{"report_id":"d7d4939c-de80-4e1d-8905-5385e77a294f","version":6,"status":"done","tags":[],"date":"2026-01-31T19:46:54Z","url":{"schema":"http","addr":"www.auth-s1.co/","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"172.67.129.168","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"www.auth-s1.co/","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"title":"Plasma","dom":{"size":1311,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (1097)","md5":"2814cda5dceabf9e2594ba7af6c2238a","sha1":"a22b7209b41ced45b47b3accfddf212784d9ac4d","sha256":"a77769614e5faa7c90ff780a5d06ea52ef1f306f60de82ac13a39f431c947640","sha512":"110519ef7261526808d35df1f24aa5a690ab13653f2b375fe23582d74867d713abd2e060dcc32b30200a175842ed5c4f05cb7a92769f4043a9ff101025bf3836","ssdeep":"","tlshash":"c0210f7bac02e8cc125199cfe937b46cd047a55ddaa9bd50f9ed06672084fa88c1246d","dom_hash":"domhash7d3dbf120df35b365369d1574de048db","first_seen":"2026-01-31T19:46:59.379056Z","last_seen":"2026-01-31T19:46:59.379056Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"www.auth-s1.co/","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"172.67.129.168","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-07T19:46:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.auth-s1.co","ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":84,"request_count":42,"received_data":873670,"sent_data":18934,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Webflow","description":"Webflow is Software-as-a-Service (SaaS) for website building and hosting.","website":"https://webflow.com","common_platform_enumeration":"","icon":"webflow.svg","categories":["Page builders","CMS"]}]},{"fqdn":"cdn.prod.website-files.com","ip":{"addr":"104.18.160.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-01-23","domain_rank":20159,"first_seen":"2023-11-01T22:05:38Z","last_seen":"2026-01-26T05:56:47.816082Z","alert_count":0,"request_count":1,"received_data":302246,"sent_data":504,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.auth-s1.co/","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"0e9e3ad57abeefde87342864450cc232","sha1":"4dc8676bf3417d597053d5f253fce034007f63da","sha256":"9a37601d1f5a5f2fba3b000694d4bf5e035c606d5485dd94e2997cbe2efe5c26","sha512":"b2d8e0e883fc8af91de120565298502b6e5b0f6e20275ecd2974de3e768a19a443f7facc2127201df66725c20451b924a69eaab78224073e385f14a5431c3a6c","ssdeep":"","tlshash":"34c0123621525559045b3d04a66ba14a758791b2a9025401dc7ee5a0311bc9aad0255e","size":181,"data":"","first_seen":"2023-03-07T01:17:43Z","last_seen":"2026-08-11T00:14:56.212639Z","times_seen":59599,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cdn.prod.website-files.com/686294612d064c19739f718e/6876260a681afcbedc81838d_first-frame%201.jpg","fqdn":"cdn.prod.website-files.com","domain":"website-files.com","tld":"com"},"ip":{"addr":"104.18.160.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.755Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prod.website-files.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 22:38:30 GMT","end":"Sun, 08 Mar 2026 23:38:26 GMT"},"fingerprint":{"sha1":"E1:F9:29:6C:56:57:15:B2:B3:5A:24:3E:50:03:94:B8:56:24:45:58","sha256":"D3:5A:81:E7:72:42:57:B7:FA:3C:C6:F7:CA:F5:06:4D:4C:20:11:11:40:37:24:F1:12:2C:AC:A4:5F:03:68:0B"}}},"request":{"raw":"GET /686294612d064c19739f718e/6876260a681afcbedc81838d_first-frame%201.jpg HTTP/1.1\r\nHost: cdn.prod.website-files.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 301560\r\ncf-ray: 9c6bb73ad913b518-OSL\r\ncache-control: max-age=31536000, must-revalidate\r\ncf-bgj: h2pri\r\netag: \"f2ecce4bacf7dbfd2537ce4149f5de45\"\r\nlast-modified: Tue, 15 Jul 2025 09:57:31 GMT\r\nx-amz-id-2: y+oilXBNotT02EfJrIISzEWEgWilMkcoEs8sKmOIB08PA+y93/JbpGTVxBU3biH+AjS1QT7Feb0=\r\nx-amz-request-id: F911T39C2WRCRTFG\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: YMiTmumYrhS0FE9g8jF02n3NRyS_0ndb\r\ncf-cache-status: HIT\r\nage: 3477389\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":301560,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1080, components 3","md5":"f2ecce4bacf7dbfd2537ce4149f5de45","sha1":"8064bf172b5721d47de34220c583ba73e0e1e911","sha256":"61652f174eb79996ecfa6740b8b12f21ac1bbba9f10b883f48efd60a9e554b47","sha512":"af944a4d0a9b734bc74cebd18198eb3ca697d361f0c49aa4c5eee3fd934583e48a329df107c58343d3e2df281a8468a1e14a952be44c289923e02863e585ed96","ssdeep":"6144:QC0qm9JIGa3TyxYhVIefCeugofQJtdnj+mTVSBroU5oM/:QC0qx93TMYhVRfCOx5IoUv/","tlshash":"405423bdbedb171db8e22af3a940ffa90f48d0695fb91491210745c43a010d8a675fda","first_seen":"2025-09-25T11:47:30.122161Z","last_seen":"2026-05-02T14:41:38.365938Z","times_seen":28,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":14,"dns":20,"connect":1,"send":0,"wait":25,"receive":15,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/68762d4ac364502c1ae1929f_Frame%201597880415.svg","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.756Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/68762d4ac364502c1ae1929f_Frame%201597880415.svg HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aPTQkiCxLYC09KQSYwgZwIRZSFNoQynyHO7lwcnGUNF9GfEz9Rd7AeWf3dmjVLBZV5by9IKQRJnytU6yInoXS%2BOQSqA2azKLJ0xaxA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"390-63b763a7eec1e\"\r\ncf-ray: 9c6bb73a8c95712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":912,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ef49adf107f5903169093ed1e1c99015","sha1":"3b6561f61c71f38747df7cd5a5aeb0e877f307ce","sha256":"99f3c8ac894edff3bf8b0356ca4f7b8714b21c9323b0fa9928437e6983e7084a","sha512":"b85eccd5abb1c9c65390f070fff65893311a9585df0d608fa542eca187da9eb88ae3630f7e07cb217d9bb1f53f2d286882322056a9d001fc90aed8be802c944c","ssdeep":"","tlshash":"e611c0f02208c329cd045729839e64d8067ef2d4714e1179fbd2bb562f1a4ae78b52ee","first_seen":"2025-09-25T11:47:30.092415Z","last_seen":"2026-05-02T14:41:38.302185Z","times_seen":28,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/N2Q7XZTsdtcE.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/N2Q7XZTsdtcE.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"971-63b763a81e9bd\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 2417\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nlyWbQHd5PXM%2Bvra47egV7mUd6lTMuHBj%2BTANvlhYgz2FAfbjxsptbMQs60BckH5ty251PlxCHa6HGi%2BQ%2FJlZc6bcfOkeIaYWy%2Fu0g%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a9c9c712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2417,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"2b614daa4251e1e8719801e55bdcce6b","sha1":"dee1e9e1401071ecf30d66a0f982f62eff4f328a","sha256":"a3fbc32344e71ea6d8ab208bd8980e3a53eb22d2e1f9f92dc1e2abd8adce5619","sha512":"3a88621503569abc6f4a280cd727c123420e9dc11715825d4109644c470b0facb62c0b365d4a849b0f6ccf06d29ef422ab333757c04c9f777cc62af773edbddb","ssdeep":"","tlshash":"dc4166c8ed00665ab6afd957bc8ac17ac0d5d328a065bd24a86902d4cf0b7783f0d1b7","first_seen":"2026-01-31T19:46:59.388622Z","last_seen":"2026-01-31T19:46:59.388622Z","times_seen":1,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/js/Y5dM1y0rBBL7.js","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.788Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /js/Y5dM1y0rBBL7.js HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"15d84-63b763a760ab1-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncontent-length: 30910\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xuItziABVK5SJn1NI9b1a9sNyr3t7tmyjuEccekIpQ9C9BF5wKtR%2BAY1q6aNf%2FcRslCJTYODcFmuHKwwQbTfYHysWQJr0htQ1p8P%2Fg%3D%3D\"}]}\r\ncf-ray: 9c6bb73abcba712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89476,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-11T00:14:56.205494Z","times_seen":266237,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":68,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/js/Nu2ZIsoLKrq0.js","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.792Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /js/Nu2ZIsoLKrq0.js HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"14322-63b763a75fef9-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncontent-length: 24927\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dC81R99CEGluNNuc8CHZ9fvuQpDGPIiVqpuyP9ORXS9OdXRa4J0Vd7eQZvNSvFmu%2BoWQ09yLeLM3MNZyoGVuPgZPJI4eoGMo%2B%2Fo53w%3D%3D\"}]}\r\ncf-ray: 9c6bb73abcbe712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":82722,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"55b4cdc56ecb4922799f7907695dfeae","sha1":"ba646b84505cb5fb75f343efd833e931d7e70a18","sha256":"118af9210b8c030669669d108eaf4d80b3cf40aefffe43b424e59a6d288e9bc5","sha512":"34cc3bb5ecd43461e57481f87d5a7d9e78f7cf01546058f6b1e5219452e8e4f9cb979f2c4fcc6a90702acb0dc5b684d114d90e2cbb05fd96fc09d2898498e0b8","ssdeep":"1536:jDimNLyyYwDX6hMrl3OOIrvfmB6/2cpfFabS5w1RY4QCbAey:R7vZdwulLdy","tlshash":"8683c5e932d2f5b543af116a503f104ab23e48da641c5050e774ccdebd348a992bbfb9","first_seen":"2026-01-31T19:46:59.392984Z","last_seen":"2026-01-31T19:46:59.392984Z","times_seen":1,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":71,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/k3U0cg1dVXtK.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:34.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/k3U0cg1dVXtK.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:35 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"3e0-63b763a81ab3d\"\r\naccept-ranges: bytes\r\npriority: u=6,i=?0\r\ncontent-length: 992\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FKvIRu6ldmTFuR5cYyyBhgwzpFZFL8GcWlKLn4qZ5%2Ffbh7f1WtCENoniMTebsuffl3Mu91xfkflXkLkhzWYOq6VqJVXZ6XaXJ3LrUw%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb748adbe712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":992,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"29052428bebee9999d324afda52b3a1c","sha1":"75f901f8efbae139817fa7e7916c20b3091109f0","sha256":"a6f535d3742937ec28471af64263388a7a3d83650aea4f59ba902942920e8ec8","sha512":"6b5558c1d16b688d63d141fd6f34a8719614ad2311c3f83553c088e534e05bb2b9f6d09b9b18f5b1b9c2781350b8bb7a7040f6e1ef5669c98267be3308270af5","ssdeep":"","tlshash":"5511a5fa9bbae833b85e883976ed972516360c19436072bcd5d95120154e1f2e5c03d1","first_seen":"2026-01-31T19:46:59.396012Z","last_seen":"2026-01-31T19:46:59.396012Z","times_seen":1,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/css/gTxtzgKuTKhG.css","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.733Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /css/gTxtzgKuTKhG.css HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"173a2-63b763a74fd29-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncontent-length: 17310\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SZdowdWhf6kg4MRx9n2h%2FsJfkISN1%2Fm82pEnlSI%2BFScJgjqzeVqPxc9FnxivLCTOJxdQJVbyRrc5FL4YvGDrNBrobcUTWuB7tC3X7Q%3D%3D\"}]}\r\ncf-ray: 9c6bb73a7c90712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":95138,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (2587)","md5":"bca2eb6883f88ea640967c313dfcf2ec","sha1":"d2dc5d51155a4c7f9af4da3508645ce59a3b983e","sha256":"160f102fe353497d182bc5a24fb348d19470500ebe62f067b7749c23d7207080","sha512":"23e41afd80c19798afe2831910f58601ee3148f971c45c1cca408ba05a15b9d36531f8c9c85bb2a7ee72629edf178fdfcaa8aa073d7b9e6209f990ccaa02be8f","ssdeep":"1536:Aye1REeqyP0XcPyjowKjda+i9znAbzeEI:OAyP0XcPyWKuw","tlshash":"f6939456a6f015b8781b607a6edae344772c60838a1dcfd86df16045dfc82e674b2bcc","first_seen":"2026-01-31T19:46:59.398174Z","last_seen":"2026-01-31T19:46:59.398174Z","times_seen":1,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":62,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/68762d4ac364502c1ae1929e_Frame%201597880416.svg","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.759Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/68762d4ac364502c1ae1929e_Frame%201597880416.svg HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J7xL7eGJEkWoaqU6BcuwP9GkheIoLqjlTgFT%2BHqCPtvMsqUvXuParuGbyPBm3Ns%2F3ZffmtTYuU%2BbR1G5VabWPU0CuOjOGDf%2FJdtDmw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"7cd-63b763a7edc7e\"\r\ncf-ray: 9c6bb73a8c99712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1997,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b79d7bce218ed9fea042d23740427627","sha1":"ad1a2a8b32187d9ad0144d8f7cfb20cf8bfac10f","sha256":"49f9a34ac7a227f23cc0e69eb8408a3ea0434fd84e5a5b61669d72869271e512","sha512":"a5e563bb1c1a70775dcad2917b58a982c117950c0f42ee05525bde082b05fcfbc54d280af8ea355d5f3aa5bc3c8279c96c027a9ad75e181c4b0f089d7e7fa06e","ssdeep":"","tlshash":"7241f084427be3f4b662e0fe497756cabe6e54e06349d0b9c3503d8295031b664e21ef","first_seen":"2025-09-25T11:47:30.144594Z","last_seen":"2026-05-02T14:41:38.396223Z","times_seen":28,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":141,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/M4bVVVw00O8P.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/M4bVVVw00O8P.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"b05-63b763a81bec5\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 2821\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H1%2FGH42E1rKtdGETAG4fehSzlGHhj9dTDeiaYP8fTyeitCxc9QNsqzGfUgOvJjQAFGboD10Kw5l%2FFXdCN%2FJujdyvaHO7e2djc4JwhA%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a9ca0712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2821,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"e1ecd5f42131755f559914781511b7a7","sha1":"767f5c3970d4c9ff45c3528b844d3c0805025506","sha256":"6493894fcea7f306978dcbadce9d6d1c877f15d0763189f7dae2f76264bab644","sha512":"913c686504204310e4492e6b024651a61e98c504875a2cdbeba7d6cf782953b54119d981310da89361e78ada47b324f279bca482a28670f3b46b55f9b608c14f","ssdeep":"","tlshash":"4551f4c8fd14660b72aaed57fd8ac12ed1c0c36db025b425f83956c49b5b7793b081a3","first_seen":"2026-01-31T19:46:59.404213Z","last_seen":"2026-01-31T19:46:59.404213Z","times_seen":1,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/68762d4ac364502c1ae192c8_Indonesian%20Rupiah.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.774Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/68762d4ac364502c1ae192c8_Indonesian%20Rupiah.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"21d1-63b763a7f7ca5\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 8657\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U728F%2Fihm%2FmFLGlHIw5TIqcBb7KGSkOFrd6iPuoc1dBDILaqpySEyUz%2B7OrPIjJyAHIoVkp830NQKmkpoJ0KLEcYoDMncjJ0iDAZ3Q%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73aacab712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8657,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"d819ad51bbbaba7c0eced8de2dd79e48","sha1":"64d45b42f704761de11adae6a06602ca86a5cb87","sha256":"94024e29583717647b2ec1ffd13da1eb90294180aaa985565933e83e5c65133b","sha512":"7e3c7156014142f6d9a5394b0392716fbe9cb55382e96c000f1090e736be408c54182a3a906dd1328bab427e40d1d8e65e85e81ed1d21f5cbc1b2586b420f22c","ssdeep":"192:2o0byEzmO0YnT0tsZyOePppOe78dcVqjs3pDTvSXU+:2oimOjTyTHppO1mVqjsZDv+","tlshash":"6402e4e43361b0fb81c410b8c21d4178741e52aeef705579de1790a98899cedcabfa8f","first_seen":"2026-01-31T19:46:59.406655Z","last_seen":"2026-01-31T19:46:59.406655Z","times_seen":1,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/29CLldYn8gL6.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.778Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/29CLldYn8gL6.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"4fd-63b763a7ea1e6\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1277\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1uarqduoaI%2BC5eS8CPDdpxRgO%2F1JYiWxcqdqZnRw45USM7wcTIBGXr%2B3z36IsPQu3airi9jvlabwKH%2BrMpr%2B%2BWx7hmA7bzzHdaNzWA%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73aacb0712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1277,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 480 x 208, 8-bit colormap, non-interlaced","md5":"c315b32913d9fca8d1ec86896ae303ce","sha1":"b36e88a64acfaa2c948b6cfa0bb7e9eceb320c25","sha256":"077bbda9b6532c1dcc791e34c071f1cc3600b77da464ae2d95585c886959b866","sha512":"b0bb5386c9a551a25ca0c7c3c3e8555d66bdf8c086e3e2fb13dee046544a350cb1c3e2288d561940464402010b36822bdeb0ffe9f6ded9f271540bd859681265","ssdeep":"","tlshash":"de21c6d9a13a6c31e8237bf69747aa2cc8921dae56f70589420f794d7d3024380283d6","first_seen":"2025-09-25T11:47:30.083656Z","last_seen":"2026-02-13T23:06:26.81129Z","times_seen":8,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/sjaw7uaCbM5u.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/sjaw7uaCbM5u.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"484-63b763a82a924\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1156\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JeAFTwk0MtvY47%2Fg4PfkcE0F9djt5woZtaOCT0oPKw8NssSj6z%2B9mGMcIx%2FUgnWh1HtHGqDm97VOuotqvMCeDfV4irIWsFaFQfztXQ%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73aacb3712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1156,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 520 x 208, 8-bit colormap, non-interlaced","md5":"fec5ae8832de15660a502d400eee2509","sha1":"d5c827dacff2954e2efbb104223d1b34bb0ff3a0","sha256":"da06061211f3fb47bf698189b3a2cb8295088b1032221c287f6aafd2522237d9","sha512":"e354a5d3ed224f7f921e6a5cc79972235dfbb910063d1147360442b24735e3c8ff41037a37299b93905201f4f0359113fd63577c2ae0d89b68c38da30abf4d17","ssdeep":"","tlshash":"3421a55c8f73fa6ac50a22b0c0e4385a1eb1731a25fc2cc7f01c87699da461a9054b6f","first_seen":"2025-09-25T11:47:30.153624Z","last_seen":"2026-02-13T23:06:26.814809Z","times_seen":8,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/d8VVDBLhEWEw.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.785Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/d8VVDBLhEWEw.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"40e-63b763a811ab5\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1038\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BK0U1SbQ3IIpCNLl72ErSRBczCGqD9NOXKsNC30zS1fNDfgttD37IcC%2BVffNf1ux%2FM6scDltyI6oZurXpbd0CgB209AqWTZkYSNi4w%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73abcb8712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1038,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 208, 8-bit colormap, non-interlaced","md5":"7c0de0b9443c40da94251aac88ecd080","sha1":"ae3b8e356c050c3ccd87686e315b8a0c1488ea50","sha256":"0111295ddb2c3315486f27b56f1430ada2cc9f6a6d56380b42647182a093dc29","sha512":"bed55e8424a5b21afc05bf9047db888af9de56fcf1e29f53db89d25266b00d5dcfcad0a6548e3b764c0570d6fdfc1a0e983a5df412882847f120b7bbbe62fb8e","ssdeep":"","tlshash":"3411c8204b95c8fdc22adeb9333430108dd20d3a6d829a67e009fd3cc53980f56a87f6","first_seen":"2025-09-25T11:47:30.129662Z","last_seen":"2026-02-13T23:06:26.891558Z","times_seen":8,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/css/k1vFUKuLEzWy.css","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.751Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /css/k1vFUKuLEzWy.css HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"234f-63b763a7504f9-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncontent-length: 2563\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S2yfBUfsaGO3u1BHVIqRSO56XEN%2FKqxKFrgm1MiPt2husp8Tesieqou4pa0h0btrjQSIiSgT4Cnj%2B0vDKZ5FvGs8sH4w0UvnUjf8Mw%3D%3D\"}]}\r\ncf-ray: 9c6bb73a8c94712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9039,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (9039), with no line terminators","md5":"c1289b2731893f5781c12cf4d64f40a5","sha1":"31476ff30878a14c4ce487f951983e755a7e6b98","sha256":"1b7536948a68e7dd8f9ccd2a859dea923eb65f7b238256fb1d9efcbb08271ffb","sha512":"2e38b0a1eb65d0b30bf3c7d2c8dbb05675106ec60c53fbac373d4612cac947a05d05d6dd20f34ad6e565e7bedf3019b9fd099a3eff2558ec87661740b0ec6ebe","ssdeep":"96:tqIvqEjeT7zu7fRt6NSsvEFZq5O+XE7xXArqTyAz3GPjTvqU29Ts8P5KpI9cKM2M:tqICEj17fRt8S/q5O+ExTy43eC9TPF38","tlshash":"5112b5ed633190fe0403481b19d5a2449831e1c2df6a16dd7677bb88c3ca3fb526aa5f","first_seen":"2026-01-31T19:46:59.417278Z","last_seen":"2026-01-31T19:46:59.417278Z","times_seen":1,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/68762d4ac364502c1ae1928d_Frame%201597880471.svg","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/68762d4ac364502c1ae1928d_Frame%201597880471.svg HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T3IiVE2gagwRNgosTKAGkAudpIXOkNjiawWUgCnkFpVuonsUB54vsiza4LP9BCzpEJgksjuk%2FRz5TEMudDAa6w35SGVeZAkVzMIjeA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"5f0-63b763a7ebd3e\"\r\ncf-ray: 9c6bb73a8c97712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1520,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"51efe4baa4d6e57864d811945000e523","sha1":"28d83b093f9f9e0c5b6f864e97a9eed2c44a9a00","sha256":"ee3befd701c2984849c23030080b84b3fbb4b676da9a4084290d046638511fa2","sha512":"84ea753fe14152b3c73ab2898ac67ff0c1492e3a4d948a7404f41bcc6d928b365e11679ea516be1bc31e1898794b77fc92157ad0dfc268338c5ba48e4e7f1991","ssdeep":"","tlshash":"fc3112e505669308f443b37ecb3c20d5db9da8c447c88cba53263a773e46269f9640c4","first_seen":"2025-09-25T11:47:30.114188Z","last_seen":"2026-05-02T14:41:38.357241Z","times_seen":28,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":128,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/H0w93laIp80p.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/H0w93laIp80p.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"b59-63b763a816cbd\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 2905\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kgc3UYeodhjKAixktBHHU%2BWBJ6lzIgVMw7wXUJbtZ%2F0cPlakBy0B6ukN%2BUxb3z6ImPdGD3PYvBSujU8zmL6YJcU%2Bk9ls0bS0rJox0Q%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a9ca7712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2905,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"8eb687b3b5158e70ab1d62a2c7c8d59c","sha1":"eabbdd3896aa1c413ffe0831a27f091c169a4009","sha256":"806e0f42811f60b6e12aa36c33e4af15f1cde3f70793dcfb8698c1e0723d038b","sha512":"536d0b872d40ab6b98da94df7372674fd63db7cd78514bedc90fcf5914a859d7f465e5398b7593bf089f7c72e19f48a67d05557d7fe4fddce8a5637944ef0a21","ssdeep":"","tlshash":"c1518ce97400b29e300bcd60cea9c0a776b847bbb1a59884e067209c1f67de07d96c4b","first_seen":"2026-01-31T19:46:59.421047Z","last_seen":"2026-01-31T19:46:59.421047Z","times_seen":1,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/ie6eKclbwWIp.svg","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.775Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/ie6eKclbwWIp.svg HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8cb8K%2BvABsrir2Fmh3BXDEDzScdNjVsFfRiurg9Wp3n2oihc67SoKw0gtM9g0Hk6Q0K5Fyuvzs1vu7JLgpuqwQE0JuthG9zgFc50%2Fg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"175-63b763a818815\"\r\ncf-ray: 9c6bb73aacac712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":373,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"78a674abf34aa84bae231b2f677c84e0","sha1":"6630bc1ff057f0f97c378c68991b7fae7826cbaf","sha256":"d139ea962033cd7b26bfae315ac91ad6ed7f64369c4317109cdee2aebbf25012","sha512":"de41c52de10586f44628bd9bc74c1b867d29e106322b4c1a85e108730c42a36eb3fbe91ec75b45f0634698e4af8e35b58c6509fce093763e13d749a6b01bea0a","ssdeep":"","tlshash":"7ae0dfe82118e500a246dd39c36922eeb0f2f0ecd34c0464d760381228546e62a8c6ed","first_seen":"2025-09-25T11:47:30.120881Z","last_seen":"2026-05-02T14:41:38.30939Z","times_seen":28,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/IsT85dULzrOi.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/IsT85dULzrOi.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"c6d-63b763a819f85\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 3181\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HSeIEVdd9MeRrfrUfDjjK3ZTSgR%2FWUvZY%2BYiNi48ZbA5CCThIzJ8r8SnfvcIhKpyHcnuYWRsPxLXp67YQD4B%2FYN24hxG2%2BLRd7YIZQ%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73aacae712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3181,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 208, 8-bit/color RGBA, non-interlaced","md5":"f5e737313f6eca2907df56730e604434","sha1":"e003555b79ac3b776e8e74b73f88ac2f03ebb353","sha256":"bff3223a41f5bbb87b7a8b51c0889960ac180f93094cedb254b1a29afbbb54ab","sha512":"2303fe0c43994ad060d5d81a3a57ebd6d677b59e54d7c19af66dc7e99012aa43e69de1ec4efa8ec2a4098bab63d0f89d40ff526a6f8b69be02956839c2910c9d","ssdeep":"","tlshash":"fd616ec5366c5c77c7213f7832673d86c9ec5002454632c5b854319669eeef01bb675b","first_seen":"2026-01-31T19:46:59.432625Z","last_seen":"2026-01-31T19:46:59.432625Z","times_seen":1,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/InQS4f8ItmMi.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.784Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/InQS4f8ItmMi.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"410-63b763a819b9d\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1040\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BRm0jywmHbJx%2BzeizVFFL4UUvwtoTEWERBZ06T%2BK06P0w%2BgPNV63edjZEtVNXWcLIEFkTJugjAz6xsareZxz4y%2B2wGHqHzQ9QjqaHw%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73abcb5712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1040,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 208, 8-bit colormap, non-interlaced","md5":"de69873e547f729aa48ac209a3e5203c","sha1":"8e0b21388871a9ddbe946e2b4487522fc60b2a54","sha256":"dd0ce216cc27cd7d92eb23fbcd279ae52bc14de548e98470546d47aaec8c61e0","sha512":"4430888034a8917626cc17fe3ce29e12635b0a058d701e03b40bdbb98f5e309b5334d7d4a9c2cb8f435d5976596e4a89d91b6f29da1a00f376189cecb64c3ac2","ssdeep":"","tlshash":"6d11947a0c136a90dc96a837063e371be7478ad73d5638b1c182057ad04762b68a4b4b","first_seen":"2025-09-25T11:47:30.116246Z","last_seen":"2026-02-13T23:06:26.818391Z","times_seen":8,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/SFQwa1FyGIKy.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.785Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/SFQwa1FyGIKy.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"52e-63b763a82a154\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1326\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=grx0%2FV7NqL6aPWW%2FIC%2BZs3S7TRTUPiBSQL99r0TE4gKN2fuS%2BZBA26MBhykhk%2BuBP2jdJKBNRhxGWpvF30IQ2lfnZflijAh6tVh3pA%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73abcb6712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1326,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 208, 8-bit colormap, non-interlaced","md5":"bfde9c5081be39638f49540f17aa5e58","sha1":"c4e486e89b4924150a2184d99ddb7c1a10844a75","sha256":"d94e9eeaae6ad637b096c49a1793da8e992924472bae7a24800cb6bbe6c84ea5","sha512":"ff7e0b57775939895f01c5c4fb99165b6b7f6eff17b915b5310c768a4014cfcbd00342eead3d652977f6e4f10267fa816f324abd0a327566daeae5163ea6431a","ssdeep":"","tlshash":"ba21b7efa5308cbce4a2f0b57415431aa5d15a02e96011f0eb51cc7811e6e14c496745","first_seen":"2025-09-25T11:47:30.156775Z","last_seen":"2026-02-13T23:06:26.815466Z","times_seen":8,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/n49VAlpFVE5X.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:34.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/n49VAlpFVE5X.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:35 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"26f5-63b763a81f18d\"\r\naccept-ranges: bytes\r\npriority: u=6,i=?0\r\ncontent-length: 9973\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D5jsQl50cgMRepi55fd9G3YlT0grRA0bsJyOSjy3g7U1j%2BMdqyUnZuI0PTWOS1pQ9IIkGQyYJxdj2cNoq6b04roP7JMeD0bG2jwDOQ%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb748adbd712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9973,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"536945e64fb59eadd5964defdb2453b7","sha1":"87e07e92df975ab70449cbf08e1193e42d5f8a46","sha256":"d57a47766d875766bf53c810c67570c57dec1ab681139991e7b13b40294f6bf5","sha512":"030f648bdeebe8911050e02630a3e2e547e95e5cd913d53873304120fa7e895acaf351e6bf05b553d3c686206fd28cd77d7e2567028afc3c2cfc3a04f9251bd1","ssdeep":"192:1Su45FsHh73MO6l8uMyykmKHlpCLgNOuyM9nbjQPKZiG6:UfsHhxO9rFieOzMrk","tlshash":"8522ad35b974d32f651fc27aad3de8070123c14842115a1412a33eb60d778bbeabf985","first_seen":"2025-06-26T11:09:56.576826Z","last_seen":"2026-01-31T19:46:59.446972Z","times_seen":4,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/OGHUjWns2TuB.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.766Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/OGHUjWns2TuB.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"b41-63b763a82012d\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 2881\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b2sMjyTw00OvkKY6jrJV3%2FbC7xUnFGCeNyZifGwRjjBYOLwFNwOm%2BJQfpnVzY9xdyaVmUsnFHuGwcwHMcEAn47N5I%2F9TUMDjQMVoqg%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a9ca1712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2881,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"24d378a079edd06386f87e66ac7d1589","sha1":"78a9fe5adf46706240b93bfbaad697719035be1d","sha256":"a86204011599c8451018cf6e6eb784fdcd9e298e209223a55539b3e250689942","sha512":"58c3c092f030625dbe7e8b4327e928879693b7927677d3153b404ea07287d9a15890577441ae906bdd9c67ba7af6202dad794c01c14a24dda9476e5b45566a4b","ssdeep":"","tlshash":"df51ace83d05b69a340bcd45cea9c5a1b3f553bbb4a19c94e43621980ffb8907c8685b","first_seen":"2026-01-31T19:46:59.448227Z","last_seen":"2026-01-31T19:46:59.448227Z","times_seen":1,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/eeDfgpgi8rSf.svg","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.770Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/eeDfgpgi8rSf.svg HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LG1rwfL57iVz7d4yJEYCH1N%2BWnLoy3BvSb4423BA%2FvFMT9Fy7g9pLICdKAtWWxh9bqvpdfCJIhTAhoWcRHRB6%2B2dU0JqBL8La52l4g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"45264-63b763a8139f5\"\r\ncf-ray: 9c6bb73a9ca5712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":283236,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1daad25865e5ec5eb10feb22f7796c82","sha1":"fdef04fb13697cb9534be4ddf79c3f21dcec4728","sha256":"c0013bdca5afc3590daa842fdf2f99e495ea23f16a5bb4636bfd1a577c118f65","sha512":"46761e2521bac8c2837a52241f05e3d141dc5e1c9a2c93b64d12ad15b6ec01cb85edcd099a6c7bdfe9cf5ced540396fd50ab7e1a6903557d820e82c98867bbdf","ssdeep":"1536:iJJlCvpivA+pK1C63UlcBeZmqJIy90p0HH8+n843KUPT0Inmhsc3vX8gvlCuff0k:ycbZ/R5","tlshash":"5c5485a41368d3f4a906f2fdad1664e6ee2f18d0bbdc9174cb022d4694c70ba9d7d8d0","first_seen":"2025-09-26T00:03:56.348136Z","last_seen":"2026-01-31T19:46:59.449318Z","times_seen":4,"resource_available":false,"data":null}},"time_used":441,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":284,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/imemFfTImXsQ.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.776Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/imemFfTImXsQ.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"b34-63b763a818fe5\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 2868\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PmBl7HM2%2BEgd7ATwo2Xg40bc%2BHUq41J9s4EkAelCydyiUON7go9X%2FYDM4lsfcfSytTwtGvrkNOO8Gb%2F2X8fnNqqG40hLaPTXwP94CQ%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73aacad712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2868,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 208, 8-bit/color RGBA, non-interlaced","md5":"8c7a91bcc8307ebbc7cd58fa8071f0fd","sha1":"c2139960d13687374ec46fd02d95c32b57a774fb","sha256":"6a934dd66b9a0fba07914af77a53ae08481de9f834f6418871901b73a3872b1f","sha512":"ff27e298c2b474db2ef26a24a770b41d1e02d1ecb23a779367fb2e85ba8fdb25e76ff008dfe82a77a67f16a02c88bf34862fa656ca60ce991ded602c2b9f5d28","ssdeep":"","tlshash":"04513bc20ee89a6eca0b617e152e6ae3c8eb084340abc819c0011429b3de559f8c4b74","first_seen":"2026-01-31T19:46:59.450712Z","last_seen":"2026-01-31T19:46:59.450712Z","times_seen":1,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/CTdGIcJtAraK.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/CTdGIcJtAraK.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"52e-63b763a8116cd\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1326\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NEJuXRTsqxuhoiAQvRVua8nLHnqe%2F%2F6z6ooOoRoYdXaMLV7SSp%2F4yRdinTc7PAMrIeQwAPWESfNTH2wqaV9VTB06LyiqtZLDmwZlHQ%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73abcb7712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1326,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 208, 8-bit colormap, non-interlaced","md5":"3277c52a97b2267ab7a65531dc9ec2cf","sha1":"a7a9f91c3cf848b9dc6a9dcfcfd391de2df062e3","sha256":"15d21494b3d0206b071af311afdc8d90a45db0d095e5b5386faa98b80629634e","sha512":"0ffd68535c95b8e45efb9238045b42603189d26a25ea64c2d95961f264a243c7849b1d8e03aa0d47718a2df022cad8b5958f5d9d5acaf39da33b644e4dcc8ab7","ssdeep":"","tlshash":"c721b7efb5308cbce5a2f0b57415435aa5d15d02ed6011f0eb51fcbc15f6e108492745","first_seen":"2025-09-25T11:47:30.111189Z","last_seen":"2026-02-13T23:06:26.821217Z","times_seen":8,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":183,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/js/4e1Plgk4YG9X.js","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.791Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /js/4e1Plgk4YG9X.js HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"ddc5-63b763a75e789-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncontent-length: 19318\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=paurYuofdBTi4IHKbKxP1CfWpLoxKqbeH2lxgGU1oo4iyTfG16AgI5pQGWW0XM%2FETInnieT%2Fi%2BoVBsnaz3NhJIH3sQSfSIBikE%2BDRg%3D%3D\"}]}\r\ncf-ray: 9c6bb73abcbd712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56773,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (56773), with no line terminators","md5":"484604eaddb70be479040b79ea103ca9","sha1":"6f56405ba4c4b4a68c02d48e2611ca70402c8977","sha256":"956c51dfb761b6adf68981b0f0dc87809f80b0545723970e9d40a1749abbe39e","sha512":"44c169bb841a3e7515c02856f6889dafbb93203176ecd3cfa3a91064f393b128f05b5245880e763e7daf30c274f053ae037150d0733b803262af4097eb814600","ssdeep":"768:vknVdyp0Vy09VhnvzzF243oK/evRMwhhW5erHOMO26+9KdvcU0VYqzCeQApUk+GZ:8nVdyp0zpzzvuMwaKUAr+Gd9fQmmS","tlshash":"544308ceb681b4b253d321f1815f9309a2375505780a895cf23ad8e57e78d8ca227fbd","first_seen":"2025-08-13T15:16:42.765423Z","last_seen":"2026-07-03T03:49:37.995472Z","times_seen":18,"resource_available":true,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/js/Jper6uP9HCxX.js","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.789Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /js/Jper6uP9HCxX.js HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"53b8-63b763a75f729-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncontent-length: 7491\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DKjVQD%2BzZdYBYImybqXvNuxqEkQ9VTACiK8o40%2BDsBlvBFBkYcN%2F3vtcxCgxrYCGQ2YyrfabUMI0eOEr4gCuQBA%2Fqtb0UdVOG0T5eQ%3D%3D\"}]}\r\ncf-ray: 9c6bb73abcbb712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21432,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (21432), with no line terminators","md5":"d8801b10e3c98c67dc717e2a52d488f3","sha1":"2eb02d6881f0c1dbd93df9697b9b5e71d655865f","sha256":"9f559bdecc4c405db205e6858c531780bf486ba4e1c678c4e00dd96fb90ac5fe","sha512":"f4ba2b2980e4f6e2e855e6bc72c03526d4c30ed92c286f8bddd9a9a2f8e6936c1a6f5052db2d29595ea11519c9c42e5d09d9865f168ef67f898c4610f358ee1a","ssdeep":"384:sDBZ+4A6sJ/n/lBQrYK3qaIRrJFfA+obKeSuV3sLm:IBzA6sd/3StIJJFQbVcLm","tlshash":"dfa242c9fac1b09647e3a4a5412f690ff17a6994b48ed4c0c262d4e4ecb855f8067f2d","first_seen":"2025-05-16T06:26:40.525429Z","last_seen":"2026-05-15T19:12:00.862062Z","times_seen":261,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/68762d4ac364502c1ae192c6_Neutrl%20USD.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.773Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/68762d4ac364502c1ae192c6_Neutrl%20USD.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"db3-63b763a7f74d5\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 3507\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s%2Ba1qPnamzeCMwPlJCa55A9%2BBdJigCsgP6GNYGX6yuJffRAtQ%2BNz1vlP6aqdbrFzO0GzrGNUyQMuQTd7hr4VD1cKtMZFLFJtyYMAcg%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a9ca8712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3507,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"7e56f656ffe56df8379158983e7893bb","sha1":"56ab144d701330c54ba27a12a9c0072730721b96","sha256":"dd5ff90e999edbe640b80bd20b84a159a4a1729c6bf39dee95132ff4ebc48ad2","sha512":"78c713f4af2edf2284d5346065795493224d3facc069f660745876105e03aacd3d7a152541a4e3d3fdc3bfaf07786c6ab96a26ab38ed28a66ee0ec83eb9ec572","ssdeep":"","tlshash":"bf71e8481e3caca4b60d6948f37750c9a206c52b9beb8414dadf3b486fbcf8d62e4145","first_seen":"2026-01-31T19:46:59.454782Z","last_seen":"2026-01-31T19:46:59.454782Z","times_seen":1,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/68762d4ac364502c1ae1928b_sNUSD%20-%20Option%205.svg","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/68762d4ac364502c1ae1928b_sNUSD%20-%20Option%205.svg HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BttD4uifQ9E3s5o68FmtygTH0f5mB2XTWifMeIj8VhdY%2B7o7HKiVAialKEVIE3mCjk00x57%2F%2BiRWibNwVeLtJI5u8PwuMDrG%2FiUdLA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"47d-63b763a7eb56e\"\r\ncf-ray: 9c6bb73a8c96712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1149,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"84965fdd4c4c75250683fe3d17c13f1a","sha1":"17b797de9f6532a8dde02922b2e98a91b23ea636","sha256":"47aec41d50e33ae22b7fa7db74eea69c4ec2fb3a529226a07c3742ffdd526e95","sha512":"50d7f2352f0ccc893843d47fbcfebf421c0212529718913441e33cb87ff677ba249a318cbd45ae4b6cb3391a9da8d90565f85edb78919b9ff8d81e4880e08bc7","ssdeep":"","tlshash":"be21ceab4761d7c0f29173bdde261ae1de1e09546345a025c3843e04a8427f9b9d24ef","first_seen":"2025-09-25T11:47:30.13633Z","last_seen":"2026-05-02T14:41:38.405237Z","times_seen":28,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":144,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/iMJZwwuMkXdI.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/iMJZwwuMkXdI.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"a8b-63b763a8193cd\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 2699\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sGmEGfU9jIzuwB2O9pXhJPFi2rrDcTuZkXDmJF8OYsD%2FimUhNTfeHdpeXXQdDfLPIzGELu3DEKABduouL%2BPNij1Y8DfFhsdcXcECDQ%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a8c9b712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2699,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"dd97e2f1bf5c805a550d2f094d30ec81","sha1":"5d383690720793b24180e2ef5bfc930b6d469c82","sha256":"a10bb7ccbdad5f1637faf5a9ce7826449278eca337edf8f6a7fed8f5404b7f6d","sha512":"25d6d7a9954f35a2b7740190806d4ac8817e54f19108cdbe32fc4e97353235761e96b3d0304dba2fa935a6041f5c80347d35ba46ef673b0f93794e29fc8b32c8","ssdeep":"","tlshash":"2351b0e97944f69a700bcc04cee881e776b553bfa4e5d880e03621980fa7da43ccb54b","first_seen":"2026-01-31T19:46:59.456822Z","last_seen":"2026-01-31T19:46:59.456822Z","times_seen":1,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/ABfxhpAt1uNu.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.764Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/ABfxhpAt1uNu.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"105e1-63b763a80b13d\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 67041\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BMAH%2FdJ%2FKw4nTDPyMyeWDJo7PYlyGkKXd5PFrO%2BLfDzr0JT8mGIP0OmZ2gd2hRpj24bzkzxXoN19e4qIpL7rNNOHfZB9m7PRM1zSjA%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a9c9e712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67041,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"4b85cb8ac7856149505ba9f5a914b76c","sha1":"cd94fbc4f3675d099ab3799b6e57193802783628","sha256":"81d617ab63c27e950a68ace67f0b1fe0e50fe181ad1fd3c2979568eca75c4fe1","sha512":"5e662cdd9cf26fe5baaa6e1e63d033fa432de0d52294b445d9f7b84523b87d2dfc1425c882e6a70e4cd4d815360835589d51f3b24ae5e53fb1b7e9bc4a02c4e6","ssdeep":"1536:9i87RPl3h94950YZIvX5rQrFJ6f50B7yZKTKaOvKy8Ausn1EInY2Z:9H7RN3fC04IvJuH3mCy8en1E8p","tlshash":"1063027cb1aeef587cb8bc966a365c6d75cd28e844128cf1ec90b5e1a391e502641436","first_seen":"2026-01-31T19:46:59.45765Z","last_seen":"2026-01-31T19:46:59.45765Z","times_seen":1,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/68762d4ac364502c1ae1929c_Frame%201597880469.svg","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/68762d4ac364502c1ae1929c_Frame%201597880469.svg HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DG6OFwmJjFwTseJrh%2FbMEhrEt1dohWw1E%2FoPiSTWU%2BXI7vx0czNRm7naciwRWEOO%2FgXiN%2FkNdEGTNa0KY0MvpsbmzTJv9mY3PVMB8w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"d76-63b763a7ec8f6\"\r\ncf-ray: 9c6bb73a9ca4712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3446,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f3ac5cca389ca71a89156e6fd8fb6f52","sha1":"d1a3fe25d38ffb2d9715d2e3cd4e4e73b69a5321","sha256":"b48dc9215a9aa366136e539344924970b0a21838b6e6d4fc0eec25f2528d407b","sha512":"8a9affad986c088c1f13390ede574d2c81ade523d6d237b14c62230d2042e767a687b257b1170206e55b841ce852519a22583cbe2f08e08e20af7a4768ee29b3","ssdeep":"","tlshash":"a76150d42b7963a8f422f2e64c6716d8fc6b20c93ac48876c3747d05e01e0b6a6a50d8","first_seen":"2025-09-25T11:47:30.085811Z","last_seen":"2026-05-02T14:41:38.403624Z","times_seen":28,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/pjN6p2GctaI6.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/pjN6p2GctaI6.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"4ff-63b763a82189d\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1279\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=POQQgxftSt7H31jSwsuZDtgzjj%2FZZgfsnIsNGKg0Yg%2Fyi073GVdL4Izo%2BpW6H52br%2ByOTywZhrX6huO8bNKbuJ3Q5Ji4PSzW62OwZg%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73aacaf712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1279,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 480 x 208, 8-bit colormap, non-interlaced","md5":"30ca1120352beb0cdd78526732b8d3a3","sha1":"8250022b30b2d5daa3d0c5ae4369e4f8cbb00331","sha256":"98c1f512c44d148afeb090a47647f8fa473cdd8f0d65c628eb955af1a6966b13","sha512":"56c10d3be56e33088c370132e63ccfbaf244663927d42174086d324af01effaef81497e360e43a250a7273a20c933d1edf6dd8b4341182d1f51e3d1fbf794251","ssdeep":"","tlshash":"a72174d6db600009d8ad91fab362c17bfef13e42e21408fb0e85966803cad0670f6b45","first_seen":"2025-09-25T11:47:30.088306Z","last_seen":"2026-02-13T23:06:26.890251Z","times_seen":8,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/11xdD1xQJ5q6.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/11xdD1xQJ5q6.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"484-63b763a7e9a16\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1156\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F%2FWN4ix4st7mXpIhogjGWX2p1pSjAVWuL8%2FY5OW1svZur%2FHBemplOWTIn77RFETu3iDMB4vl9dROto7xpfLBxzVcrgNFCgf7ZOOgwA%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73abcb4712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1156,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 520 x 208, 8-bit colormap, non-interlaced","md5":"f49f65cdf530e08598948e279c5b4b12","sha1":"ef1f37ffae63cea545bfeec8e1daeeda6edf7feb","sha256":"9b6942e03ee61ef7356c12d285847b21abcc60fffbfad9871353a502e801a50e","sha512":"874aba523dba6a2120510761baf2c4975f0af3a04b7814f5a7c57dbec28b142aefae0b09bfdd7c9c51138318bb3f1a1f2760cf664a0809f1ce4c613896e1065f","ssdeep":"","tlshash":"9621b54c8f73ea6ac506227080e438560da17f1a14ec2cc7f00cb76d58b421a8054b5b","first_seen":"2025-09-25T11:47:30.155633Z","last_seen":"2026-02-13T23:06:26.826156Z","times_seen":8,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-31T19:46:32.210Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\ncf-cache-status: DYNAMIC\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gTaSttooLJPdSSP%2FoovLAbCDH9qp%2FwkwrQnktV2widGapsZ4awS59byL2TJo81jb1LAzrucI5o5KZ5suwJveJz7EkR1jVR2qs%2B%2FjUQ%3D%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9c6bb737ba6056a3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Webflow","description":"Webflow is Software-as-a-Service (SaaS) for website building and hosting.","website":"https://webflow.com","common_platform_enumeration":"","icon":"webflow.svg","categories":["Page builders","CMS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41698,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (29105)","md5":"a090d26533ebb370e484e783bfb0f3f6","sha1":"8b7cc74a96ef8da29b85de69f496b8fda0c2c1dc","sha256":"cb3ad8d1b1e4725bbe4e9230eb91e0d263ebfbdb27aecd92f847bab7918b708b","sha512":"56b26e72793309514ce9061b02b4c719496fb08c55a6b25abb2ba228cba0ad0cc82cb6f9c88242459cc7c21bf9ab643f33254a522c4bff46b099ab8a6bf284a3","ssdeep":"768:bznKopKliEEvrH69Hh6KRMoinJzLUf8twVOS/Z8WGSvQdMrdSvQdMrdSvQdMrUWT:3nKExrHg6KRMoinJzLUf8twVOS/Z8WGc","tlshash":"a81395784f5ad0fb7a4755e3b135ab1c799b428ec6621805e7fa4acc8bc0cdbcd1a058","first_seen":"2026-01-31T19:46:59.461604Z","last_seen":"2026-01-31T19:46:59.461604Z","times_seen":1,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":65,"dns":39,"connect":1,"send":0,"wait":254,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/Av7UsXInLMVg.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.768Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/Av7UsXInLMVg.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"932-63b763a80c0dd\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 2354\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UEVzdM%2BeSgLVTslea6vdgNJcP9z5q6O9mrWL6omxHGZwvkf0ONSkqytLrzWyZlMelBC0seQaB7BwXa8EcTMCfm24LCfqpVnE8oAG4g%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a9ca2712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2354,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"831b383c181e5fc38321c7943253100b","sha1":"be2e9c4c6d291d7a9a2794317d769e16f4acfdd2","sha256":"63afd27481d77ecb5c4f907d17f06a2c7b427601df5efa16cb752dc5fc743b90","sha512":"5a520e69a78cf39fdb818587f91a4231cd0c5da422e16e2155ab62c51f01547848247463c33bfd84d335a35a343444bd2a5855546755bd39d5d77cd3bc180b05","ssdeep":"","tlshash":"264166c8ed54620eb2efd947bc8b846ec2c1d36da520e820a02852c49b5b7387f185b3","first_seen":"2026-01-31T19:46:59.462511Z","last_seen":"2026-01-31T19:46:59.462511Z","times_seen":1,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/68762d4ac364502c1ae192c3_Argentine%20Pesos.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.773Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/68762d4ac364502c1ae192c3_Argentine%20Pesos.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"b6f-63b763a7f6d05\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 2927\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SaZCVCe2E6oIaNCevNTjDchfH0p6xuBrWf%2BAIg2zvKrwgEQG8fUNXMRKAfLdqrODfeGZTbdsMTquJ5uRRP63s20qvMwN5%2BqdHCb6Mw%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73aacaa712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2927,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"a580ed03eeec74b81d612840fff613ab","sha1":"65fc5f32540c6285815b058c41e0d0a189c339db","sha256":"c11184d0886873ab78ab6dc64744d507ae04c4487a7d16fd9079e3b045800534","sha512":"4b4a5357d145841bf2140abebb9f7d67256476432da6faae1924c12d18b930a05c787f7e6e6b91c6b8c175463def4203666aca135340e22a0f0114ae2dea2902","ssdeep":"","tlshash":"d651a2cd54ed2dd4da2785a001327a58587e3cbf3490416cf60981fa1b28cbb3f9764a","first_seen":"2026-01-31T19:46:59.463492Z","last_seen":"2026-01-31T19:46:59.463492Z","times_seen":1,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/LsJSwxAR3Dc9.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/LsJSwxAR3Dc9.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"616-63b763a81b6f5\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1558\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I5mvnwKw6RA7qsief7caubKO09JbPDSMsZn1bBZVWU%2BEMTYta1oHF7jpo8JXvMNz5hxPSKVTZWBnJdyjGBmmo0X0Vu3hJob7Q1tg%2Fw%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73aacb1712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1558,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 440 x 208, 8-bit colormap, non-interlaced","md5":"4551280aecd430a61ed6e634185270ae","sha1":"1c74108f8e9b51339bee4fd143e55084457ef365","sha256":"4f55075987b472927cab0fa04e65c4640630c1cce4339dd7c388af8916cd6fed","sha512":"b150de11bc1f2aaf36f36195e2c11f38a6929b3fa5ec8eb471278599c33ac5acd79c5e818003ab5e9ab51c6caf44d70a49f843e484b53842840bfbb7eb28dd4b","ssdeep":"","tlshash":"9931e933f494090dc583257a57406acf98ba08419d80cea7e842c48f7636fa9c5f7b45","first_seen":"2025-09-25T11:47:30.09484Z","last_seen":"2026-02-13T23:06:26.92664Z","times_seen":8,"resource_available":false,"data":null}},"time_used":185,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":185,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/js/IxxguTcs3Kce.js","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.789Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /js/IxxguTcs3Kce.js HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"4e59-63b763a75ef59-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncontent-length: 6291\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/javascript\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BsmjZvtvQmuoycxl%2BF8i8hKhbhpH9yZgmo4eXxFx42XDxitNqJyOjEFQypUdLA101b0UPP4o048zOaB5j3T%2Bm4vxIXRbSFGIZ33kUw%3D%3D\"}]}\r\ncf-ray: 9c6bb73abcbc712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20057,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (20057), with no line terminators","md5":"96dc9dc4b7148459fd8fea78602548b9","sha1":"2df6732246441fc0dbe0b8659d9b0e07c3953264","sha256":"9105be0a8ea0024fbd425be57035439212cad71a8e1a751cc8121c68f6ce9abe","sha512":"fb1b500f1d6e13b323456c755cc726d774c1d1c92c7c55fd50f8928dc786c8ed56de888692102cd7fb355cf6a118b1fc918ca36db042c8552de4dfa696b2a1a2","ssdeep":"384:TtDi/rIk6NaYaQMdCe3N2oMinYpi1qjtBVuNAi:TViTz6NpeCdotnYpio18","tlshash":"9692e18efed1f0514363f865926f944af27a1959b04fe4d492aad1e0dc3d54f8023e2e","first_seen":"2025-05-16T06:26:40.566174Z","last_seen":"2026-05-15T19:12:00.902834Z","times_seen":248,"resource_available":true,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/T6tFeyz75Kbi.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/T6tFeyz75Kbi.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:14 GMT\r\netag: \"57d-63b763a82ad0c\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1405\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8C69lVncJ%2F1rdcvtJYHAEj%2Bli0AD4NRPyMdUPSf1kDWXCaOSRyu6QfGzxAoS3kRxBC6rtM8msgwejnyShL4gLgMN5FHqXtpeJVessA%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a9ca6712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1405,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"050f7494139df82318d2c5c3038462cc","sha1":"cfc080804c33bb5ac0cab0f913babc5da8de67b3","sha256":"cf4125c0a4efcaeab9b85aeee5c3dfc7ce12e92d90fa01aac5e7165d8611c362","sha512":"012db896bdae180ebd84b9d8b590a5f199f3f6d35846a4859e5462f2a543609f9f3e5bee9a329b899528c36777abcb23c3e23d4a8a5b4885183e4743339ff62b","ssdeep":"","tlshash":"fc21edae2d436a7ec8bf3ee36d501d1c34e7fd919814c8825a204664e32d47c5aceec8","first_seen":"2026-01-31T19:46:59.46716Z","last_seen":"2026-01-31T19:46:59.46716Z","times_seen":1,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/aXpv8iS1J21n.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.780Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/aXpv8iS1J21n.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"616-63b763a80c4c5\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1558\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=breJ65htSVLC7N9rJ%2FdOs36%2BSKOxhKcF7bLAxMhYTbRR6q8NhOZJByXroN6thtZhrDF4%2Fe%2B4zGuO9YuUpRG5fVemffk4ipmEpSIyJw%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73aacb2712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1558,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 440 x 208, 8-bit colormap, non-interlaced","md5":"26552567ff6fc516a1898a0e01c74d31","sha1":"0adb3ec9058399440051c88e6c5e0bbc6fb6d484","sha256":"fcda281b372a6e2924e90ddbef2238dbc6f70872525cea5cef13047774adabfe","sha512":"ad6aa8ff9197702664c69cbd2a7c8aac0c9756107cf044231c8fde1c7189cd4b09fa81ad4cf57b4cb645ab62322ac722ed9496207043f09564099e2534c1516b","ssdeep":"","tlshash":"7c31e927f4d4090dc583217a57406acf98ba0c419d80cea7d881f88f7675fa9c5f7b45","first_seen":"2025-09-25T11:47:30.125611Z","last_seen":"2026-02-13T23:06:26.855076Z","times_seen":8,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/68762d4ac364502c1ae1928a_Frame%201597880475.svg","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/68762d4ac364502c1ae1928a_Frame%201597880475.svg HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M7crHY7GVIoVXosz9UhaySmvRWm0B5n%2BfF0p8SJ7fQ6Oj8wHRjojspLygE2Kkn3ky2SNDtC3mUmtajJGTvfwduwq8R%2F5YAgTPoSloA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"701-63b763a7ead9e\"\r\ncf-ray: 9c6bb73a8c98712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1793,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7bd8622478c6dfa073bf74bd317a665c","sha1":"7172924a84e147b25cbba76c6e6d1fbcf01bd53c","sha256":"c13010b49089af09329d482a547ba2207fc8ed9225a0f203cf60dd8a8933635a","sha512":"0ce8c1cc8d3a513591d0b4c46e5bc7eef564ec9b66a49eba9c0f58f382f6ce32cfe7c25a5187b54e6e0efabcb7f97a09ffca5c85dcd545bdf23829570940c764","ssdeep":"","tlshash":"113101a4737ed378c435a5fac92a12e5fc0d54ea225c61b2c7d13c0ae502079dd7b2c8","first_seen":"2025-09-25T11:47:30.143048Z","last_seen":"2026-05-02T14:41:38.3795Z","times_seen":28,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.auth-s1.co/images/8Y1ZMxZOew4U.png","fqdn":"www.auth-s1.co","domain":"auth-s1.co","tld":"co"},"ip":{"addr":"104.21.1.171","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.auth-s1.co/","date":"2026-01-31T19:46:32.763Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-s1.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 27 Jan 2026 15:28:43 GMT","end":"Mon, 27 Apr 2026 16:27:20 GMT"},"fingerprint":{"sha1":"20:E0:F8:80:EC:C3:AB:4E:3A:F8:00:8A:F5:1A:3F:EF:ED:20:9E:93","sha256":"86:E8:5A:9D:18:DE:D5:33:3C:EF:FE:B8:97:53:EE:57:63:2D:9D:3D:37:4D:E2:0D:CF:47:6F:E9:25:1D:89:F9"}}},"request":{"raw":"GET /images/8Y1ZMxZOew4U.png HTTP/1.1\r\nHost: www.auth-s1.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.auth-s1.co/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 31 Jan 2026 19:46:32 GMT\r\nserver: cloudflare\r\ncross-origin-resource-policy: cross-origin\r\nlast-modified: Sun, 03 Aug 2025 13:47:13 GMT\r\netag: \"9e9-63b763a8076a5\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 2537\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lG9QXvh9iEMUt2ScbNyGvi%2FTtTmNTnr0l%2FsJS3jxQuVRwOnCSKy1CbpzT%2FYF6Pox5I76u%2FHCF7SwzeCagb2%2BzcKUWA45TF3oVJRhgQ%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-ray: 9c6bb73a9c9d712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2537,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 296, 8-bit/color RGBA, non-interlaced","md5":"661760f5910ccc5739185509be4036b7","sha1":"a94c8fe39fe03a0b8bf24e3a5deabf82965e4c29","sha256":"e7b8863e18209238121cddfa0afc7bda163f823d72734571b2a4abd8fedda3f6","sha512":"77c5cebb059a89a8464ba23fd2b1fbcefffd677ae20bb7874d4bd29de10583678376cde98e01e834f062931c76e47063150a2eafa475f98491ddfd6ca61a53d8","ssdeep":"","tlshash":"1c5131c8ed15664af2aec813fd9ec12ac4d0c329e560a820e46946d49f1b7393b691a7","first_seen":"2026-01-31T19:46:59.469716Z","last_seen":"2026-01-31T19:46:59.469716Z","times_seen":1,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-31","alert":"Sinkholed","trigger":"www.auth-s1.co","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}