{"report_id":"ded0af4a-2d1c-4b84-99b7-536a11fa5efe","version":0,"status":"done","tags":["phishing","skyw4lker","aitm"],"date":"2026-07-18T18:09:18Z","url":{"schema":"http","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":0,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?ZBkf5dR5\u0026PAjFt84MDgLdCSS=nTf7tb\u00263VEE=ivxawN1U0pc2KlT4atGt68p4M4R5IfD\u0026t-2cpFOqVStesMT-Q_mDAnSEb\u0026sY4kgkQt=f66K9zeRtf24tadwLH=39Xhs3=ZAj3XntDpZZs3tW\u0026Uv06yezguGmwSfUPgchNw\u00268L4fqtB24N3E\u00261\u0026locales=en-US","fqdn":"runro.info","domain":"runro.info","tld":"info"},"title":"Please si‪gn ‭in to continue","dom":{"size":239313,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7946)","md5":"f0f86f2f3982709f8cfa0110b5a822cd","sha1":"711352dc2515f8a6fcf83157e3e7f2d68698dcd4","sha256":"7419d2b872a05907809bd53671a549932c6cfa6dce2096e515061d985531a261","sha512":"cea0e39f17a9fafc3ffa5df202772b39b9575d72477d1921b5d796538ed1e8a7804d93cb825c13315d10e0fb6a41b969a49591182797e1d68c6e97178e2bbb73","ssdeep":"3072:9PWLFuODRd7hv7h8UYGlYG1i7hYF1gYG2YGkhZ7hOYGg:VWLFuO3hTh8Urlr12hPr2rwRhOrg","tlshash":"e234c82241fa107204b2a7ea5aee374c73f4f0bbd5566a05f59d12a8cfafe04364359c","dom_hash":"domhash817c278378160eeb4ffdd42804b28f61","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":0,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-22T18:09:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"runro.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"runro.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Skyw4lker Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","skyw4lker","aitm"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Skyw4lker Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","skyw4lker","aitm"],"meta":null}]},"summary":[{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-07-12T22:42:14.264548Z","alert_count":0,"request_count":2,"received_data":98328,"sent_data":1006,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"ipapi.co","ip":{"addr":"104.26.8.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-07-16T01:19:31.086188Z","alert_count":0,"request_count":1,"received_data":2491,"sent_data":446,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.65.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-07-12T23:52:49.76326Z","alert_count":0,"request_count":1,"received_data":90144,"sent_data":460,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]},{"fqdn":"aadcdn.msauth.net","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2018-10-25","domain_rank":5248,"first_seen":"2018-11-19T10:50:03Z","last_seen":"2026-07-15T18:24:36.097154Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":602,"comment":"","tags":null,"fingerprints":null},{"fqdn":"runro.info","ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-17T15:03:11.463206Z","last_seen":"2026-07-17T15:03:13.653959Z","alert_count":15,"request_count":5,"received_data":940276,"sent_data":3300,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"crypto-js:4.0.0","description":"crypto-js is a JavaScript library of crypto standards.","website":"https://github.com/brix/crypto-js","common_platform_enumeration":"","icon":"default.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Skyw4lker Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","skyw4lker","aitm"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"9c8f677798e03b02df76e69497d29b34","sha1":"388d4c8e5f0a173782d2a7d5fd6287339680f309","sha256":"5c56f7fe93e5e5409cafc63d711409d451ee84c4f6948aa578f6356ecaba3b66","sha512":"1030d38bb4fde0f0e175dc2c3a712ad0c34d00b56c7b57cabc18854a19f11a2c2f423e6e7ae3b87a9011938ebdcd312c05b494410f0e0aa561d4714c95b6980d","ssdeep":"6144:LKpi1gJMzte1Dg+BTLkqpfwOA17w2ABaDej/nfUFjEdJ1JaU+56oL+jkFQ0c69bG:mp5MxAsu/HhwxZ2/dj1JMnk0cdgg","tlshash":"cf15a8f05700dcc0d52b5a32b9bd7b98f2391277dbcd5acc1254bae12ef2a11a90dd89","size":915764,"data":"","first_seen":"2026-07-18T18:09:21.723768Z","last_seen":"2026-07-18T18:09:21.723768Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2ca03ad87885ab983541092b87adb299","sha1":"1a17f60bf776a8c468a185c1e8e985c41a50dc27","sha256":"8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762","sha512":"13c412bd66747822c6938926de1c52b0d98659b2ed48249471ec0340f416645ea9114f06953f1ae5f177db03a5d62f1fb5d321b2c4eb17f3a1c865b0a274dc5c","ssdeep":"768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS","tlshash":"19231ac5a19c605152a774c40d7f704b7463352a070d8aacf668e9eeecfcaea9039d7c","size":48316,"data":"","first_seen":"2023-03-07T01:31:53Z","last_seen":"2026-07-19T06:19:02.886506Z","times_seen":153231,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/assets/js/url_helper.js","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8ec656b311fa5272646369a94ef1debd","sha1":"1c4293bcf0468ff391ecd182754ca2cb27d5ce91","sha256":"c14735c3ab35ffe363e9a2d1257d8168344fdee90068945e47e06f234763c1d4","sha512":"31b0a7cff0a2338872bb55caadbbf516956685bdbd37f8d69723a9338b4531ae2a31950ab5c4a25ddabc37ed1513f305b0c5e429595a071a081d4c7e98cbe0c5","ssdeep":"","tlshash":"5411cc4fb813e36146b34f60820bb4b4fb76112736419105b8acc3911fb6c2ed563dc9","size":1067,"data":"","first_seen":"2025-05-07T15:40:30.841103Z","last_seen":"2026-07-18T18:09:21.723107Z","times_seen":146,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/assets/js/endpoint.js","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8716f6b043b6f33510cdc38fd963cbb6","sha1":"9ba426d72ddf366081b72876ecb0c4fe4343573e","sha256":"0e78922ab17c205081d2407e438a8dd813462b6dbf89f3554d52f83da556de2f","sha512":"481285fcf44e3f4c92a54aa8b6bd280dd343b560b429ddb65e9780d768136e00cfdd59cf2599a0adaf8f642cb2ce53170b014c1da10e3a4e1ab2c7cc1ba897d3","ssdeep":"","tlshash":"4751de4c24ffa4210f07b869554f5d047269e4476a4eac5aba8c03906f0d2ddd477ed9","size":2782,"data":"","first_seen":"2025-12-09T13:39:20.793788Z","last_seen":"2026-07-18T18:09:21.720568Z","times_seen":141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.0.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.65.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-07-19T06:20:55.050228Z","times_seen":491888,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"06e06653c9965a29dc11b9cf4a7f4153","sha1":"a1a01d5f446389a638c208f480e1cc1762b9955e","sha256":"e2fa06b15d2a2d30e26567b4cfae73d94fae25b87d7b5beac35136c4096ba5eb","sha512":"bfc1e1cf859377dcaca40d80f0d1eaff298ca1ac9987d414a6674ef37ad56cce94d94ddd8a3408c47e2b1d46c76251c3c8b992cb5888b07603b668b942a1b930","ssdeep":"768:qWwcq9zaYSDrhXoD0j2BI/xRZlb1mWIIxuDt4lLpeHh2GHgeQs:iYYWXp7h8w0Hh2GHRH","tlshash":"8d438661d1fe206604b7b2fe599a630c32f4f0b7e9856906f19d12a4cfbfe243603599","size":57620,"data":"","first_seen":"2026-07-18T18:09:21.724635Z","last_seen":"2026-07-18T18:09:21.724635Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cf3402d7483b127ded4069d651ea4a22","sha1":"bde186152457cacf9c35477b5bdda5bcb56b1f45","sha256":"eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc","sha512":"9ce42ebc3f672a2aefc4376f43d38ca9ed9d81aa5b3c1eef60032bcc98a1c399be68d71fd1d5f9de6e98c4ce0b800f6ef1ef5e83d417fbffa63eef2408da55d8","ssdeep":"768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe","tlshash":"9c231bc1a19c219152a774d0093f7107b463353a460ed5acf668e9eeecbcaea903dd7c","size":47992,"data":"","first_seen":"2023-03-07T12:04:24Z","last_seen":"2026-07-19T05:11:03.474858Z","times_seen":76949,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3d33dba8c908a948433240a290f317f","sha1":"0ed00b82d1001d95ddf508683f3eb1b5c7541854","sha256":"27083ece37cb84c11b732130452230175c13dfdeb466367e0e4dda3506a30633","sha512":"bec5841016a4d15419f259ccb4783baef3d3a7533b4c0cdf1bcf2318c861ee756ce0259ca3d7314caf72b5d7ebf45024d492bc395a809e7c46bd3abe365ae40a","ssdeep":"3072:BmghkkyJRLFh35ATwlEKUdECCMrT11DR+bN8sSjko:sghkkybLFhGTh0CCMLDR+bN8slo","tlshash":"42858d95ccbb1051d123483abd7c79f596f23afb9bce8660037eba73de614462e44818","size":1832042,"data":"","first_seen":"2026-07-18T18:09:21.72586Z","last_seen":"2026-07-18T18:09:21.72586Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"runro.info/favicon.ico","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","date":"2026-07-18T18:08:50.827Z","timestamp":1784398130827,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.runro.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 20 May 2026 17:43:06 GMT","end":"Tue, 18 Aug 2026 17:43:05 GMT"},"fingerprint":{"sha1":"15:E0:A5:D4:B2:B8:14:6A:77:A6:1D:EC:8B:53:26:48:08:7E:7B:CA","sha256":"06:E3:BC:54:B7:35:60:31:CE:41:EA:72:3F:F5:32:96:07:53:EF:74:C9:E3:DB:88:2E:14:41:9C:D8:5C:CB:1D"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: runro.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y\r\nCookie: PHPSESSID=bhina355uvt49tbd5uussocfph; cookie_test=test\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-length: 257\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Sat, 18 Jul 2026 18:08:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":257,"size_decoded":411,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"366da9908dcfeeaff1585928ba0014f9","sha1":"23d67d03f047ebaa6a44c452d71e83a9bdf676a6","sha256":"0ad6246f49bc98373b044ccc9e43e4c92fdbe863e376ed09914791c7ade6098f","sha512":"a79b42854ccd492dbcfecb7bd8d58e5f3572f00291f56fceb96e05bb0b7b72a4ee7740a1c4930f0440b707f760d1454804274dc10932a3718b5ddadb0a9eb8de","ssdeep":"","tlshash":"f9d0959e904333d74811145039c211c227c813fab43dc1e83dc5d447625c53dcdc95cd","first_seen":"2026-07-17T15:03:16.065927Z","last_seen":"2026-07-18T18:13:19.454059Z","times_seen":8,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":129,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"runro.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"runro.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Skyw4lker Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","skyw4lker","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","date":"2026-07-18T18:08:55.226Z","timestamp":1784398135226,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://runro.info/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sat, 18 Jul 2026 18:08:55 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 13972\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Sat, 14 Aug 2021 20:33:09 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mT43iylB6B7k8dNh18WFR0mIR7xUOMZ3SLqeia2Lvh0yXHw0gI4ATAvoZgIeO%2BoNg3CpRXHuvgV2wmxf6IWAaZu3MzVG1eLcmCebNZGZuQQuE%2BLe747sLcbsy5%2BDklCyzKx8absq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a1d36f392bdb783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48316,"size_decoded":14977,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (48316), with no line terminators","md5":"2ca03ad87885ab983541092b87adb299","sha1":"1a17f60bf776a8c468a185c1e8e985c41a50dc27","sha256":"8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762","sha512":"13c412bd66747822c6938926de1c52b0d98659b2ed48249471ec0340f416645ea9114f06953f1ae5f177db03a5d62f1fb5d321b2c4eb17f3a1c865b0a274dc5c","ssdeep":"768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS","tlshash":"19231ac5a19c605152a774c40d7f704b7463352a070d8aacf668e9eeecfcaea9039d7c","first_seen":"2023-03-07T01:31:53Z","last_seen":"2026-07-19T06:19:02.886506Z","times_seen":153231,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.8.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","date":"2026-07-18T18:08:55.344Z","timestamp":1784398135344,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 05:11:37 GMT","end":"Sun, 13 Sep 2026 06:11:34 GMT"},"fingerprint":{"sha1":"CE:63:0D:F2:C0:D2:04:93:CA:AE:0D:AA:ED:9F:31:01:7A:BC:69:40","sha256":"0D:2E:E4:8D:BD:B6:76:95:B5:BD:B8:C5:CE:61:98:B9:6E:81:B5:4B:16:5C:C0:0C:C9:FB:54:0B:B4:A6:7C:65"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://runro.info/\r\nOrigin: https://runro.info\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sat, 18 Jul 2026 18:08:58 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, OPTIONS, HEAD, GET, POST\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://runro.info\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a6gKZY%2FkufeBi05RsCW1pVZYnbj5y0NQRUY28T%2FTcM2y6gqbFEQpCTqlqnJJ6eGBuCBqX2zGT6TRLDRTvj%2Boba8IvTzxb%2BKsu8xiuuahG162sQ0iUYiWCj%2BE\"}]}\r\ncontent-encoding: br\r\ncf-ray: a1d36f4d4dc5569a-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":740,"size_decoded":2102,"mime_type":"application/json","magic":"JSON text data","md5":"56fa0cc157befab41f7ca09bcbcf6ba0","sha1":"218ffc9c9caa468ff56f9abdec6fa8b77eea1362","sha256":"56ae1d62ced9e47f11decc4556f9a81def550c64ba66d466f3e5e979b7c7f43f","sha512":"0b3072e63f5c820a9042ed809be9a4ab9d051727b474a7eaf65a3e2e4275d724dce3bc3f55b7179634fa1907bebe0f1e7b302af0ae737104e53a8517fb028323","ssdeep":"","tlshash":"3c01df68e4780f7b9cb8135870786817113462175e563a8e7bd4a74d0f8d8bf30b135e","first_seen":"2026-07-09T15:47:21.439328Z","last_seen":"2026-07-19T06:02:14.366951Z","times_seen":415,"resource_available":false,"data":null}},"time_used":3315,"timings":{"blocked":0,"dns":3,"connect":1,"send":0,"wait":211,"receive":0,"ssl":3099},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-18T18:08:49.581Z","timestamp":1784398129581,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.runro.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 20 May 2026 17:43:06 GMT","end":"Tue, 18 Aug 2026 17:43:05 GMT"},"fingerprint":{"sha1":"15:E0:A5:D4:B2:B8:14:6A:77:A6:1D:EC:8B:53:26:48:08:7E:7B:CA","sha256":"06:E3:BC:54:B7:35:60:31:CE:41:EA:72:3F:F5:32:96:07:53:EF:74:C9:E3:DB:88:2E:14:41:9C:D8:5C:CB:1D"}}},"request":{"raw":"GET /5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y HTTP/1.1\r\nHost: runro.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=bhina355uvt49tbd5uussocfph; path=/\ncookie_test=test; expires=Sat, 18 Jul 2026 19:08:50 GMT; Max-Age=3600; path=/\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 5165\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sat, 18 Jul 2026 18:08:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"crypto-js:4.0.0","description":"crypto-js is a JavaScript library of crypto standards.","website":"https://github.com/brix/crypto-js","common_platform_enumeration":"","icon":"default.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}],"data":{"size":20134,"size_decoded":5608,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"5c55724fe011247a96f40fc332088adc","sha1":"40240a40c3b77b1e7db9b8b8c04b8fafdee97d3b","sha256":"93dbbf585ee36624995c3f9bd61c80927bd60e7aad66711eff1901b908a1f724","sha512":"e11d8789ecd63a53d56787620a73d49ebe5598d907d42537920f4289349c70aa9f0830c7ebbfe9c534dd4fd7624e75827213fff535143d43871cb5cf7bd9b540","ssdeep":"192:RBz9Fx+TBoXNJVqsJMPn1Ip02Y/PSZsZGOqf6MvBytDEAFBFPeMpCKWQArW/Gw8M:R3Fx+lo9S1iWJI4xgRV6kfmwwWnuTXsu","tlshash":"7992401faaf312602c53b2711fffb7693934a403a648ee193e0d27508fc7651e9927a4","first_seen":"2026-07-18T18:09:21.718746Z","last_seen":"2026-07-18T18:09:21.718746Z","times_seen":1,"resource_available":true,"data":null}},"time_used":676,"timings":{"blocked":-1,"dns":74,"connect":129,"send":0,"wait":208,"receive":0,"ssl":264},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"runro.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"runro.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Skyw4lker Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","skyw4lker","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","date":"2026-07-18T18:08:50.684Z","timestamp":1784398130684,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://runro.info/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sat, 18 Jul 2026 18:08:50 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 14107\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:09:17 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kA1JDsRB5u2IIIPxrimY92vpHdRoGNuqTaTe%2FLFYeOeq2VLNDKNXTG7FWeulFaDv2Q5vKQHf%2F1jRoOi%2FwlJv3vRuL4%2FUL%2FjWJuSNI32jBBBG%2BJK8Wff%2B7D0wBwgxVraiWE%2B1etvY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a1d36f1cdd99783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47992,"size_decoded":15122,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (47992), with no line terminators","md5":"cf3402d7483b127ded4069d651ea4a22","sha1":"bde186152457cacf9c35477b5bdda5bcb56b1f45","sha256":"eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc","sha512":"9ce42ebc3f672a2aefc4376f43d38ca9ed9d81aa5b3c1eef60032bcc98a1c399be68d71fd1d5f9de6e98c4ce0b800f6ef1ef5e83d417fbffa63eef2408da55d8","ssdeep":"768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe","tlshash":"9c231bc1a19c219152a774d0093f7107b463353a460ed5acf668e9eeecbcaea903dd7c","first_seen":"2023-03-07T12:04:24Z","last_seen":"2026-07-19T05:11:03.474858Z","times_seen":76949,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":3,"connect":10,"send":0,"wait":48,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/assets/js/endpoint.js","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","date":"2026-07-18T18:08:50.689Z","timestamp":1784398130689,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.runro.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 20 May 2026 17:43:06 GMT","end":"Tue, 18 Aug 2026 17:43:05 GMT"},"fingerprint":{"sha1":"15:E0:A5:D4:B2:B8:14:6A:77:A6:1D:EC:8B:53:26:48:08:7E:7B:CA","sha256":"06:E3:BC:54:B7:35:60:31:CE:41:EA:72:3F:F5:32:96:07:53:EF:74:C9:E3:DB:88:2E:14:41:9C:D8:5C:CB:1D"}}},"request":{"raw":"GET /5ec7a11945f75e4d12ee24828e5b1675/assets/js/endpoint.js HTTP/1.1\r\nHost: runro.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y\r\nCookie: PHPSESSID=bhina355uvt49tbd5uussocfph; cookie_test=test\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Mon, 08 Dec 2025 04:27:22 GMT\r\netag: \"ade-64569361cbe80-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization\r\ncontent-length: 900\r\ncontent-type: text/javascript\r\ndate: Sat, 18 Jul 2026 18:08:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2782,"size_decoded":1328,"mime_type":"text/javascript","magic":"ASCII text","md5":"8716f6b043b6f33510cdc38fd963cbb6","sha1":"9ba426d72ddf366081b72876ecb0c4fe4343573e","sha256":"0e78922ab17c205081d2407e438a8dd813462b6dbf89f3554d52f83da556de2f","sha512":"481285fcf44e3f4c92a54aa8b6bd280dd343b560b429ddb65e9780d768136e00cfdd59cf2599a0adaf8f642cb2ce53170b014c1da10e3a4e1ab2c7cc1ba897d3","ssdeep":"","tlshash":"4751de4c24ffa4210f07b869554f5d047269e4476a4eac5aba8c03906f0d2ddd477ed9","first_seen":"2025-12-09T13:39:20.793788Z","last_seen":"2026-07-18T18:09:21.720568Z","times_seen":141,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"runro.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"runro.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Skyw4lker Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","skyw4lker","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/assets/php/theme_selection.php","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","date":"2026-07-18T18:08:53.635Z","timestamp":1784398133635,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.runro.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 20 May 2026 17:43:06 GMT","end":"Tue, 18 Aug 2026 17:43:05 GMT"},"fingerprint":{"sha1":"15:E0:A5:D4:B2:B8:14:6A:77:A6:1D:EC:8B:53:26:48:08:7E:7B:CA","sha256":"06:E3:BC:54:B7:35:60:31:CE:41:EA:72:3F:F5:32:96:07:53:EF:74:C9:E3:DB:88:2E:14:41:9C:D8:5C:CB:1D"}}},"request":{"raw":"GET /5ec7a11945f75e4d12ee24828e5b1675/assets/php/theme_selection.php HTTP/1.1\r\nHost: runro.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=bhina355uvt49tbd5uussocfph; cookie_test=test\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Sat, 18 Jul 2026 18:08:53 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":914408,"size_decoded":457041,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"190990771d64a9d52f6404c26942c7fc","sha1":"eed6946cf52b017647fe1ae1215047714e77817a","sha256":"26f3c67b9919af88cbaffc2ee9a256194f62546caa5bd9421c87d1ab5ea7faf0","sha512":"e5c415f40870520c1aa0d27bfa012b7011146f28384789113890837443bac03a145efb8f94724cdf9533a46d78a036db77c9f1c5e2c276f6325f6b8b4a58c67c","ssdeep":"6144:5Kpi1gJMzte1Dg+BTLkqpfwOA17w2ABaDej/nfUFjEdJ1JaU+56oL+jkFQ0c69by:Up5MxAsu/HhwxZ2/dj1JMnk0cdgE","tlshash":"a715a8f05700dcc0d52b5a32b9bd7b98f2391677dbcd5acc0254bae12ef2a11a90dd89","first_seen":"2026-07-18T18:09:21.721074Z","last_seen":"2026-07-18T18:09:21.721074Z","times_seen":1,"resource_available":false,"data":null}},"time_used":406,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":406,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"runro.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"runro.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Skyw4lker Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","skyw4lker","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.0.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.65.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","date":"2026-07-18T18:08:55.224Z","timestamp":1784398135224,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 20 May 2026 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:F8:0F:C4:8F:BC:F5:01:B1:66:91:CC:15:DC:D8:6E:5D:2F:45:4E","sha256":"05:8E:2E:14:85:E2:41:28:F5:18:A4:37:49:31:2B:0E:24:53:64:3F:02:15:BE:63:EF:F4:B8:53:5A:8B:6D:29"}}},"request":{"raw":"GET /jquery-3.6.0.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://runro.info/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-15d9d\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Sat, 18 Jul 2026 18:08:55 GMT\r\nage: 1927214\r\nx-served-by: cache-lga21931-LGA, cache-bma-essb1270069-BMA\r\nx-cache: HIT, HIT\r\nx-cache-hits: 373015, 491303\r\nx-timer: S1784398135.253626,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30875\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":89501,"size_decoded":31518,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-07-19T06:20:55.050228Z","times_seen":491888,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":2,"connect":9,"send":0,"wait":11,"receive":2,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aadcdn.msauth.net/shared/1.0/content/images/backgrounds/4_eae2dd7eb3a55636dc2d74f4fa4c386e.svg","fqdn":"aadcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","date":"2026-07-18T18:08:55.365Z","timestamp":1784398135365,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /shared/1.0/content/images/backgrounds/4_eae2dd7eb3a55636dc2d74f4fa4c386e.svg HTTP/1.1\r\nHost: aadcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://runro.info/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-19T06:20:46.341232Z","times_seen":17358522,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"runro.info/5ec7a11945f75e4d12ee24828e5b1675/assets/js/url_helper.js","fqdn":"runro.info","domain":"runro.info","tld":"info"},"ip":{"addr":"167.88.164.132","port":443,"asn":14956,"as":"ROUTERHOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y","date":"2026-07-18T18:08:50.687Z","timestamp":1784398130687,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.runro.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 20 May 2026 17:43:06 GMT","end":"Tue, 18 Aug 2026 17:43:05 GMT"},"fingerprint":{"sha1":"15:E0:A5:D4:B2:B8:14:6A:77:A6:1D:EC:8B:53:26:48:08:7E:7B:CA","sha256":"06:E3:BC:54:B7:35:60:31:CE:41:EA:72:3F:F5:32:96:07:53:EF:74:C9:E3:DB:88:2E:14:41:9C:D8:5C:CB:1D"}}},"request":{"raw":"GET /5ec7a11945f75e4d12ee24828e5b1675/assets/js/url_helper.js HTTP/1.1\r\nHost: runro.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://runro.info/5ec7a11945f75e4d12ee24828e5b1675/zTRMvceQSE3ahg5En8iMnz62qQVqzQfhqVOp?yQt-=LGVkp7hARNu_G5gU7AdP2=FZa=MePG4zoyGopC3c=ygCoftgJ-gR-035n4y\r\nCookie: PHPSESSID=bhina355uvt49tbd5uussocfph; cookie_test=test\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Thu, 10 Jul 2025 14:01:44 GMT\r\netag: \"42b-63993a22b8200-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization\r\ncontent-length: 467\r\ncontent-type: text/javascript\r\ndate: Sat, 18 Jul 2026 18:08:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1067,"size_decoded":895,"mime_type":"text/javascript","magic":"ASCII text, with CRLF line terminators","md5":"8ec656b311fa5272646369a94ef1debd","sha1":"1c4293bcf0468ff391ecd182754ca2cb27d5ce91","sha256":"c14735c3ab35ffe363e9a2d1257d8168344fdee90068945e47e06f234763c1d4","sha512":"31b0a7cff0a2338872bb55caadbbf516956685bdbd37f8d69723a9338b4531ae2a31950ab5c4a25ddabc37ed1513f305b0c5e429595a071a081d4c7e98cbe0c5","ssdeep":"","tlshash":"5411cc4fb813e36146b34f60820bb4b4fb76112736419105b8acc3911fb6c2ed563dc9","first_seen":"2025-05-07T15:40:30.841103Z","last_seen":"2026-07-18T18:09:21.723107Z","times_seen":146,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-18","alert":"Phishing Block","trigger":"runro.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"runro.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Skyw4lker Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","skyw4lker","aitm"],"meta":null}]}}]}