{"report_id":"da90c07c-3dc9-48ed-9f19-3a8ddc8e538f","version":0,"status":"done","tags":[],"date":"2026-09-22T10:06:09Z","url":{"schema":"http","addr":"primoweb.com/","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":0,"asn":16509,"as":"Amazon.com, Inc.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"primoweb.com/","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"title":"Primoweb Collection","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T04:48:22.252471Z","times_seen":18611488,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"primoweb.com/","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":0,"asn":16509,"as":"Amazon.com, Inc.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-27T10:06:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"primoweb.com","ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"1998-10-22","domain_rank":0,"first_seen":"2026-05-29T18:51:10.403358Z","last_seen":"2026-09-22T09:33:37.785351Z","alert_count":78,"request_count":26,"received_data":5262388,"sent_data":13837,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Elementor:4.2.4","description":"Elementor is a website builder platform for professionals on WordPress.","website":"https://elementor.com","common_platform_enumeration":"","icon":"Elementor.svg","categories":["Page builders","WordPress plugins"]},{"name":"WordPress:7.1.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Gravatar","description":"Gravatar is a service for providing globally unique avatars.","website":"https://gravatar.com","common_platform_enumeration":"","icon":"Gravatar.png","categories":["Miscellaneous"]},{"name":"Twenty Sixteen","description":"Twenty Sixteen is the default WordPress theme for 2016.","website":"https://wordpress.org/themes/twentysixteen","common_platform_enumeration":"","icon":"WordPress.svg","categories":["WordPress themes"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"primoweb.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-09-23T04:46:54.211474Z","times_seen":1066522,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13577,"data":"","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-09-23T04:46:54.207876Z","times_seen":974778,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-includes/js/wp-emoji-loader.min.js","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"29aec851414fe50fd723fbb79caa91ce","sha1":"a2f2906f13941ab66ffce7b64dac192a9076a69a","sha256":"6bc13925f360c2a90a86748a7315e2ca14a7d5708561fae071c14161c8845c39","sha512":"da5d078524e5c63d2d95e0304e158683bc438db2dcaea9b6f808365e7aac631c5e6dec2c60af97f46b98de39d7238d4da239fec26f7a78d80c8c1957c290aa74","ssdeep":"","tlshash":"0f718659eb7538df33fa01f2653a4d4beb614436e684d038c9ae631414b1893c375a56","size":3569,"data":"","first_seen":"2026-09-22T09:33:40.154282Z","last_seen":"2026-09-22T10:06:23.638522Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-includes/js/wp-emoji-release.min.js?ver=7.1.1","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","size":22752,"data":"","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-09-23T04:45:01.446599Z","times_seen":60432,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/twentysixteen_javascript_detection","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3c84d1a2f898df1f4f7bf1c742bb2f42","sha1":"bb2cf64f6d21e0429b7791a9a3eb95970044d21c","sha256":"e816f24b61fe933be9ef5d2a426e2dfd56c17085588e5ef478fe947fddad25be","sha512":"266d3b1a746fba65e343e507c5828dbbb64d72d6d6aec5e04fcdf5fb292a449668e1c0deba7b74f5c00f98598eb2608fd32f6125f8bd15756de7ac782d9d7c2a","ssdeep":"","tlshash":"e4c08c2abca8b879142b282831ef93243865a140f901a800c0bd24040932f9b0b21e4d","size":159,"data":"","first_seen":"2025-12-10T06:06:41.32339Z","last_seen":"2026-09-22T10:06:23.639581Z","times_seen":215,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/twentysixteen-script-js-extra","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"08eb2b5898a9fa3def8999f9b763d47f","sha1":"344abd59d336b3af1c43907b1280a95e600d4eab","sha256":"dfb5e3e9a8816419c79883f8fe64f203aff0f8849bbbfae205c2c7fcfeefc1cc","sha512":"f145a7863d4798310c564ebc2f40a75a3d48323d52749ac4fe9010fcbb70264810e5869ca087c6ecb9ba5f031c2d4462f60e45f2cbcc46b87d68415a271093b1","ssdeep":"","tlshash":"f9c02bded8453f62b5427cf00939d33a102d4400c293c44e11c9810c0414b9a106e088","size":193,"data":"","first_seen":"2026-04-26T08:22:53.192655Z","last_seen":"2026-09-22T10:06:23.64044Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"e8ba7f3133784b1dfdd63c10d1a7e126","sha1":"1c8764457eb6adf8031fc376f97a10b5ac849fd5","sha256":"6582699597ee6dd4ae9691085514c0e844de0b5c226802babcf016e229e85b20","sha512":"78acf550cd4a615b5d9ea595ab4ceece83823e3d1c1dac13abe387d2a6a610001f81c64178652691e2b586fb9c523146f202bc4c4a26843e98f893c1734b04a6","ssdeep":"","tlshash":"78c08c2a3ca4b879142b280831ef932438259140f901a800c0bd24040832f9a0b11e4d","size":151,"data":"","first_seen":"2026-01-20T14:07:07.315658Z","last_seen":"2026-09-22T10:06:23.641088Z","times_seen":53,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"c1764b770bc65a55b04fbc5c5b318d7a","sha1":"ac471770bb5d0031c84a21f79a954a801cd458b8","sha256":"724538678c23416f50ff6c18ff326f7e86dc0f2725273bbda6118072b4d7f33b","sha512":"bf8b43238210ee5576afc115870ff3b2700717c029620aa469439dc9be5d6d6424fa86f5eea7b184d38b9bf25e3befb9c2693c04b6173ffb3247bdb65b8ddf44","ssdeep":"","tlshash":"2cc02bde98453f6275423ce00535d339102d4400c253c44e11c5410c0414b9a106e088","size":131,"data":"","first_seen":"2026-03-28T20:56:16.607687Z","last_seen":"2026-09-22T11:02:33.922424Z","times_seen":226,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"e4c597e5869b2ad5536888ffb8bd93c3","sha1":"059594b1ebe58afb453956a630d37ebb6564779c","sha256":"a03f489b35fe14824d8e0a005f1487156a2293aaabd502226f0a855589229cc9","sha512":"5b611886cb6f4ff03f5a98221be6699218d973503fd5e498ad742d361918d392befb91d8d6ec45fe15d2cace659a919f2e23fd6a9730f02e8804b8bfa4d5a1d5","ssdeep":"","tlshash":"e911e9f3b39da07fbaae6d66193802ce6a1c90735c100a5bfeac35758c8042538b2d40","size":962,"data":"","first_seen":"2026-06-30T16:37:28.019196Z","last_seen":"2026-09-23T04:31:15.981127Z","times_seen":11314,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/themes/twentysixteen/js/functions.js?ver=20230629","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"359932414ca3e9428a54749084f7057a","sha1":"17f3055a169ba30daf74ed3e3238575cfedb0fa5","sha256":"7487eaab8afc394d9746bcacd476d1ceef806107b0eab0b2059c2b37d10311f6","sha512":"5312e483e1b9b80a86c8ffc3093d0279a441d7972eaac8a06479ac5e8530a075b086e4175ccdf484ba4c9a601119e831c367d99d3459f8f83b4438c499bf4e15","ssdeep":"192:CQdYTbrLR85ICOJbv7Tv2zjeqMhLDQXF9I5:GzRuICOJD7Tv2zqqMJDQXF9I5","tlshash":"2be152d9f75e227740bb31e68a2ec0a8357d8837f40538567c5f91243b1c82952b2f6e","size":7326,"data":"","first_seen":"2023-11-04T07:49:46Z","last_seen":"2026-09-22T14:24:31.256718Z","times_seen":687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"JQMIGRATE: Migrate is installed, version 3.4.1","filename":"https://primoweb.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","line_number":2,"column_number":981}]},"http":[{"url":{"schema":"https","addr":"primoweb.com/wp-content/themes/twentysixteen/fonts/montserrat/montserrat-latin-700-normal.woff2?ver=25","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:33.280Z","timestamp":1790071533280,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/themes/twentysixteen/fonts/montserrat/montserrat-latin-700-normal.woff2?ver=25 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://primoweb.com/wp-content/themes/twentysixteen/fonts/merriweather-plus-montserrat-plus-inconsolata.css?ver=20230328\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:33 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 12848\r\nlast-modified: Sat, 12 Sep 2026 07:01:56 GMT\r\nvary: Accept-Encoding\r\netag: \"6aa4f8e4-3230\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12848,"size_decoded":13234,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 12848, version 1.0","md5":"f0b3206d02a2f684530117ce1d7e8ce0","sha1":"f3708b707b65e241b0f1c819d5f7bf7da8412653","sha256":"f31b80562610135edd91a86ec7f243c5eeaec2ec08337e6a20c2d135d8e217da","sha512":"319019c97a520d9d0fac5487d614c41b7c766bde2a60724966054b232427490817ff46e9f6ac82165343d50732c02e7f4821f4074908fe58775e3cefe6812026","ssdeep":"384:7s2w3jKnPxyyqn2JKL8i3pAGQF7Zximd9qjAECMfd2J:I2wjGQ9n2s8i5TiZbdYtCcd2","tlshash":"6342b0fd32582df09d56a7bff79794d75774915d888038d56dd0894c0bac278021cf4a","first_seen":"2023-04-08T01:23:46Z","last_seen":"2026-09-22T23:10:18.011955Z","times_seen":5671,"resource_available":false,"data":null}},"time_used":1259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":917,"receive":342,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/themes/twentysixteen/js/functions.js?ver=20230629","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.360Z","timestamp":1790071532360,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/themes/twentysixteen/js/functions.js?ver=20230629 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 12 Sep 2026 07:01:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aa4f8e4-1c9e\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7326,"size_decoded":2281,"mime_type":"application/javascript","magic":"ASCII text","md5":"359932414ca3e9428a54749084f7057a","sha1":"17f3055a169ba30daf74ed3e3238575cfedb0fa5","sha256":"7487eaab8afc394d9746bcacd476d1ceef806107b0eab0b2059c2b37d10311f6","sha512":"5312e483e1b9b80a86c8ffc3093d0279a441d7972eaac8a06479ac5e8530a075b086e4175ccdf484ba4c9a601119e831c367d99d3459f8f83b4438c499bf4e15","ssdeep":"192:CQdYTbrLR85ICOJbv7Tv2zjeqMhLDQXF9I5:GzRuICOJD7Tv2zqqMJDQXF9I5","tlshash":"2be152d9f75e227740bb31e68a2ec0a8357d8837f40538567c5f91243b1c82952b2f6e","first_seen":"2023-11-04T07:49:46Z","last_seen":"2026-09-22T14:24:31.256718Z","times_seen":687,"resource_available":true,"data":null}},"time_used":805,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":805,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2023/05/discover.jpg","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.376Z","timestamp":1790071532376,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2023/05/discover.jpg HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 11 Jul 2024 05:41:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f708d-b1ab\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45483,"size_decoded":45034,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 800x533, components 3","md5":"ecb724b9aee15b342cc441a3eb7b7464","sha1":"34d3f71ef784099cb515352919fc0aa8ccce8e36","sha256":"60be509714e130eb84a00b7d5ac18fb58ece8fca2b5e1754e8db84b367f39f91","sha512":"a2d48c806fc1da88f7da79ae6da02e9614d4e2897fa8a77911f6c96dab588dd7d53661111dabf54366395c28719399b502c0bcf348c25151bd0c5fde3e4eb8b2","ssdeep":"768:xYyE6osF/jBjYxM8XEUfpL/0lTeJg3sBXKYGW9hUVvcnxC+47TZWzjuVm3lSn+AZ:xfXZj2TpT0lgAsB6YtWcnxJ43Z3m3lSj","tlshash":"1713f17b2eeec349d7b3d374e4e8349aa607906dfa513ee57c6a6417090e6f0d44b021","first_seen":"2026-09-22T09:33:40.125389Z","last_seen":"2026-09-22T10:06:23.613438Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1136,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-includes/js/wp-emoji-release.min.js?ver=7.1.1","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:33.449Z","timestamp":1790071533449,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?ver=7.1.1 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:33 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 12 Sep 2026 06:03:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aa4eb30-58e0\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22752,"size_decoded":5283,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (19813)","md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-09-23T04:45:01.446599Z","times_seen":60432,"resource_available":true,"data":null}},"time_used":748,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":748,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/themes/twentysixteen/style.css?ver=20260819","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.356Z","timestamp":1790071532356,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/themes/twentysixteen/style.css?ver=20260819 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 12 Sep 2026 07:01:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aa4f8e4-114c2\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":70850,"size_decoded":12662,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (413)","md5":"ea7b923b2ab9cc034efa1119c8620c26","sha1":"346a05b79274f480218f6f7c1bffb95f2e9a6d18","sha256":"dbbaf52b1ded93eb8e735b826d21f30ac0327e3452e110261093804b51f9801f","sha512":"3e99ee897edf6e9477acb794d1a9f9cce72c7a192ed5040698c89d46344883e066d9695a7a323a7aa72f652b8b323922944a855c68cd1322530ee371856949c8","ssdeep":"768:66cB4KHEdVbzFpls/IFgXsgqIFpTDKaOqcb8KgCrgW3ZIwlBhcr8VmELFb0tp77R:66cB4KHEdBTFgtp7s9KzMH7jEsrq","tlshash":"896396a96b901840932f0369bfadffa4191c14659e0f8fffd495b63cd6c46a002a7f49","first_seen":"2026-08-22T17:09:46.084672Z","last_seen":"2026-09-22T14:24:31.287691Z","times_seen":12,"resource_available":true,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":465,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/themes/twentysixteen/css/blocks.css?ver=20260105","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.357Z","timestamp":1790071532357,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/themes/twentysixteen/css/blocks.css?ver=20260105 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 12 Sep 2026 07:01:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aa4f8e4-29d7\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10711,"size_decoded":2395,"mime_type":"text/css","magic":"ASCII text","md5":"cd1ced50ea574342ef57e1debe231b91","sha1":"974b0b599f0bcdc8312ab3d61b7570986e098d38","sha256":"037268612bbb1efda49df93db13ee77b2b72956521ae1d7d7a8696bbf8faa90f","sha512":"7823cff6873129a7ce2131e7c448befd8f5224b413430580549c7ce701e489930f34c381da2a04fdffc80a190c622d28d996b42ba4a447b7cf8f7d98caf3f17e","ssdeep":"96:tUJlqdNTEdXmrfR7d9iaUzSad/ORJoQHM7KAq69lcyGuOQou:tylqEdy7d9inSad/woQHM5Z9lRGuB","tlshash":"9c2231096ff2ace7209fc36aae1cddb4d78d15859e1e4bd2f421d064660c2540cadf9b","first_seen":"2026-05-22T23:42:11.180259Z","last_seen":"2026-09-22T14:24:31.283136Z","times_seen":71,"resource_available":true,"data":null}},"time_used":581,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":581,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.358Z","timestamp":1790071532358,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 12 Sep 2026 06:03:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aa4eb29-15601\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87553,"size_decoded":29881,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-09-23T04:46:54.211474Z","times_seen":1066522,"resource_available":true,"data":null}},"time_used":693,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":693,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2017/02/cropped-PRIMOWEB-300x300.png","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:38.464Z","timestamp":1790071538464,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2017/02/cropped-PRIMOWEB-300x300.png HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Jul 2024 05:40:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f7049-10b9\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4281,"size_decoded":4538,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit grayscale, non-interlaced","md5":"4fbfb9e53485965a0842765ad2390e43","sha1":"f16516bdba78852869495f3e4d9ea22b838a1d66","sha256":"79fa9804337d01e4329b25091da7a94544f10e66d076b1d1fe6dfa12f895ff32","sha512":"626b16c5058b278e04cdfc1e949c7e56b7d0e7eb9b9c3f61daa0de58b9e36f32408206b51c74d9a82f7e0872961a329542873fb4cd8efac6241eb95fa223b246","ssdeep":"96:UJT3ECcEPX8D/GxXbh++IC0uhZFVENzbj49L9gd3ZF2sENEk:NEiG9b8rC0uhvVsvt8T","tlshash":"d3915dc17a141ba37b614cbc924f45d4d7534d9336dba6fcc637a0b828a901fe1d3a68","first_seen":"2026-09-22T09:33:40.118803Z","last_seen":"2026-09-22T10:06:23.61869Z","times_seen":2,"resource_available":false,"data":null}},"time_used":537,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":537,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T10:05:31.008Z","timestamp":1790071531008,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:31 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlink: \u003chttps://primoweb.com/wp-json/\u003e; rel=\"https://api.w.org/\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-permitted-cross-domain-policies: master-only\r\nreferrer-policy: same-origin\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Elementor:4.2.4","description":"Elementor is a website builder platform for professionals on WordPress.","website":"https://elementor.com","common_platform_enumeration":"","icon":"Elementor.svg","categories":["Page builders","WordPress plugins"]},{"name":"WordPress:7.1.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Gravatar","description":"Gravatar is a service for providing globally unique avatars.","website":"https://gravatar.com","common_platform_enumeration":"","icon":"Gravatar.png","categories":["Miscellaneous"]},{"name":"Twenty Sixteen","description":"Twenty Sixteen is the default WordPress theme for 2016.","website":"https://wordpress.org/themes/twentysixteen","common_platform_enumeration":"","icon":"WordPress.svg","categories":["WordPress themes"]}],"data":{"size":67303,"size_decoded":12092,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (12681)","md5":"acfc21ff349b52096a9ac2e875bc5221","sha1":"0a3c9197190e2fe23e2d5c58546bc5cb253258c4","sha256":"7e66d1f9cf9aaa4ae566209bf63364e1babd78c5446b5d322bddeb8c050b2fa2","sha512":"e93c8a0ead154bb7fa78b2e0c45252e8b65061658028f22df40395c8dc17692c3dcd224df4b8b9d57ff017181a8a377281f71ca5b0ef077a692669765c33e4e7","ssdeep":"1536:laypLKdAwV6HIY1mktrgSRNrVb3SrCoVjcrGYMXr2t3or+zehrnndUrZ0eJlr/Rv:lTdKdAwxKB","tlshash":"a6631ab3a0d8047f271b93c5d17a7f6c6ea7c0a9cb1167e2f0f9d1688b40db7152a909","first_seen":"2026-09-22T09:33:40.112664Z","last_seen":"2026-09-22T10:06:23.619786Z","times_seen":2,"resource_available":true,"data":null}},"time_used":744,"timings":{"blocked":-1,"dns":37,"connect":114,"send":0,"wait":363,"receive":0,"ssl":230},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.359Z","timestamp":1790071532359,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 12 Sep 2026 06:03:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aa4eb29-3509\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13577,"size_decoded":5048,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-09-23T04:46:54.207876Z","times_seen":974778,"resource_available":true,"data":null}},"time_used":805,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":805,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2023/04/feynman.png","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.379Z","timestamp":1790071532379,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2023/04/feynman.png HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Jul 2024 05:41:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f7075-55f06\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":352006,"size_decoded":352379,"mime_type":"image/png","magic":"PNG image data, 574 x 425, 8-bit/color RGBA, non-interlaced","md5":"62f36b8ef3b0851ffd48750e835db4ba","sha1":"14d9249dbd26233e5685f6388e2b27483d458d44","sha256":"fec1f716b29d2e810c452dc1bb41db9d41aede43ea25237bf85a5eb8d4e850c2","sha512":"a9bb3f9dd598b7eaf4062f719b182269edce4d5fc19e6d9cbf58cee89934c02abdb35ec97f2507941dc778f05c8e4e09b1b71a29c063b724466601052334805f","ssdeep":"6144:rgqMItZBHTYolyAUgMV2PSh0jIm5jphjBAnHPRDSeyqooksQ3r0T8R8S4ueJzSik:E3IZYCnPM9m5dFBAnHt5WsQ3IT84ihrp","tlshash":"9c742337b8575bebd181a1012bef92d37b14a889d8efc9105d2d5ad17ccba1210fb98c","first_seen":"2026-09-22T09:33:40.111483Z","last_seen":"2026-09-22T10:06:23.621713Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2023/03/role_model.jpg","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.381Z","timestamp":1790071532381,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2023/03/role_model.jpg HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 11 Jul 2024 05:41:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f7074-11cab\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72875,"size_decoded":73246,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 660x440, components 3","md5":"a8f6c9a82be10612a26ce709ec7b83f7","sha1":"46efc93cce0a3bb1d052439e02b89e5dde5080ce","sha256":"8cbcc4f9cd1491cbb5cfcd8012df4b915077d7b6790a37f6b40850d39badd8f5","sha512":"2f0e95da2072e915fcc33a2e1912956f8217590d3d733394a2a3c43d2a1b41ff66c1c054dfae89fb08c98dcc8887d5de077c015ff509395516de9b9fda5ec786","ssdeep":"1536:4xGSmPCN51hb/iscD/QedwgseH6eWCjz1uQcU66ABxdgRygSmCcudHWb//C:4vpNB/8/jdwyajCP1xcUiTgSBwC","tlshash":"d8630239b2e19041de336b8a4657da6ecab0645aa4a8078b10ecd5cc88e5ef037970f5","first_seen":"2026-09-22T09:33:40.123245Z","last_seen":"2026-09-22T10:06:23.622691Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1132,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1132,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/themes/twentysixteen/genericons/genericons.css?ver=20251101","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.355Z","timestamp":1790071532355,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/themes/twentysixteen/genericons/genericons.css?ver=20251101 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 12 Sep 2026 07:01:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aa4f8e4-6884\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26756,"size_decoded":16094,"mime_type":"text/css","magic":"ASCII text, with very long lines (18732)","md5":"ad4672625f32b11fa5406aeab79515ca","sha1":"a087352dde0fabcd5c9eb613a29af2c67100c386","sha256":"24f9a5cb64bee8bc9a7f895e3f2575142dabc595192200ccc6b838ef42170881","sha512":"66d28f787424175e82ea99e55cd49273fc894f73a690826b6b8aec3b9d3a97c3e7474adf9ff8f4401368aa4c70f0590a5d4f0e18872c1acbcdb7b085e624012c","ssdeep":"384:B6H21lHT+RERegeG2NKJtO3EdEMQvujSE2mJzJ0u39XhJfSqn5:B6W1lcNGZQ3MJjS/mJF39xJ15","tlshash":"59c2b4b6910d15a0631aea903347f7001b98712d98a0ace6f40a3c9df7e5a3cc3a37dd","first_seen":"2025-12-04T18:50:01.566932Z","last_seen":"2026-09-22T14:24:31.295275Z","times_seen":228,"resource_available":true,"data":null}},"time_used":348,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":348,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2024/12/Screenshot-2024-12-15-013214.jpg","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.374Z","timestamp":1790071532374,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2024/12/Screenshot-2024-12-15-013214.jpg HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sun, 15 Dec 2024 07:39:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"675e87a1-9c17\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39959,"size_decoded":39193,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 550x251, components 3","md5":"3edce8ed1aa0ec61cc740f9f748ed42d","sha1":"50d6e0390abc400552c300846c061da9c565266c","sha256":"261cbe29c4eaea260c943fe127d5614f036438c878c27af98ac17bc9db787972","sha512":"2d89bd469327dceb10235e4a78d9aff08eae5a961f9dcb931126a4e69c6e68cf8a0d8d4b4502abb0b3bde437625bdd4ed1dbfa35482ae68ea45c225d7797964f","ssdeep":"768:IFdEqRe4ZJoQNE/gPhE914yQ18OPdntjreHUeSbS3gHFGa1f7qr8haCy4HY:ITh/o9aIw1Pdn9re9SbugH72Ihfy44","tlshash":"fe03e21711a2dfc3b82b81c077876eb53ac36b0ab6d07df66d415fdba9106a2928405d","first_seen":"2026-09-22T09:33:40.10895Z","last_seen":"2026-09-22T10:06:23.625603Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2026/09/Screenshot-2026-09-14-001819.jpg-1024x594.png","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.361Z","timestamp":1790071532361,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2026/09/Screenshot-2026-09-14-001819.jpg-1024x594.png HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 14 Sep 2026 05:19:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aa783c4-6e3f7\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":451575,"size_decoded":451951,"mime_type":"image/png","magic":"PNG image data, 1024 x 594, 8-bit/color RGBA, non-interlaced","md5":"60b8652dda2337babb28a66f7f331bbf","sha1":"a2d5edd5e0554e6d696d696dd0649ab6f15b3f30","sha256":"a2f108af745811a6fa25a34bc93c45f977e06c526c2e2aec31439a26bd83e984","sha512":"c1684d1a78395cccae478b92077b31d93ceb25373e47666fcfd784c14ab0c9b34ce24c86d2ee8d2c9a51372b235283133d7297a14669c2a9fc113bc50f784cc9","ssdeep":"12288:t60kLEbTHAsI9yRnYJUaU0EEn8DIstTHsrYM4:t6tL4EsIinYGHLlEsdsrYM4","tlshash":"bca423cb40cdbc5302dfac67caa2106693364737d47d0e90dd026a0c6d9e96ad19fbe9","first_seen":"2026-09-22T09:33:40.096019Z","last_seen":"2026-09-22T10:06:23.627683Z","times_seen":2,"resource_available":false,"data":null}},"time_used":918,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":918,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2023/05/starship_explosion.png","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.378Z","timestamp":1790071532378,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2023/05/starship_explosion.png HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Jul 2024 05:41:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f7075-1d7e3\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":120803,"size_decoded":121176,"mime_type":"image/png","magic":"PNG image data, 488 x 423, 8-bit/color RGBA, non-interlaced","md5":"11e486954d7b83855c4cf030af7b9714","sha1":"29f8fb6edbe23ee8b53b6d0b0aca41537e259812","sha256":"c1788dbb8b2b57dc83e1b0eb82ebede533d4230a8768319cd580cb46a512b55b","sha512":"4558c06b69a5e7db8935fd4684039b6f2ff13b10de5e9f1ff9322d2324c9440a5b5ecc7f3773025aca6468a319a475cdd7be87ed92fe15bb955e3be3371e9c22","ssdeep":"3072:+TgDR9LN9rHVOE5j6QI4/dxxCNYb2P5k/Zk/c4pNrTivwoX2:+a7N9rHs6j6t4Fxb2hk/Wc4pNrTiHm","tlshash":"69c3128cfa8873df65188b34067d7665f36078c5c9d22e93ea784361c26a4c64d0fee0","first_seen":"2026-09-22T09:33:40.110088Z","last_seen":"2026-09-22T10:06:23.628603Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1135,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/themes/twentysixteen/fonts/montserrat/montserrat-latin-400-normal.woff2?ver=25","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:33.281Z","timestamp":1790071533281,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/themes/twentysixteen/fonts/montserrat/montserrat-latin-400-normal.woff2?ver=25 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://primoweb.com/wp-content/themes/twentysixteen/fonts/merriweather-plus-montserrat-plus-inconsolata.css?ver=20230328\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:33 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 12708\r\nlast-modified: Sat, 12 Sep 2026 07:01:56 GMT\r\nvary: Accept-Encoding\r\netag: \"6aa4f8e4-31a4\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12708,"size_decoded":13094,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 12708, version 1.0","md5":"b4a68b1e743ee317eaaf0bbadd131571","sha1":"f24f7823d4e3830c7cfa5bcb33733d2897c00f13","sha256":"ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394","sha512":"b3bf2523c9cf0ed55365ff6f03375512d478239297a2af99b839f15d59e49094b03e085fca8918faa75b928fe1531376070018ea5fdb07c3e8743e6253a14ed7","ssdeep":"384:uvrIB27G1PF5LfsdGAu0lKtDvJL8REbg/qif0:sY27a8xovJg2SfM","tlshash":"dc42d0753492f402b159fef554ae6fb0f802d1da7b81bf574116d1a0461c8c789bee0e","first_seen":"2023-04-05T14:23:20Z","last_seen":"2026-09-22T23:10:17.985302Z","times_seen":8420,"resource_available":false,"data":null}},"time_used":1372,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":916,"receive":456,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/themes/twentysixteen/fonts/merriweather/merriweather-latin-400-normal.woff2?ver=30","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:33.282Z","timestamp":1790071533282,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/themes/twentysixteen/fonts/merriweather/merriweather-latin-400-normal.woff2?ver=30 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://primoweb.com/wp-content/themes/twentysixteen/fonts/merriweather-plus-montserrat-plus-inconsolata.css?ver=20230328\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:33 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 20028\r\nlast-modified: Sat, 12 Sep 2026 07:01:56 GMT\r\nvary: Accept-Encoding\r\netag: \"6aa4f8e4-4e3c\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20028,"size_decoded":20414,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20028, version 1.0","md5":"2bfde17b9a1384ce64af78db1b87a82f","sha1":"8effd23e482511e249c3f8e91cdc503729b93598","sha256":"5c2d662e92bcbf1a5970b97040f901031295e79a96314db8302f549003022087","sha512":"4aa4665aeb9d038078b303448d56cf14db8ea43739380cda67ba63f738abfe77470686d67e1d04fb1c784fccbf9a053c246f440e0f638ae790b6a6146b10e0dc","ssdeep":"384:rsI3Ql/p69zMPrE1cP232AphZG/66KSRKFUfGTsvNGRqt:wIAW9zoCvoZ9XMK","tlshash":"be92e16c996b25b5ed706bbda1184eec3b6f7a3ae0c0f17b85cc29d070a2930b1500f4","first_seen":"2023-04-05T14:14:51Z","last_seen":"2026-09-23T02:06:21.64662Z","times_seen":4634,"resource_available":false,"data":null}},"time_used":1371,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":915,"receive":456,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2025/05/tds-vax-600x907.jpg","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.372Z","timestamp":1790071532372,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2025/05/tds-vax-600x907.jpg HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 14 May 2025 17:45:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6824d6c5-28494\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":165012,"size_decoded":163663,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: \"Created with GIMP\", baseline, precision 8, 600x907, components 3","md5":"54c6b51e88653125ef82da257d8743f5","sha1":"9fa3e431f8bf1a149a2a8bbb2d0833da0d11fc12","sha256":"6bb1fad5869fafbb72d2e4e9e7e9a484d91e1edc3ba47df4a3e30bfb53080e1a","sha512":"9def31c9803e1acc6dbd835c43f1867a60b78c6f6dd8c8a0a70666fc7148dd9ddf0f196eda582448e81847d39fde0011a2a088494712c264c85430a50ebb6af6","ssdeep":"3072:qJaeZOR2H3PH2d2PwRrh/rlIK7XyjAqlr75iR95cvaY+AgZSGVMXVmx:teZJfWdDjlhryPr75s92vcAgZSpgx","tlshash":"0af312752b1a3ee3f5c65f34bcc9c045b6e0cabd89c57a8584f8fa5877c2a9520dca01","first_seen":"2026-09-22T09:33:40.114833Z","last_seen":"2026-09-22T10:06:23.63143Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1140,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2023/05/grand_canyon-1024x683.jpg","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.375Z","timestamp":1790071532375,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2023/05/grand_canyon-1024x683.jpg HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 11 Jul 2024 05:41:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f7090-3bbcc\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":244684,"size_decoded":235265,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 240x240, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=11, description=dawn on the S rim of the Grand Canyon, manufacturer=Canon, model=Canon EOS 5D Mark III, xresolution=212, yresolution=220, resolutionunit=2, software=Adobe Photoshop Lightroom 4.4 (Macintosh), datetime=2013:04:13 01:36:00], baseline, precision 8, 1024x683, components 3","md5":"d8431deda762b624044a3240864776dc","sha1":"6debed801192e752b4cfb6103ca45425324865fd","sha256":"0c7c1edb91551d06e278bbe0a586a6adedbc0f8304a49bf8d24a3ca5fa6a18cc","sha512":"967adfab363f6fd96b2e421dec822d4a8ef208a9fd802e59e2cca0376c13be0b4c066dc30541a5040a05c507c4bc3f69ef6a5a5d43c2f128fe8e9f33751c24a9","ssdeep":"6144:5LUqJ/yfi0AsqCT+4WLxQIkkDfa10EFfSxUWcj5Z1mp4KrDM:5LT/yAE+4W1QLkrG0ExSMdZmLI","tlshash":"4834129ca91139d0e46cad7f90d7068ab4221663c852a42bb1fcd920bf399c65d4fe37","first_seen":"2026-09-22T09:33:40.13676Z","last_seen":"2026-09-22T10:06:23.632237Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2023/05/dahmer.png","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.375Z","timestamp":1790071532375,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2023/05/dahmer.png HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Jul 2024 05:41:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f708d-2f4ad8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3099352,"size_decoded":3099768,"mime_type":"image/png","magic":"PNG image data, 1000 x 1471, 8-bit/color RGBA, non-interlaced","md5":"6951af18d06b08b2792d22c27ae3bcc3","sha1":"668fe9fdf6206fdf7737c5f69e339d618169295f","sha256":"af19a3006ec717fad1b2e5dd8fc06ee69a65be1cb4a12798fbe600886da1b21c","sha512":"e9a5a4fb6cad9914af5166c20086fe2a5908c43bc5b3b4e949640543516cecdae822300ade271dedc26f4e46cdf957faa8dcb05d0f2de97682f7b4e9846f630d","ssdeep":"24576:Z/GSSogX3NWEjtbsoa90N6Fz9GjNKONfZ3XkGIqk+8qo:9GSsHNTsls6lEKikGeyo","tlshash":"a32533a3da198bdce9d6510c7109a8aee3c7b76082f58655042fafdf3b7d2c92532700","first_seen":"2026-09-22T09:33:40.116469Z","last_seen":"2026-09-22T10:06:23.633595Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2023/05/master_and_commander.jpeg","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.377Z","timestamp":1790071532377,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2023/05/master_and_commander.jpeg HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 11 Jul 2024 05:41:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f708c-219af\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":137647,"size_decoded":138021,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 960x412, components 3","md5":"0f4c6749eb13defc9ea28f1ceead61d6","sha1":"e0373f8f2d67236fa54eeb70d05375695ceec03d","sha256":"8727c1f8b996b08a9b9aec6c7d0cb7263e957a918500290d1b9685d3525eb29a","sha512":"34b2d3df81bd5f67248cf97cfc894fee30db346681b553eaa90d4913fd22f44e2ebe84fc588199272d61a15684594ee33015117c1b957244fc46b1d42c6a34f9","ssdeep":"3072:Vz5sIsSqaPZNZOsPqXs1wYSy0eN5rrEQLolSZsonA:fsSqaPH4sPqch0+xrBLolSZDnA","tlshash":"06d312205b507b7279fb766f8b07c7c3ba4d0bf270b6cc6b86302226563491952b986d","first_seen":"2026-09-22T09:33:40.145137Z","last_seen":"2026-09-22T10:06:23.634703Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1135,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2017/02/cropped-PRIMOWEB-150x150.png","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:38.465Z","timestamp":1790071538465,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2017/02/cropped-PRIMOWEB-150x150.png HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Jul 2024 05:40:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f7049-715\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1813,"size_decoded":2181,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit grayscale, non-interlaced","md5":"b450ac7d84a1440e3f774cf5e9f3db0b","sha1":"b943d4a4adf8bb7c1e6a2e7af572037feba9807e","sha256":"6f8e3390bffd5cfc48a1908c0474c4320395033d14ffc57dd925e305751111a5","sha512":"bb9ea71fe8efb5065ca1e795cd831efe70d66f9e644b23789afdbc081dd47d6979c2992c38b0a6502e918fe11d95c8c4aaf8420460dc1717c1c69f22def0646a","ssdeep":"","tlshash":"5e312bc026794613c34da0d3710d6e5d362c4630d8bb0f9a69d79cde35970384a1463d","first_seen":"2026-09-22T09:33:40.146526Z","last_seen":"2026-09-22T10:06:23.635469Z","times_seen":2,"resource_available":false,"data":null}},"time_used":536,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":536,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-includes/css/dist/block-library/style.min.css?ver=7.1.1","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.352Z","timestamp":1790071532352,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-includes/css/dist/block-library/style.min.css?ver=7.1.1 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 17 Sep 2026 20:14:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aac4a09-2261d\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":140829,"size_decoded":17439,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"a79a37e2ca447803804c6f5a6a892558","sha1":"fbe3a9b4ec1462088ae10fde82ad016e226794c9","sha256":"222ca4216c4f17530a03bf9701410b689d7d9c953c8ddcc9d4e8722d69c348aa","sha512":"7813f0cf173536ba067dea758c6fb457d318c036104e643879bce2ef0577a616930dc009989fbf8e343400c7b29913a4d4b736c8392b5c4242ce18364489b59c","ssdeep":"3072:XkeJG/pQg5Mmjx+qehFP01nckRiBmgT0cTrnbO23kIzcZozg:K/pQg5Mmjx+qehFP01nckoPkIQZz","tlshash":"d9d3831417b4dcf934ffa73a5e4ee358a607aa01c68967e6e066d190618ca490df3f0f","first_seen":"2026-09-17T20:15:14.466864Z","last_seen":"2026-09-23T04:38:58.397447Z","times_seen":270,"resource_available":true,"data":null}},"time_used":237,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":237,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/themes/twentysixteen/fonts/merriweather-plus-montserrat-plus-inconsolata.css?ver=20230328","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.354Z","timestamp":1790071532354,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/themes/twentysixteen/fonts/merriweather-plus-montserrat-plus-inconsolata.css?ver=20230328 HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 12 Sep 2026 07:01:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aa4f8e4-4b81\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19329,"size_decoded":1410,"mime_type":"text/css","magic":"ASCII text","md5":"a8c277231f2c3400baa9fe0e738152a9","sha1":"5b1b640d498c40e1a72b75e26ca3ccd04bc5eb4c","sha256":"71adc15350145604f7a2794da7be297e14345f3fb31c4ea37c8a97e5e0b2ccd0","sha512":"7c9442acaa26880097dbf8e15055f48a65913f4eb337aa7a02551a7515b6a59bf2a5f1d0cb8c648ee0beb1dc8565e38eaa05a09b5429d62638e0c621c122fc62","ssdeep":"384:Ap765y9vhIJpTzCrXQG6jnz9esAfDXeBrTW:AD","tlshash":"5c9277314855611e5687df95a3ceae62960c3cf35c20b821adfca850aeda8791351fce","first_seen":"2023-04-05T14:46:22Z","last_seen":"2026-09-22T14:24:31.261897Z","times_seen":655,"resource_available":true,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"primoweb.com/wp-content/uploads/2017/02/primoweb-header.png","fqdn":"primoweb.com","domain":"primoweb.com","tld":"com"},"ip":{"addr":"3.137.78.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://primoweb.com/","date":"2026-09-22T10:05:32.366Z","timestamp":1790071532366,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"primoweb.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 05:14:59 GMT","end":"Fri, 11 Dec 2026 05:14:58 GMT"},"fingerprint":{"sha1":"D9:8E:7A:D2:EF:C8:32:6C:2C:F7:4A:B7:9F:F3:1D:38:A3:12:49:D6","sha256":"02:32:93:51:6D:52:B2:0B:0C:E0:2F:A6:BD:F5:48:E3:B8:E5:88:8A:36:B8:5D:2D:93:00:B4:02:0E:81:5F:BA"}}},"request":{"raw":"GET /wp-content/uploads/2017/02/primoweb-header.png HTTP/1.1\r\nHost: primoweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://primoweb.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 10:05:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 11 Jul 2024 05:40:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668f7049-1232\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4658,"size_decoded":4935,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"e2dcb968b2e6e2f17bd03da418bd270f","sha1":"36d71b1fcb165cd347f84e45d207f31959a6311e","sha256":"1e2de64f8a5ccc41263d7980fd3370255231fc6ce96a4e1fee5078d285775df6","sha512":"7f77814d3b34d76d02bc9ea18f6e96e7b4d605f9323035d32a49bc377e15b38ea4727e505eaab771a60c025b8f77f04922359b0cb111aaeb0f7bce16b7f78a6b","ssdeep":"96:8S8qdJ/4DGUncoLTVAyiJOfxf3vLDMqyDn0jUEO2:8SXP4DHconVCkfx7DJyDnwUq","tlshash":"9ca18d99d260f1d58f97f97ca61d6fabcd6b080810d1860bcdeebd7e8180c2d02a471b","first_seen":"2026-09-22T09:33:40.120418Z","last_seen":"2026-09-22T10:06:23.637733Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1145,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"primoweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"primoweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}