{"report_id":"d57f47a8-d1da-4809-accc-d51a2678fd35","version":0,"status":"done","tags":[],"date":"2026-06-09T09:42:00Z","url":{"schema":"http","addr":"sh2.us","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":0,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"sh2.us/","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"title":"Rustic Cyberpunk","dom":{"size":4104,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"aa7edf8cbff59c070c0fb828fd0fac71","sha1":"d5415468bcba8b1eab1cffbf54d1948ff3cc308c","sha256":"fdb6e8b789c85540f4f47d8942e0c2495276dbc11180a99f7e43dd8711b6ca7a","sha512":"dde3a05d1a5d59140daef83f1170b8624460b75576d7e796a313ae4de248b5b60d008a3f09cc4a8ef0e79094f0bbcf5d8b897c184f8cf1d0948ee48d3cdf06a2","ssdeep":"48:YSGx7HdGgKRguy8i6QKh1twQ7oN4AD9gBVW3EquAWZvlU1d7j+OSDQOf6v4P+UrE:CX4guQ6LhBVyKEX5Sxf6vioMWf","tlshash":"278195bbe9c8bb3b0384fbce82a13a1ce47344d5c0911c11b2d649dece90eb1423a163","dom_hash":"domhashe23ce1151cbef7469dc2fa8441f846bb","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"sh2.us","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":0,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-14T09:42:00Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"sh2.us","ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"domain_registered":"2013-01-09","domain_rank":0,"first_seen":"2026-03-27T14:43:54.120149Z","last_seen":"2026-03-27T14:43:54.120149Z","alert_count":32,"request_count":16,"received_data":312793,"sent_data":7658,"comment":"","tags":null,"fingerprints":[{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"sh2.us/main_.js","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"45d49efbd814d44c081889cde4cd78c0","sha1":"aaa5fdb3dac29bfd5f7a3bd539020d8a301e3ddf","sha256":"6a22956f1080481802a8549d93801266f0bc46f099ce48823f979cdaac1402e7","sha512":"394acb8b6ba44eca2cfd11cb7c269584e7d09f7a11cf772fc47106d37c4365562bf6d5e12e13fc45d264d3f7f7160b5e33b51088ee148390e470b5ef0469a2be","ssdeep":"","tlshash":"47d017cf1424030032f7a04b8f1b3254222310fa1c8ae8115b484a82392866f633feae","size":251,"data":"","first_seen":"2026-03-27T14:43:56.158268Z","last_seen":"2026-06-09T09:42:01.762Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sh2.us/fonts_.css","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:37.007Z","timestamp":1780998097007,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /fonts_.css HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/style_.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 444\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-type: text/css;charset=UTF-8\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nETag: 65627392-1bc\r\nExpires: Tue, 16 Jun 2026 09:41:37 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":444,"size_decoded":1404,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"70f54c5987aa36e73ef3d63f2a7650bb","sha1":"929dd48193c14cf2c09fdb9a55124b4d53ef539a","sha256":"7baafba1306c8f9d81826f015361f75c4b0900b0b8d470c4193918bc1e4163f3","sha512":"f8bed437ebfa83998d77e6dc56bdd0401752ebc37e76967da8ac89911f46b0a72a0b9fc3b61a221905e313bc4cf4d952049e9f36f3c3213b46aab538fd0a84d5","ssdeep":"","tlshash":"02f08c00ac1e99238f511c69f3cb7f2d094d282661968a2695713cb85cf25eb53d2fed","first_seen":"2026-03-27T14:43:56.155993Z","last_seen":"2026-06-09T09:42:01.755082Z","times_seen":2,"resource_available":false,"data":null}},"time_used":429,"timings":{"blocked":-1,"dns":0,"connect":89,"send":0,"wait":157,"receive":0,"ssl":183},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/buttons/btn-cypnk-at-sh2.png","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:36.597Z","timestamp":1780998096597,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /buttons/btn-cypnk-at-sh2.png HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nConnection: keep-alive\r\nContent-Length: 851\r\nContent-Type: image/png\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nLast-Modified: Sat, 25 Nov 2023 22:22:05 UTC\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":851,"size_decoded":1110,"mime_type":"image/png","magic":"PNG image data, 88 x 15, 8-bit/color RGBA, non-interlaced","md5":"a74fbb30d38ab2447e052a20e0046ec3","sha1":"003e25898a472b41f9b5156143dfc999330e3b41","sha256":"5b2b83647bfad5c3c3162385b3d90632ebc70d0bb7faa6cabbc1197da529858a","sha512":"d3fa35bb98f963361c7bdecdab0573305e50e951afcdf842283cca3956345d22511c5e50e2225bd705e54b935a2582822581ae61418a7292b335270e00b046e4","ssdeep":"","tlshash":"2301da67730edd7837c1023e6b1553130f354b09e35a612d680971dc7981a24c550569","first_seen":"2026-03-27T14:43:56.155156Z","last_seen":"2026-06-09T09:42:01.756136Z","times_seen":2,"resource_available":false,"data":null}},"time_used":900,"timings":{"blocked":395,"dns":0,"connect":90,"send":0,"wait":95,"receive":136,"ssl":183},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/snow2.png","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:37.453Z","timestamp":1780998097453,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /snow2.png HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/snow.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 7515\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-Type: image/png\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nETag: 6562737b-1d5b\r\nExpires: Tue, 16 Jun 2026 09:41:37 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7515,"size_decoded":8464,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"089e1ede3f10e8236f33476d9cd967f8","sha1":"24e7fd8b20e66effb25fd5e9fb8cdbf88b28917b","sha256":"371322413093c0e1a11ce06c84a634342ed4d45e44f0cf2921a1b28718fff111","sha512":"5222bc56ca39579dd270d9978ecc7eb921a4f4c60b0b7be0cc34aafff5489d8592d98c86a2a6c80df6fcd5991b1ab9e29466a67320a94e46396aeccb42987420","ssdeep":"192:sSDS0tKg9E05TwYUjqdQ1wo/1JrkTvSqVD1A6n:rJXE05EYrdQ1n/vWL5AA","tlshash":"bff16c2bc0f1155fe639ac708ccc4356ff5968fe5b21bd2863c1289d64b96d77a69030","first_seen":"2023-05-17T21:26:33Z","last_seen":"2026-06-09T09:42:01.757104Z","times_seen":30,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/Envy_Code_R_Bold.ttf","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:37.461Z","timestamp":1780998097461,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /Envy_Code_R_Bold.ttf HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/fonts_.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 83856\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-Type: font/sfnt\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nETag: 6562737b-14790\r\nExpires: Tue, 16 Jun 2026 09:41:37 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]}],"data":{"size":83856,"size_decoded":84807,"mime_type":"font/sfnt","magic":"TrueType Font data, 15 tables, 1st \"OS/2\", 27 names, Macintosh, Copyright (c) 2006-2008 by Envy Technologies Limited. All rights reserved.Envy Code RBoldEnvyTec","md5":"1aa885157b7775037d45be1bd13ab1d0","sha1":"63b3b9fcdea37795bb39952850c26b978b97e3ed","sha256":"a2b3225bfa885a66a6d70c234e4e5b35b82c2066e01fe7760bd9a023409be59d","sha512":"d45ad29021c451cfb793a487065976fb7651a82ed19646cab45ddc91e4b95615aa7ad0a43b1ef5269a3a6627789cb7f7fe01c515b9c87dc4ed840a6b70d544ed","ssdeep":"1536:6/1GmhGmipwZvjFJHqU93LEZrLtTeoZOCQ2LQw6nnBf+P:69RhRip+FF0rLteokCQSQw6nnBf+P","tlshash":"2283c4d99ffb9903e6639cf48debc3690a64f40aaee0e44f2805d585c6d33b06547c98","first_seen":"2026-03-27T14:43:56.163547Z","last_seen":"2026-06-09T09:42:01.758147Z","times_seen":2,"resource_available":false,"data":null}},"time_used":711,"timings":{"blocked":41,"dns":0,"connect":0,"send":0,"wait":318,"receive":352,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/favicon.ico","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:37.935Z","timestamp":1780998097935,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 318\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-Type: image/vnd.microsoft.icon\r\nDate: Tue, 09 Jun 2026 09:41:38 UTC\r\nETag: 65627392-13e\r\nExpires: Tue, 16 Jun 2026 09:41:38 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":318,"size_decoded":1280,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 1 icon, 16x16, 16 colors, 4 bits/pixel","md5":"19db67a515f9374e38c4fbabde29c19f","sha1":"e579c76950a737f9ba7d653f34054af88e31f859","sha256":"6e6645c9b944e0244b9df73c3ac262b650468ed247e222d946522c2215f5c2d9","sha512":"10cf2e4584e85c6e70cc4e8ae491634e811be9ff1f3102224f31c88b444a6cb9f2a3fa4f03357beecacac48acabafe30ee3a93521241e4955733df6065797449","ssdeep":"","tlshash":"50e048c123c0cfe3e48821300c0b1bcc2c0140b8c193330ac32118cee8193c80ca59e0","first_seen":"2026-03-27T14:43:56.164344Z","last_seen":"2026-06-09T09:42:01.759083Z","times_seen":2,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":135,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/snow1.png","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:37.451Z","timestamp":1780998097451,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /snow1.png HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/snow.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 3483\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-Type: image/png\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nETag: 6562737b-d9b\r\nExpires: Tue, 16 Jun 2026 09:41:37 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3483,"size_decoded":4431,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"e32dffcfdaaf8db4e69f733895cfa5dc","sha1":"a0a40cde1e811db61417032c59bbfc74cd43b3e1","sha256":"79f9ac506a97d2fe7e5c0186f825683bb7b04c18ce9550b61945d86e649ff5bf","sha512":"271a44f18e017cee33946159b18dc191385e6bfb1f46921a31587c75ed85baf7509c69cb3a88c27fc46da6880094c8dc81b40882b479e6aa97ce062be1f3d2b6","ssdeep":"","tlshash":"b071b370a2a81ef86630464968748c804f20cdbddef7a084255db31b63daabd3dcd5e1","first_seen":"2023-12-15T08:49:03Z","last_seen":"2026-06-09T09:42:01.759996Z","times_seen":15,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-09T09:41:35.429Z","timestamp":1780998095429,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=7200\r\nConnection: keep-alive\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-type: text/html; charset=UTF-8\r\nDate: Tue, 09 Jun 2026 09:41:36 UTC\r\nExpires: Tue, 09 Jun 2026 11:41:36 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nTransfer-Encoding: chunked\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]}],"data":{"size":4130,"size_decoded":5077,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"d8e0daba000697bcf3a9c4814dc8c66f","sha1":"dfcc9b3e39cff9ac92b0174645973a1c6addb657","sha256":"86ee8e465ea92e84a89b73caa4ec5c3b288e4dff46379fb4bbe67a367f261443","sha512":"30dc6167749fe31416140a17613c35fe5549ad718de29865041cb6afad2c42200c5bbf815fbac3abb4425ff9c900e85de162d8cb4424eadc978e1b82ce7e4507","ssdeep":"48:eSGx7HdGgKRguy8i6QKh1twQ7oN4AD9gBVW3EquAWZvlU1d7j+gSDQOf6v4P+UrR:MX4guQ6LhBVyKEXJSxf6vioMWq","tlshash":"b68185fbe988bb3b0384fbce92a13a1ce47345d5c0911c11b6d649dede90e75423a167","first_seen":"2026-03-27T14:43:56.153391Z","last_seen":"2026-06-09T09:42:01.761065Z","times_seen":2,"resource_available":true,"data":null}},"time_used":923,"timings":{"blocked":-1,"dns":563,"connect":88,"send":0,"wait":90,"receive":0,"ssl":182},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/main_.js","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:36.585Z","timestamp":1780998096585,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /main_.js HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 251\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-type: text/javascript;charset=UTF-8\r\nDate: Tue, 09 Jun 2026 09:41:36 UTC\r\nETag: 65627392-fb\r\nExpires: Tue, 16 Jun 2026 09:41:36 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":251,"size_decoded":1217,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text","md5":"45d49efbd814d44c081889cde4cd78c0","sha1":"aaa5fdb3dac29bfd5f7a3bd539020d8a301e3ddf","sha256":"6a22956f1080481802a8549d93801266f0bc46f099ce48823f979cdaac1402e7","sha512":"394acb8b6ba44eca2cfd11cb7c269584e7d09f7a11cf772fc47106d37c4365562bf6d5e12e13fc45d264d3f7f7160b5e33b51088ee148390e470b5ef0469a2be","ssdeep":"","tlshash":"47d017cf1424030032f7a04b8f1b3254222310fa1c8ae8115b484a82392866f633feae","first_seen":"2026-03-27T14:43:56.158268Z","last_seen":"2026-06-09T09:42:01.762Z","times_seen":2,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/style_.css","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:36.586Z","timestamp":1780998096586,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /style_.css HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 5000\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-type: text/css;charset=UTF-8\r\nDate: Tue, 09 Jun 2026 09:41:36 UTC\r\nETag: 692f40cc-1388\r\nExpires: Tue, 16 Jun 2026 09:41:36 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]}],"data":{"size":5000,"size_decoded":5962,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"04646f62ab22e57289dc0db08dac690c","sha1":"591115596c78b71ee8dc1a8ef4514549b41ff83c","sha256":"de0cfe54ad7429d35acfb3286e20e7f3d996800f4db8f16a0ffd991b10f8f6ff","sha512":"52a96644a1e6cb0c2d932f160674f014673eb2333ec655006e046eb858f653eeaa9fce708d1deeff41362323b75a1b7bcd66da60cab97d225756d7dc76a77456","ssdeep":"96:w8aZxFUqR3RNMI8kQY1DMz2+ZMg75L/3W9y3DMMcmYdXLM7:w8aZxF9V/MNvYZMK+CY5jrIMEpLM7","tlshash":"05a165552a063e868e1b8074ffc49ff02e4e0515ad1f4e4ea412b9bde3cc55122f6fa9","first_seen":"2026-03-27T14:43:56.159167Z","last_seen":"2026-06-09T09:42:01.763039Z","times_seen":2,"resource_available":false,"data":null}},"time_used":410,"timings":{"blocked":-1,"dns":0,"connect":89,"send":0,"wait":137,"receive":0,"ssl":184},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/cam/capture-tn.jpg","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:36.592Z","timestamp":1780998096592,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /cam/capture-tn.jpg HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nConnection: keep-alive\r\nContent-Length: 17319\r\nContent-Type: image/jpeg\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nLast-Modified: Sat, 25 Nov 2023 22:21:47 UTC\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17319,"size_decoded":17581,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 640x360, components 3","md5":"fcf80ab1a4b8d0e4859f4cd777ad711a","sha1":"1332b756d101b160b260aec2178929a0a1883041","sha256":"605774eaef5e7b5bed61b5f977ce193f8f8311db4b8b20a7ee50c93557d88b53","sha512":"124d1b7750c698cd4554cee5334dda328f41b596534c0b5d54d4cf1ea4761a3cf8724d171bf5506d509fcdb41e1ad4dd40429c3d489a6021fd15cbe379fca850","ssdeep":"384:5PmlxwfdrNTXpeUVdTzYpGHErj9sJBVZMsMf2cxLLcz:klEdrlXIOdTzSGIjYuPc","tlshash":"f772d006edeb1e26fe65b33f75028a46704dab03d6c174011a8d1ab574ead117fab28c","first_seen":"2026-03-27T14:43:56.154266Z","last_seen":"2026-06-09T09:42:01.764017Z","times_seen":2,"resource_available":false,"data":null}},"time_used":856,"timings":{"blocked":396,"dns":0,"connect":90,"send":0,"wait":96,"receive":89,"ssl":182},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/snow.css","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:37.006Z","timestamp":1780998097006,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /snow.css HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/style_.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 550\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-type: text/css;charset=UTF-8\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nETag: 6562737b-226\r\nExpires: Tue, 16 Jun 2026 09:41:37 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":550,"size_decoded":1510,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"50a6d0c5b3efcf588f5ed68b97796f3b","sha1":"7d0af997e7b15200c6d1346317b7665319232fb2","sha256":"62afef7c43d45538a54c1ca6b5feecd228662364d3499085c05db48437b6ec53","sha512":"baacbbe8e762b5159ae668a4675d8e0f60697b45f2e7e042e7c11e76a1d3dd47bc9cf2eba09d600012edf34622a0e9fb37041c7bd81130a70eee5100c558875c","ssdeep":"","tlshash":"37f0fc4782862486bb57d1720c72061ea53d1516f91b5f2b20f536f0f29e4e457d34f8","first_seen":"2026-03-27T14:43:56.156866Z","last_seen":"2026-06-09T09:42:01.76568Z","times_seen":2,"resource_available":false,"data":null}},"time_used":430,"timings":{"blocked":264,"dns":0,"connect":0,"send":0,"wait":166,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/snow3.png","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:37.454Z","timestamp":1780998097454,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /snow3.png HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/snow.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 5321\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-Type: image/png\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nETag: 6562737b-14c9\r\nExpires: Tue, 16 Jun 2026 09:41:37 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5321,"size_decoded":6270,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"7c969c000622886bb6d86c648626abaf","sha1":"60e9fd6b49edd965992590fd096e41ec3697649e","sha256":"7773a7686d57a0124f8b4446225909e50081d2ae346845f3d587703862b7c9ce","sha512":"2fcaf4461224817a7493e0f1e4053b9a6f3e237143d86fa9d497e14187acf982d3e1cc610126acf2aaafb7f357f1c8fd49e8fee98755e775b160154654e5ebdd","ssdeep":"96:f+mOBDOYubrrrasrrrrrmlU4izkXjIYbGfhYnrrJ3J9VcUdhrrv+0rpvTzdh5Ece:fYDOYubrrrasrrrrrme4iIEYqmnrrJ3+","tlshash":"fab167915d9f7082012fd3ea975b4bed00389efda9c59a1d93469cb814a32f2937dec0","first_seen":"2024-08-20T15:07:42.801851Z","last_seen":"2026-06-09T09:42:01.767048Z","times_seen":4,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/Envy_Code_R_Italic.ttf","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:37.457Z","timestamp":1780998097457,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /Envy_Code_R_Italic.ttf HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/fonts_.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 80240\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-Type: font/sfnt\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nETag: 6562737b-13970\r\nExpires: Tue, 16 Jun 2026 09:41:37 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80240,"size_decoded":81191,"mime_type":"font/sfnt","magic":"TrueType Font data, 15 tables, 1st \"OS/2\", 27 names, Macintosh, Copyright (c) 2006-2008 by Envy Technologies Limited. All rights reserved.Envy Code RItalicEnvyT","md5":"6ee3e0bcab78e682e4077643054b50c5","sha1":"d06de84d3434e5ebaf8b27ed160ec2dbcd3328a1","sha256":"038f17f9bc1cbebf7a0247c391833e0672e4f535f3de4728b448e160c01def75","sha512":"8ce6c775fa45c87960f785504ef782c244a1df2f1e9d7b0e998228de12b3a8be302bdd45d5e424df398f337e95be2c4a1a19de3e0add96b50bfbef108f6c5632","ssdeep":"1536:7+zDupyYupyDyjZS0oLZISkFEbMBdWlnWzAhFEMwbQBZmQ6LEf6MH1fpDt:KSyYSyDyNqLZISk6MzHAhGBKZmQWEf62","tlshash":"f073c3998fff9903fb135df44de7c7580670f01bae20661f2908e691caa72b05547ea8","first_seen":"2026-03-27T14:43:56.162721Z","last_seen":"2026-06-09T09:42:01.768064Z","times_seen":2,"resource_available":false,"data":null}},"time_used":594,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":266,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/Envy_Code_R.ttf","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:37.458Z","timestamp":1780998097458,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /Envy_Code_R.ttf HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/fonts_.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=604800\r\nConnection: keep-alive\r\nContent-Length: 89924\r\nContent-Security-Policy: default-src 'none';img-src *;base-uri 'self';style-src 'self';script-src 'self';font-src 'self';form-action 'self';frame-ancestors 'self' ;frame-src *;media-src 'self';connect-src 'self';worker-src 'self';child-src 'self';require-trusted-types-for 'script'\r\nContent-Type: font/sfnt\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nETag: 6562737b-15f44\r\nExpires: Tue, 16 Jun 2026 09:41:37 GMT\r\nPermissions-Policy: accelerometer=(none), camera=(none), fullscreen=(self), geolocation=(none), gyroscope=(none), interest-cohort=(), payment=(none), usb=(none), microphone=(none), magnetometer=(none)\r\nReferrer-Policy: no-referrer, strict-origin-when-cross-origin\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]}],"data":{"size":89924,"size_decoded":90875,"mime_type":"font/sfnt","magic":"TrueType Font data, 15 tables, 1st \"OS/2\", 27 names, Macintosh, Copyright (c) 2006-2008 by Envy Technologies Limited. All rights reserved.Envy Code RRegularEnvy","md5":"af58fbdcc839dfe69c8365033c3662b7","sha1":"b8bfc57294faf001ce3b5297f045d323cf524d50","sha256":"1b6eeeb2363e77e19e265310d5af35d478f4570b6a61d0fda4638c8214c3632d","sha512":"8477e25149af0c78773afbb811bd6764b8378ccf09b18a7409b05369a383bfa70d5ec2641598041cb5768c9a1617c5e5295d9320229034ac3329708ca41dc2aa","ssdeep":"1536:V/Rujj+ujjxF0aCtnJsDoztZu51Sppit0fGrsmQ6Lbf6MH1fpDh:VZsqsFqZnBKmhfosmQWbf6MH1fhh","tlshash":"ce93d4ea9ffb5d03eba259f44df7872a0aa0f007ae60620f4905d6c0c9d72f05147e69","first_seen":"2026-03-27T14:43:56.166241Z","last_seen":"2026-06-09T09:42:01.769017Z","times_seen":2,"resource_available":false,"data":null}},"time_used":673,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":363,"receive":310,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/buttons/btn-cypnk.png","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:36.594Z","timestamp":1780998096594,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /buttons/btn-cypnk.png HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nConnection: keep-alive\r\nContent-Length: 574\r\nContent-Type: image/png\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nLast-Modified: Sat, 25 Nov 2023 22:22:05 UTC\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":574,"size_decoded":833,"mime_type":"image/png","magic":"PNG image data, 88 x 15, 8-bit/color RGBA, non-interlaced","md5":"f005e5db532484e24f5df92487945f18","sha1":"cece65d82cbe42ea804fbf6181ec5f398b86f53f","sha256":"13a7075eb6baceb04c8ab17bb20bf5c22ea55e30d03443ab60f3dad0eb2df913","sha512":"ed16d901261851dc6953df0ff6c20509f1728598f1fc9568159851323f854892f450834e88ae58bb498303c492a6e7f2add90abc3121b74cae1ae3074f0f290a","ssdeep":"","tlshash":"29f041d678d8c9246aa653a44504730284668eca002b49dbc6fe9d27ff81014400ab0f","first_seen":"2026-03-27T14:43:56.160045Z","last_seen":"2026-06-09T09:42:01.769842Z","times_seen":2,"resource_available":false,"data":null}},"time_used":573,"timings":{"blocked":396,"dns":0,"connect":0,"send":0,"wait":89,"receive":88,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sh2.us/buttons/btn-sh2.png","fqdn":"sh2.us","domain":"sh2.us","tld":"us"},"ip":{"addr":"69.118.39.66","port":443,"asn":6128,"as":"CABLE-NET-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sh2.us/","date":"2026-06-09T09:41:36.596Z","timestamp":1780998096596,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sh2.us","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Apr 2026 06:32:08 GMT","end":"Fri, 10 Jul 2026 06:32:07 GMT"},"fingerprint":{"sha1":"34:E9:BE:F5:D0:6D:E0:A3:B4:DF:55:11:8D:A1:EB:BB:00:BF:E4:85","sha256":"94:BB:1C:90:25:47:C2:92:57:08:C7:CC:DE:2D:DB:FD:AD:F7:70:E0:15:23:17:EA:24:DE:C1:46:82:64:23:8B"}}},"request":{"raw":"GET /buttons/btn-sh2.png HTTP/1.1\r\nHost: sh2.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sh2.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nConnection: keep-alive\r\nContent-Length: 522\r\nContent-Type: image/png\r\nDate: Tue, 09 Jun 2026 09:41:37 UTC\r\nLast-Modified: Sat, 25 Nov 2023 22:22:02 UTC\r\nServer: OpenBSD httpd\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"OpenBSD httpd","description":"","website":"https://man.openbsd.org/httpd.8","common_platform_enumeration":"cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*","icon":"OpenBSD httpd.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":522,"size_decoded":781,"mime_type":"image/png","magic":"PNG image data, 88 x 15, 8-bit/color RGBA, non-interlaced","md5":"e0396619b9d444cc05b752a7b2828d03","sha1":"237954668e5e729caa01cf81f2f8aee11d5651f7","sha256":"f20db4201305d35049f4910c13b1af78a7d62598eeab04a9defd7f312fa81a5c","sha512":"f1d2a744d20da20bcc718d5c0a0628842a1992bf36d9ccaf3c6ac84dabc6dbead1e2ea4863dc1086f92acf852c15779ab33774670cd613e14b2b7ea7a6123afc","ssdeep":"","tlshash":"13f005be53f656904959381e1511e2591f92830d0b30036f2c5e27296f858eeac7d665","first_seen":"2026-03-27T14:43:56.160833Z","last_seen":"2026-06-09T09:42:01.770667Z","times_seen":2,"resource_available":false,"data":null}},"time_used":620,"timings":{"blocked":396,"dns":0,"connect":90,"send":0,"wait":90,"receive":134,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-09","alert":"Sinkholed","trigger":"sh2.us","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}