{"report_id":"d5aad916-9991-4d55-ad2b-2ba7ab6666c7","version":0,"status":"done","tags":[],"date":"2026-09-19T07:20:29Z","url":{"schema":"http","addr":"cowswap.farm/","fqdn":"cowswap.farm","domain":"cowswap.farm","tld":"farm"},"ip":{"addr":"45.134.10.34","port":0,"asn":400529,"as":"Infraly, LLC","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"cowswap.farm/","fqdn":"cowswap.farm","domain":"cowswap.farm","tld":"farm"},"title":"CoW Swap","dom":{"size":53975,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1817)","md5":"66426a4845bd0b27b32f4b8eac5b1efc","sha1":"213c6112be34e3d4ef094d78baa7c2836f1f2a62","sha256":"3b88915fc44109a4c5b4c09f1cec4a20c92c621fefc18d85f944189f0425b91f","sha512":"3fcddd15d6fe1d3d32365a012eddb059bdba237c047dd07e29708f0675a173d080695026ff2ce5ed44965c23403e9e518cf155efb727e1bd1c7f80d56b04d9ee","ssdeep":"768:ya6e4AkBT/qrnvy77POugHJZ4wOO4v9yUzESbeWPRi7EZ:0Bg+POugHJZ4wn4vskhgU","tlshash":"75336f6158f6943b10b3e4d37aa5031f7ae0e617dc474144b2ad4be04fcbea2f96b648","dom_hash":"domhash899706e1a2f5edfaf957189e73846289","first_seen":"2026-09-19T07:20:30.813633Z","last_seen":"2026-09-19T07:20:30.813633Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"cowswap.farm/","fqdn":"cowswap.farm","domain":"cowswap.farm","tld":"farm"},"ip":{"addr":"45.134.10.34","port":0,"asn":400529,"as":"Infraly, LLC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-24T07:20:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cowswap.farm","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-19T07:07:25.173827Z","last_seen":"2026-09-19T07:07:25.173827Z","alert_count":10,"request_count":5,"received_data":201570,"sent_data":2108,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-13T22:43:30.72904Z","alert_count":0,"request_count":1,"received_data":16491,"sent_data":623,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-13T22:43:30.746969Z","alert_count":0,"request_count":6,"received_data":212873,"sent_data":3619,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"cowswap.farm/","fqdn":"cowswap.farm","domain":"cowswap.farm","tld":"farm"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f4f1d1245ea90b56ee37f522264ca8be","sha1":"43fdf24a9995d8229667edcf9d4923e87894ae3f","sha256":"da0caf95c5130858fd07f6c32b220eccc0ceb5e21cd3bb7f1fdc0d34415aa35a","sha512":"81e297f316d10c539d558d511e3f1c38ca48dc5ade13438eb6b79183b02dd88cbfeb0c687d321d58dce7725aad4fc8221783e1a300e9e5a6c492f2ce1b3b7f88","ssdeep":"192:x94bclNPhEQfYOq1iG4YXuNPSUjX9bgtHpiPikC/0vgBV:dzESbqcGvXuNPRBgtHpiPiN0vq","tlshash":"7422505bbdea483105fbdef730925319f96484027c4bd090b69c86a11baae41e47fbdc","size":10729,"data":"","first_seen":"2026-09-19T07:20:30.825285Z","last_seen":"2026-09-19T07:20:30.825285Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cowswap.farm/","fqdn":"cowswap.farm","domain":"cowswap.farm","tld":"farm"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T07:19:58.452Z","timestamp":1789802398452,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: cowswap.farm\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T16:41:48.415874Z","times_seen":18571319,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,500;9..144,600;9..144,900\u0026family=Nunito+Sans:wght@400;600;700;800\u0026family=Space+Mono:wght@400;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:00.983Z","timestamp":1789802400983,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css2?family=Fraunces:opsz,wght@9..144,500;9..144,600;9..144,900\u0026family=Nunito+Sans:wght@400;600;700;800\u0026family=Space+Mono:wght@400;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://cowswap.farm/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 19 Sep 2026 07:20:01 GMT\r\ndate: Sat, 19 Sep 2026 07:20:01 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15807,"size_decoded":1653,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"1dfef9324e1398cdaae0497e92da3149","sha1":"99bf665eb07764f6d67c859b77cf2096bacd3d2e","sha256":"ca596c1cdafa9d2877de15905edd5123e2819f0c0671e2430a8d9c81123cab29","sha512":"df4b44dfb1a62dcd771fb667fa68431aa20c8121246bfa958edd3b539257532134f97aef83359fd364c80540354dc82620be47933992ebf38ed98b36d0760fc2","ssdeep":"384:cE7E3AKNJkv43aKjfevH35KEQtvO3sKhlIvmbe:KwyJkv4KYfevHpnQtvOculIvX","tlshash":"08621090083b9444eb436cc233cf7e36ae5fa1512015d43daffc5899dc9ad2a6365b0e","first_seen":"2026-09-17T20:04:18.697859Z","last_seen":"2026-09-19T07:20:30.817964Z","times_seen":3,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":36,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cowswap.farm/logo.jpg","fqdn":"cowswap.farm","domain":"cowswap.farm","tld":"farm"},"ip":{"addr":"45.134.10.34","port":80,"asn":400529,"as":"INFRALY-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:00.990Z","timestamp":1789802400990,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /logo.jpg HTTP/1.1\r\nHost: cowswap.farm\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://cowswap.farm/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=100\r\nCache-Control: public, max-age=604800\r\nExpires: Sat, 26 Sep 2026 07:20:01 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Tue, 18 Aug 2026 16:27:21 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 53842\r\nDate: Sat, 19 Sep 2026 07:20:01 GMT\r\nServer: LiteSpeed\r\nStrict-Transport-Security: max-age=15552000; includeSubDomains; preload\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":53842,"size_decoded":54242,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"f12844cf2031aa0a4710c9f55bb86629","sha1":"b78791bcbba824a5ec818f0f4ffeeb747f1c5ee0","sha256":"eeef655d80e71d80923f22dce369d7e5bef0cab8343c94cb133860655ab0ea71","sha512":"4ce090b4b917663e9ee22f790b6f7acd6f6e4d3ea3049aec1389e66615ad6ca87d662fcfaf2a4b0ee584488514d18c0e1018c6134004d7a0515e2ed380c65762","ssdeep":"768:Hc5WRPzF2VNZmwxIlW3FRHpvRCJOS0lc6uwBc9V6qIZshvUP2EyHayEXdM:HbRzexIw3Fn8JOScZcXEyHaPM","tlshash":"2833ae07dc44cfa3c59943f5bd276d88ae292b0ce8833bea45934f867aa46317cd7065","first_seen":"2026-09-19T07:20:30.820027Z","last_seen":"2026-09-19T07:20:30.820027Z","times_seen":1,"resource_available":false,"data":null}},"time_used":445,"timings":{"blocked":76,"dns":0,"connect":0,"send":0,"wait":129,"receive":240,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:01.200Z","timestamp":1789802401200,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://cowswap.farm\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30992\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 17 Sep 2026 12:00:07 GMT\r\nexpires: Fri, 17 Sep 2027 12:00:07 GMT\r\ncache-control: public, max-age=31536000\r\nage: 155994\r\nlast-modified: Tue, 16 Sep 2025 13:31:55 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30992,"size_decoded":31805,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30992, version 1.0","md5":"7dc7d01533c963a285fd36c5abbb58a2","sha1":"73ee042eb471294fba713f6ab9f91a93fe464583","sha256":"4608fe39fa0f9651ce629e11e99708914f569823ab37bd9d564fccbec7e1a4a4","sha512":"436bd20867d1a283d586d6911e8c6aa40a1a331ee5a54245c72726497346042843de95ef6d562c755f793e3883aabbb81bc41786a24311015592f1eb0a9be1dd","ssdeep":"768:v0hv0VMEt1jVDpK36ZjTSVKGCz8VfDrJkNuIBvkxyw:v0VEvjnKKZSVY8VfDlafE","tlshash":"04d2f1954aef7208f02917fda3ca015a550610eccbdc5aa5bbe2dca885148614e8f6ed","first_seen":"2025-09-17T00:11:12.784576Z","last_seen":"2026-09-20T17:04:30.939311Z","times_seen":21901,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":31,"send":0,"wait":17,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cowswap.farm/logo.jpg","fqdn":"cowswap.farm","domain":"cowswap.farm","tld":"farm"},"ip":{"addr":"45.134.10.34","port":80,"asn":400529,"as":"INFRALY-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:01.425Z","timestamp":1789802401425,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /logo.jpg HTTP/1.1\r\nHost: cowswap.farm\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://cowswap.farm/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=100\r\nCache-Control: public, max-age=604800\r\nExpires: Sat, 26 Sep 2026 07:20:01 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Tue, 18 Aug 2026 16:27:21 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 53842\r\nDate: Sat, 19 Sep 2026 07:20:01 GMT\r\nServer: LiteSpeed\r\nStrict-Transport-Security: max-age=15552000; includeSubDomains; preload\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":53842,"size_decoded":54242,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"f12844cf2031aa0a4710c9f55bb86629","sha1":"b78791bcbba824a5ec818f0f4ffeeb747f1c5ee0","sha256":"eeef655d80e71d80923f22dce369d7e5bef0cab8343c94cb133860655ab0ea71","sha512":"4ce090b4b917663e9ee22f790b6f7acd6f6e4d3ea3049aec1389e66615ad6ca87d662fcfaf2a4b0ee584488514d18c0e1018c6134004d7a0515e2ed380c65762","ssdeep":"768:Hc5WRPzF2VNZmwxIlW3FRHpvRCJOS0lc6uwBc9V6qIZshvUP2EyHayEXdM:HbRzexIw3Fn8JOScZcXEyHaPM","tlshash":"2833ae07dc44cfa3c59943f5bd276d88ae292b0ce8833bea45934f867aa46317cd7065","first_seen":"2026-09-19T07:20:30.820027Z","last_seen":"2026-09-19T07:20:30.820027Z","times_seen":1,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":119,"send":0,"wait":119,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"cowswap.farm/","fqdn":"cowswap.farm","domain":"cowswap.farm","tld":"farm"},"ip":{"addr":"45.134.10.34","port":80,"asn":400529,"as":"INFRALY-LLC","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T07:20:00.145Z","timestamp":1789802400145,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: cowswap.farm\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=100\r\nContent-Type: text/html\r\nLast-Modified: Tue, 18 Aug 2026 16:27:13 GMT\r\nAccept-Ranges: bytes\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\nContent-Length: 10862\r\nDate: Sat, 19 Sep 2026 07:20:00 GMT\r\nServer: LiteSpeed\r\nStrict-Transport-Security: max-age=15552000; includeSubDomains; preload\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":38477,"size_decoded":11229,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (322)","md5":"06640ca541430513de0c4b766544cc57","sha1":"4141ba6a808ff7dd272c695b77a1147c7bab665b","sha256":"9f2618f7db3917b748c5d7691a774149d045f40e2968d384a9319e1a9ba44edf","sha512":"1cc9b5511a75f8b182b3c2495dee1cb73ff279f949b1a0c3aa166ad23b31b035cf8529b8c97b62d89f50f87f0e11617add61decf265333667f8390d43178c962","ssdeep":"768:16e4AkBT/qrnvy77PONKYZ24vJyCzESbeWPRi7Ed:MBg+PONKYZ24vwehgU","tlshash":"4a03d7616ce6503a14b7e6937bc1075eb960d013dc078598b2de8aa14fc3ff299bf648","first_seen":"2026-09-19T07:20:30.822407Z","last_seen":"2026-09-19T07:20:30.822407Z","times_seen":1,"resource_available":true,"data":null}},"time_used":495,"timings":{"blocked":-1,"dns":254,"connect":121,"send":0,"wait":119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:01.202Z","timestamp":1789802401202,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://cowswap.farm\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30992\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 17 Sep 2026 12:00:07 GMT\r\nexpires: Fri, 17 Sep 2027 12:00:07 GMT\r\ncache-control: public, max-age=31536000\r\nage: 155994\r\nlast-modified: Tue, 16 Sep 2025 13:31:55 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30992,"size_decoded":31805,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30992, version 1.0","md5":"7dc7d01533c963a285fd36c5abbb58a2","sha1":"73ee042eb471294fba713f6ab9f91a93fe464583","sha256":"4608fe39fa0f9651ce629e11e99708914f569823ab37bd9d564fccbec7e1a4a4","sha512":"436bd20867d1a283d586d6911e8c6aa40a1a331ee5a54245c72726497346042843de95ef6d562c755f793e3883aabbb81bc41786a24311015592f1eb0a9be1dd","ssdeep":"768:v0hv0VMEt1jVDpK36ZjTSVKGCz8VfDrJkNuIBvkxyw:v0VEvjnKKZSVY8VfDlafE","tlshash":"04d2f1954aef7208f02917fda3ca015a550610eccbdc5aa5bbe2dca885148614e8f6ed","first_seen":"2025-09-17T00:11:12.784576Z","last_seen":"2026-09-20T17:04:30.939311Z","times_seen":21901,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":31,"dns":0,"connect":0,"send":0,"wait":22,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/fraunces/v38/6NU78FyLNQOQZAnv9bYEvDiIdE9Ea92uemAk_WBq8U_9v0c2Wa0KxC9TeA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:01.242Z","timestamp":1789802401242,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/fraunces/v38/6NU78FyLNQOQZAnv9bYEvDiIdE9Ea92uemAk_WBq8U_9v0c2Wa0KxC9TeA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://cowswap.farm\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 67304\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 16 Sep 2026 10:33:21 GMT\r\nexpires: Thu, 16 Sep 2027 10:33:21 GMT\r\ncache-control: public, max-age=31536000\r\nage: 247600\r\nlast-modified: Tue, 09 Sep 2025 18:43:20 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":67304,"size_decoded":68117,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 67304, version 1.0","md5":"069cb90e11a337bf264eadfb15ad00f5","sha1":"48642176d960affe01a1a57fc8179e05c618793d","sha256":"7234ed860a9cc83045413c4faee63c960a8f2d1917adcf728119307d56e0d783","sha512":"1c076a1b528a83e283f57d408c8e4f0a629b8daa47e8e10e2607fa26e346b7ea5ad1d237f815be91b553adfe644227877cb4693d1db9568028b6c2c68ed3f1d2","ssdeep":"1536:suAREpsv3Xf8UR8UX2S6teGGD7BhviSVDQ2AV4QnsKBn3Fa9dT1G5w6:GdPXzeUX2S60GGD36uOZFATM","tlshash":"d663020d07b99b3c436f5c9319b2ede92e2ea41b2486f045feb7b891e4405c591bcc97","first_seen":"2025-01-24T12:50:21.10871Z","last_seen":"2026-09-20T16:28:48.59452Z","times_seen":7628,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:01.243Z","timestamp":1789802401243,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://cowswap.farm\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30992\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 17 Sep 2026 12:00:07 GMT\r\nexpires: Fri, 17 Sep 2027 12:00:07 GMT\r\ncache-control: public, max-age=31536000\r\nage: 155994\r\nlast-modified: Tue, 16 Sep 2025 13:31:55 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30992,"size_decoded":31805,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30992, version 1.0","md5":"7dc7d01533c963a285fd36c5abbb58a2","sha1":"73ee042eb471294fba713f6ab9f91a93fe464583","sha256":"4608fe39fa0f9651ce629e11e99708914f569823ab37bd9d564fccbec7e1a4a4","sha512":"436bd20867d1a283d586d6911e8c6aa40a1a331ee5a54245c72726497346042843de95ef6d562c755f793e3883aabbb81bc41786a24311015592f1eb0a9be1dd","ssdeep":"768:v0hv0VMEt1jVDpK36ZjTSVKGCz8VfDrJkNuIBvkxyw:v0VEvjnKKZSVY8VfDlafE","tlshash":"04d2f1954aef7208f02917fda3ca015a550610eccbdc5aa5bbe2dca885148614e8f6ed","first_seen":"2025-09-17T00:11:12.784576Z","last_seen":"2026-09-20T17:04:30.939311Z","times_seen":21901,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/spacemono/v17/i7dMIFZifjKcF5UAWdDRaPpZUFWaHg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:01.244Z","timestamp":1789802401244,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/spacemono/v17/i7dMIFZifjKcF5UAWdDRaPpZUFWaHg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://cowswap.farm\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 16724\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 18 Sep 2026 17:36:13 GMT\r\nexpires: Sat, 18 Sep 2027 17:36:13 GMT\r\ncache-control: public, max-age=31536000\r\nage: 49428\r\nlast-modified: Wed, 25 Jun 2025 16:58:05 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":16724,"size_decoded":17536,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 16724, version 1.0","md5":"e5e908997a453e21f2fe41cb72e186d2","sha1":"d0c504bd8f896d39883e0ddfc81c511af526656b","sha256":"2d46bd159b53f55c41167a4f1540a074649464194fd1e416f5b4694a6c0f282c","sha512":"dd6bf730a4b16a50b0977b2d8efe865be0805da41c50aa86d39b4892c79db91f354e91b1a2ce4198e4b58e26752d4e9a06e33e9911e63f2df2e004d610685cd8","ssdeep":"384:ZRyfvfqIrJOZA3s5dQsQLR7JIWapcGsukRYRv5fpD:ZUXfNs5IRQ3zkCZ5fpD","tlshash":"8f72d0b8fe064610c2542fbf06209de1831895fe192e4f24f8aa74ac4f1715e3f117ba","first_seen":"2025-02-19T12:54:04.600022Z","last_seen":"2026-09-20T13:19:34.978156Z","times_seen":3478,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:01.246Z","timestamp":1789802401246,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://cowswap.farm\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30992\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 17 Sep 2026 12:00:07 GMT\r\nexpires: Fri, 17 Sep 2027 12:00:07 GMT\r\ncache-control: public, max-age=31536000\r\nage: 155994\r\nlast-modified: Tue, 16 Sep 2025 13:31:55 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30992,"size_decoded":31805,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30992, version 1.0","md5":"7dc7d01533c963a285fd36c5abbb58a2","sha1":"73ee042eb471294fba713f6ab9f91a93fe464583","sha256":"4608fe39fa0f9651ce629e11e99708914f569823ab37bd9d564fccbec7e1a4a4","sha512":"436bd20867d1a283d586d6911e8c6aa40a1a331ee5a54245c72726497346042843de95ef6d562c755f793e3883aabbb81bc41786a24311015592f1eb0a9be1dd","ssdeep":"768:v0hv0VMEt1jVDpK36ZjTSVKGCz8VfDrJkNuIBvkxyw:v0VEvjnKKZSVY8VfDlafE","tlshash":"04d2f1954aef7208f02917fda3ca015a550610eccbdc5aa5bbe2dca885148614e8f6ed","first_seen":"2025-09-17T00:11:12.784576Z","last_seen":"2026-09-20T17:04:30.939311Z","times_seen":21901,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cowswap.farm/logo.jpg","fqdn":"cowswap.farm","domain":"cowswap.farm","tld":"farm"},"ip":{"addr":"45.134.10.34","port":80,"asn":400529,"as":"INFRALY-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://cowswap.farm/","date":"2026-09-19T07:20:01.427Z","timestamp":1789802401427,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /logo.jpg HTTP/1.1\r\nHost: cowswap.farm\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://cowswap.farm/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=100\r\nCache-Control: public, max-age=604800\r\nExpires: Sat, 26 Sep 2026 07:20:01 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Tue, 18 Aug 2026 16:27:21 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 53842\r\nDate: Sat, 19 Sep 2026 07:20:01 GMT\r\nServer: LiteSpeed\r\nStrict-Transport-Security: max-age=15552000; includeSubDomains; preload\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":53842,"size_decoded":54242,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"f12844cf2031aa0a4710c9f55bb86629","sha1":"b78791bcbba824a5ec818f0f4ffeeb747f1c5ee0","sha256":"eeef655d80e71d80923f22dce369d7e5bef0cab8343c94cb133860655ab0ea71","sha512":"4ce090b4b917663e9ee22f790b6f7acd6f6e4d3ea3049aec1389e66615ad6ca87d662fcfaf2a4b0ee584488514d18c0e1018c6134004d7a0515e2ed380c65762","ssdeep":"768:Hc5WRPzF2VNZmwxIlW3FRHpvRCJOS0lc6uwBc9V6qIZshvUP2EyHayEXdM:HbRzexIw3Fn8JOScZcXEyHaPM","tlshash":"2833ae07dc44cfa3c59943f5bd276d88ae292b0ce8833bea45934f867aa46317cd7065","first_seen":"2026-09-19T07:20:30.820027Z","last_seen":"2026-09-19T07:20:30.820027Z","times_seen":1,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":0,"dns":0,"connect":119,"send":0,"wait":119,"receive":238,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"cowswap.farm","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}