f06000020000002088800a000220aa302a200a20080a0080000c30200020080800a002","first_seen":"2023-04-06T19:00:00Z","last_seen":"2026-06-08T02:53:31.058526Z","times_seen":11424,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-16","alert":"Phishing Block","trigger":"rblx.foo","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblx.foo/logo.png","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:49.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rblx.foo","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 16:14:14 GMT","end":"Wed, 10 Jun 2026 16:14:13 GMT"},"fingerprint":{"sha1":"C9:F8:ED:C3:72:FC:52:5A:F0:35:35:6B:75:96:DA:1E:07:47:11:C8","sha256":"D9:BA:B8:72:F1:01:9F:31:64:13:04:78:DB:8C:FC:93:E3:0C:28:F5:71:C1:12:27:0A:82:53:9A:A6:3D:DF:47"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: rblx.foo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rblx.foo/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\ncontent-length: 740815\r\ncontent-type: image/png\r\ndate: Mon, 16 Mar 2026 12:15:49 GMT\r\netag: W/\"b4dcf-19ce3021f08\"\r\nlast-modified: Thu, 12 Mar 2026 17:04:53 GMT\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":740815,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGB, non-interlaced","md5":"e5aea88a3a26c6d2dc92f05a4811aeff","sha1":"c74d59ef33b56d1dcfad9a07a53bdaf2fb8b1c4d","sha256":"049b0a944d842273bb38049b412b58261955e6cec8bd7213e3a045aa9a4a8170","sha512":"81fa7a1660a86c45d3edf7970d5ee64c81ac12ca96d20f19f966f960646d880c5a57a193b782cd26ece5242a4a85660222489eef7d44ec718a85b8a57b434df9","ssdeep":"12288:HZs0ZouBwbGObnTRfHTLxKsme9dab+uu1UcJfqLcsRewPqz7XjLXkdn2BrSLLUtN:5JqgwbfDTRfzANm4BuVfqLcspP67zjmK","tlshash":"88f423a3badc07f317958879a795a17f78e9b94e13c34b188832d2c2a75fd01120e7d6","first_seen":"2026-03-16T12:16:14.801768Z","last_seen":"2026-04-04T07:34:58.697432Z","times_seen":6,"resource_available":false,"data":null}},"time_used":455,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":292,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-16","alert":"Phishing Block","trigger":"rblx.foo","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026family=JetBrains+Mono:ital,wght@0,100..800;1,100..800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:48.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:01 GMT","end":"Mon, 27 Apr 2026 08:38:00 GMT"},"fingerprint":{"sha1":"AD:23:3E:9B:CF:2B:A1:EC:31:14:63:D1:58:73:BB:E7:C5:32:16:8C","sha256":"B1:5F:45:BF:00:8C:68:35:D3:42:B2:67:66:47:9D:BB:42:41:07:56:3A:C4:1C:D6:10:7B:B7:53:C2:71:81:33"}}},"request":{"raw":"GET /css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026family=JetBrains+Mono:ital,wght@0,100..800;1,100..800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rblx.foo/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Mon, 16 Mar 2026 12:15:48 GMT\r\ndate: Mon, 16 Mar 2026 12:15:48 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9510,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"13079914e095fb21996530516dba2b81","sha1":"86861a41834ee339ad8631a6304de001f549e19f","sha256":"8ac4b24d0c53e87cb7ca121159dae64978aaa1f0cd2a4a4de48a105a52a5f962","sha512":"0550667c0acb5703791f2fcc69f1a9f75d01533d3780ceaf4012be18f9fcabe35ae8436c1438042df9f3faad85b64447c33b32426b7e7f97af082419471d4a98","ssdeep":"192:vywfydyGy63gy/yFVyR73xpmj3U8fH8hf2hWha3rhEh2Ah8UxSI3mzWb6:vtfcHjg8ciIs92AmrGfdjo","tlshash":"1312fe91042f9004aa432cd637cf7e32ad8e61567082d5b9affe2cd9acdac22537474d","first_seen":"2025-09-30T00:54:14.249022Z","last_seen":"2026-06-04T17:04:26.185439Z","times_seen":66,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":89,"dns":1,"connect":21,"send":0,"wait":34,"receive":0,"ssl":68},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rblx.foo/assets/index-DYNIdxvi.css","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:48.019Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rblx.foo","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 16:14:14 GMT","end":"Wed, 10 Jun 2026 16:14:13 GMT"},"fingerprint":{"sha1":"C9:F8:ED:C3:72:FC:52:5A:F0:35:35:6B:75:96:DA:1E:07:47:11:C8","sha256":"D9:BA:B8:72:F1:01:9F:31:64:13:04:78:DB:8C:FC:93:E3:0C:28:F5:71:C1:12:27:0A:82:53:9A:A6:3D:DF:47"}}},"request":{"raw":"GET /assets/index-DYNIdxvi.css HTTP/1.1\r\nHost: rblx.foo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rblx.foo/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\ncontent-length: 97380\r\ncontent-type: text/css; charset=utf-8\r\ndate: Mon, 16 Mar 2026 12:15:48 GMT\r\netag: W/\"17c64-19ce3021f08\"\r\nlast-modified: Thu, 12 Mar 2026 17:04:53 GMT\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":97380,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"6fd5b16c60db270c396a3ecaf7d234de","sha1":"9e16972242c69d94dc28cd826e429278841d57d2","sha256":"d4d4296c4bba718548ae76936f7eabb071c1a3b77070ea7ff9b6e0689b5622c0","sha512":"422e2a9bcc5f6f2962ec0f265c91c9c55e7c47a4cecafc160d3ef603ed8fdafba58983c0e810e54e2c121dfa759933d7c7afc0f44d85d6833910169be6631501","ssdeep":"1536:uZofh+YRXvZnThQKw8gMt6yc8MUwKelGrfC378VQZkt5FxPbTJS:uZofh+YRXvZnTHw8gMC8MUwKelGrfC3R","tlshash":"f893532dba59503f3d6790f8d38cbaaca10af1c0ce3b46e9bd86412157c23f65da7614","first_seen":"2026-03-16T12:16:14.813388Z","last_seen":"2026-03-18T10:55:34.608994Z","times_seen":4,"resource_available":false,"data":null}},"time_used":344,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":85,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-16","alert":"Phishing Block","trigger":"rblx.foo","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rblx.foo/assets/index-BTLz5Ng7.js","fqdn":"rblx.foo","domain":"rblx.foo","tld":"foo"},"ip":{"addr":"34.111.179.208","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:48.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rblx.foo","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 16:14:14 GMT","end":"Wed, 10 Jun 2026 16:14:13 GMT"},"fingerprint":{"sha1":"C9:F8:ED:C3:72:FC:52:5A:F0:35:35:6B:75:96:DA:1E:07:47:11:C8","sha256":"D9:BA:B8:72:F1:01:9F:31:64:13:04:78:DB:8C:FC:93:E3:0C:28:F5:71:C1:12:27:0A:82:53:9A:A6:3D:DF:47"}}},"request":{"raw":"GET /assets/index-BTLz5Ng7.js HTTP/1.1\r\nHost: rblx.foo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rblx.foo/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\ncontent-length: 625092\r\ncontent-type: text/javascript; charset=utf-8\r\ndate: Mon, 16 Mar 2026 12:15:48 GMT\r\netag: W/\"989c4-19ce3021f08\"\r\nlast-modified: Thu, 12 Mar 2026 17:04:53 GMT\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-powered-by: Express\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":625092,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (37654)","md5":"b2c4dab8a56531849ee66e0f236a21e8","sha1":"493ed7b3ccb0b3f4e37d1d39a8697aa46017b4e0","sha256":"cc6ce2c6443834b8831fd43a6a4bbf06a2e1a3cb1cfde3be2cf03282776c4a39","sha512":"7f6ac8073fd8f34e283983d47e85a23ee8ba74a65f14db6060bcf4be6757a4e26e2adf6c99be95d677e0cef1c12a1d748bc1c9f8ad1cfa5f114a09580af6978c","ssdeep":"6144:aG39ev5OS6Ic+SP4shwkbQs1/nTQ5k3gWgDZaGFo3yYdhnmjdw1d:dz+owUQ15k3gWg9tYdhnmjdw1d","tlshash":"57d47e44b152ba2dbbe34ae5607f4105b13e1e14f90d8866f17cacab2a60059b537ffc","first_seen":"2026-03-16T12:16:14.816251Z","last_seen":"2026-03-18T10:55:34.61256Z","times_seen":4,"resource_available":true,"data":null}},"time_used":578,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":416,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-16","alert":"Phishing Block","trigger":"rblx.foo","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-16","alert":"Sinkholed","trigger":"rblx.foo","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/jetbrainsmono/v24/tDbV2o-flEEny0FZhsfKu5WU4xD7OwE.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.251.38.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rblx.foo/","date":"2026-03-16T12:15:48.799Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:00 GMT","end":"Mon, 27 Apr 2026 08:37:59 GMT"},"fingerprint":{"sha1":"43:A0:56:D7:CE:45:C9:96:6F:34:12:13:53:CC:34:DD:63:FB:5D:20","sha256":"A4:AF:37:76:AF:D3:DB:1B:79:93:8F:E9:D4:21:4B:BA:43:54:3D:F9:56:DC:18:E9:5C:CA:1A:7C:B2:C7:DF:9B"}}},"request":{"raw":"GET /s/jetbrainsmono/v24/tDbV2o-flEEny0FZhsfKu5WU4xD7OwE.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://rblx.foo\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40404\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 15 Mar 2026 05:13:37 GMT\r\nexpires: Mon, 15 Mar 2027 05:13:37 GMT\r\ncache-control: public, max-age=31536000\r\nage: 111731\r\nlast-modified: Wed, 10 Sep 2025 16:52:35 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40404,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40404, version 1.0","md5":"b058178d7f309414f8f856b99fd80d9b","sha1":"e7277e714521ceb5f174cc9879b51e0f4aa69753","sha256":"18be452724bfdc236c074ca94a249a7f41a86752c7d04ab258ce9ed5651f6a7e","sha512":"0eaceff7dabb62af403cd6fa06f0fcaa4de0e88658b1d781ccd90f58596f945668e99bee1bbfb474788160c459ade4c940f972fc298af82295c262663e049afd","ssdeep":"768:PHic6xtku0k1APPuTtIw9uCZawd5iucW0c+858iSHn1twyVl:fO7hqPWIrCswd/0cJ5+1OyVl","tlshash":"e503f1d7b7502c70885b162d7fc62e0ebe026fb1987a16d9523fc372372688a6472352","first_seen":"2024-10-24T21:44:25.834346Z","last_seen":"2026-06-08T02:25:33.63606Z","times_seen":2072,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":64,"dns":1,"connect":7,"send":0,"wait":9,"receive":10,"ssl":54},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}