{"report_id":"e08219e2-49e6-494f-99be-b83ec1ba0194","version":0,"status":"done","tags":[],"date":"2026-10-07T15:45:55Z","url":{"schema":"https","addr":"why777.run/","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":0,"asn":200088,"as":"Artnet Sp. z o.o.","country":"Poland","country_code":"PL"},"final":{"url":{"schema":"https","addr":"why777.run/","fqdn":"why777.run","domain":"why777.run","tld":"run"},"title":"Рабочее зеркало Wha — быстрый доступ к официальному сайту казино","dom":{"size":82020,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (49892)","md5":"bbe8fd5d881821def0967009826a96f3","sha1":"212a9be20307e510b3db70f099bfda0fc101dc7c","sha256":"af41e3b466008c9a80d8ae8f673b4ce1ce86ff2f09e76fb6f7e12d5d27f39668","sha512":"76d9efd089aeb3548b6e2e7d764d4136390faef0d78876f826fddd25994c9136291ed0f330c049a306fe0731fb8f8dd0b2457fd0a3808902ebf4ff79cab29467","ssdeep":"1536:1i1yp8Ze64/hwSnFnczaaThBkdc89Ovjog3/8MFjll7Bk4vIsw+zWXy8vej6NbBm:HNZBSdPPvYAlT","tlshash":"e283d92553643298501ae569eed4ab0c333940b9bf5b47f529f13c2993ce9f803b672e","dom_hash":"domhash90890bdbee45fc35f44b0a7ec03f1ddb","first_seen":"2026-10-07T15:27:03.651758Z","last_seen":"2026-10-07T15:45:56.710612Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"why777.run/","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":0,"asn":200088,"as":"Artnet Sp. z o.o.","country":"Poland","country_code":"PL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-11T15:45:55Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"why777.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-10-04T22:46:21.559025Z","alert_count":0,"request_count":4,"received_data":126316,"sent_data":2260,"comment":"","tags":null,"fingerprints":null},{"fqdn":"why777.run","ip":{"addr":"92.63.227.153","port":443,"asn":44942,"as":"Digitalreti srl","country":"Italy","country_code":"IT"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-10-07T15:26:57.005576Z","last_seen":"2026-10-07T15:26:57.005576Z","alert_count":5,"request_count":5,"received_data":170659,"sent_data":2618,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"W3 Total Cache","description":"W3 Total Cache (W3TC) improves the SEO and increases website performance and reducing load times by leveraging features like content delivery network (CDN) integration and the latest best practices.","website":"https://www.w3-edge.com/wordpress-plugins/w3-total-cache","common_platform_enumeration":"","icon":"W3 Total Cache.png","categories":["Caching","WordPress plugins"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-10-04T22:47:16.540786Z","alert_count":0,"request_count":1,"received_data":36465,"sent_data":636,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"why777.run/","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":443,"asn":44942,"as":"Digitalreti srl","country":"Italy","country_code":"IT"},"introduction_type":"scriptElement","is_inline":true,"md5":"266b8ab0b7bd72eb965ec00507cf99d6","sha1":"7032cc6ff7c7d0643fed66a8bef24e1eedd94b64","sha256":"883b3ac3e9de261ff89dc23ee8a000e210d5721df7569bcdd575c74738ed6b51","sha512":"742bcde316a834c1a89f17e42d92bd87eb719d82e1231b12b94f30d646a3239c836ccba0615be5b9f9b79f34b40797ac788f6701a25e4fd97696835ad3a824de","ssdeep":"","tlshash":"65e0d8b3aa874d3d14aa76239731665c367d88856f133803049d1dd404d8f5554f4e8c","size":368,"data":"","first_seen":"2024-08-20T01:51:17.397201Z","last_seen":"2026-10-07T15:45:56.722763Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"why777.run/","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":443,"asn":44942,"as":"Digitalreti srl","country":"Italy","country_code":"IT"},"introduction_type":"scriptElement","is_inline":true,"md5":"3cd8627224e4feddca8b18d60481c403","sha1":"4299424b2c41996dcedad9a9d15a43a76f27e88b","sha256":"146fe73a4dfef3e739a09891b8214f9400036edcc78ec29df2407f33157287a6","sha512":"5d1c47fc9d1d75a12054ee8d7021e469d901882ca15d7ded781e6209518e2550c6c09436a771eb0be0b68d7f9e76c3e65f0ff3a8e80fa30fdf2fe564c7839175","ssdeep":"","tlshash":"fdf0c0ebb6c030b3834a1166f53f2b3ad46b1ef24d2dd8488a10c5503164c2ac13aa9c","size":525,"data":"","first_seen":"2026-05-14T19:57:51.446424Z","last_seen":"2026-10-14T18:44:39.774331Z","times_seen":135,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"why777.run/","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":443,"asn":44942,"as":"Digitalreti srl","country":"Italy","country_code":"IT"},"introduction_type":"scriptElement","is_inline":true,"md5":"d7d20ecfd52a58a26e6c1a4849280e5a","sha1":"88af904c47c15c8db23bead9f4b352a9e5ee17ef","sha256":"87759be0029d31f5ad6a49a927fa315232b30e00f4507dea9b48074e3988621d","sha512":"50adcf9335c3508ad68dd7aca3f789a3fb50502f5c1d67c9f0c79358966a608e5e657fed68e52d18f6f9acace64851535803789de3f300a4182703063f72391a","ssdeep":"","tlshash":"d7f0a389fb7e6db80782b229820f3316f636866f54460481dd33ebf088556cab50345b","size":454,"data":"","first_seen":"2023-03-07T12:03:49Z","last_seen":"2026-10-14T18:44:39.94926Z","times_seen":780,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://why777.run/","date":"2026-10-07T15:45:22.655Z","timestamp":1791387922655,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://why777.run\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:54:13 GMT\r\nexpires: Tue, 05 Oct 2027 15:54:13 GMT\r\ncache-control: public, max-age=31536000\r\nage: 172269\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":38569,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-10-15T10:27:31.455026Z","times_seen":571572,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":28,"dns":0,"connect":0,"send":0,"wait":38,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459W1hyyTn89ddpROi.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://why777.run/","date":"2026-10-07T15:45:22.657Z","timestamp":1791387922657,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459W1hyyTn89ddpROi.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://why777.run\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 23776\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 06 Oct 2026 04:03:34 GMT\r\nexpires: Wed, 06 Oct 2027 04:03:34 GMT\r\ncache-control: public, max-age=31536000\r\nage: 128508\r\nlast-modified: Thu, 04 Sep 2025 17:11:55 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":23776,"size_decoded":24589,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23776, version 1.0","md5":"61611e47a80abeae7bab6335b074c70b","sha1":"6902954d25cbd00a037f12421a0d25580a0a81f7","sha256":"6e310df94df0c3e75cd1c6ecd08e22cc559eb0667d54013afdc469671ef4614a","sha512":"8207ee33de460e5f705a53a54ed45f4ad921141672b995584b2718a9bee837ae3331647f0f8fa9b62b812e6b54f9397e1da11160f9b3bf51ae39fc1ec32bb07b","ssdeep":"384:uEEi3OYr7g0sF91UG3qkcKtr40D/w18XHu3Nr/UL2s+HSeSN/Z26s6A296:fEieY/gfj1UVKSow1TVs+HY/Z/a","tlshash":"d4b2e142401cf0b1e7c76f7daacf24c095d613bacf3f95981145db7855ad5932c9c88a","first_seen":"2025-09-05T05:16:31.285834Z","last_seen":"2026-10-15T11:08:02.429448Z","times_seen":12895,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":27,"dns":0,"connect":0,"send":0,"wait":19,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"why777.run/wp-content/uploads/2026/01/cropped-favicon-192x192.png","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":443,"asn":44942,"as":"Digitalreti srl","country":"Italy","country_code":"IT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://why777.run/","date":"2026-10-07T15:45:22.857Z","timestamp":1791387922857,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"why777.run","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 08:20:02 GMT","end":"Tue, 05 Jan 2027 08:20:01 GMT"},"fingerprint":{"sha1":"36:4F:AF:82:F5:5B:4F:B1:D9:40:FC:F6:56:86:C4:40:93:07:FD:73","sha256":"78:95:23:B0:88:59:21:45:6A:73:3A:6E:50:2E:F2:6C:CE:C3:0F:F8:8B:89:E3:AD:FE:D2:45:D1:9D:3F:45:05"}}},"request":{"raw":"GET /wp-content/uploads/2026/01/cropped-favicon-192x192.png HTTP/1.1\r\nHost: why777.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://why777.run/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 07 Oct 2026 15:45:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 1757\r\nlast-modified: Wed, 21 Jan 2026 07:39:15 GMT\r\netag: \"697082a3-6dd\"\r\naccept-ranges: bytes\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\npermissions-policy: accelerometer=(), ambient-light-sensor=(), attribution-reporting=(), autoplay=(), bluetooth=(), browsing-topics=(), camera=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), storage-access=(), usb=(), web-share=(), window-management=(), xr-spatial-tracking=(), aria-notify=(), captured-surface-control=(), cross-origin-isolated=(), deferred-fetch=(), deferred-fetch-minimal=(), on-device-speech-recognition=(), summarizer=(), wildcards=(), private-state-token-issuance=(), private-state-token-redemption=(), interest-cohort=()\r\ncontent-security-policy: object-src 'none'; form-action 'self'; frame-ancestors 'self';\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nreferrer-policy: no-referrer-when-downgrade\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1757,"size_decoded":3134,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"2de09398545c0f8f8ba8227f2c498ee4","sha1":"f41db9ceb2fc8fe6d4246bc080489447b0e69aee","sha256":"bc6bd9188e02c7e5f8d1717aff9ab292080abeaa511918320431026d0c14afec","sha512":"640143b0f7819cc19941b12b0fe4774eeb1d5483030dc0d666e4b91ad5cdb71f7360eba060a7907a31378ee4a3dd8d275bbadabd55fcc6be2220e301b8149149","ssdeep":"","tlshash":"a8314337e25fb1454c38e3752733384a78ae9e768ac766b82148f069f1b832f914d404","first_seen":"2026-10-07T15:27:03.660747Z","last_seen":"2026-10-07T15:45:56.713339Z","times_seen":2,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"why777.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"why777.run/wp-content/uploads/2026/01/cropped-favicon-32x32.png","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":443,"asn":44942,"as":"Digitalreti srl","country":"Italy","country_code":"IT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://why777.run/","date":"2026-10-07T15:45:22.860Z","timestamp":1791387922860,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"why777.run","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 08:20:02 GMT","end":"Tue, 05 Jan 2027 08:20:01 GMT"},"fingerprint":{"sha1":"36:4F:AF:82:F5:5B:4F:B1:D9:40:FC:F6:56:86:C4:40:93:07:FD:73","sha256":"78:95:23:B0:88:59:21:45:6A:73:3A:6E:50:2E:F2:6C:CE:C3:0F:F8:8B:89:E3:AD:FE:D2:45:D1:9D:3F:45:05"}}},"request":{"raw":"GET /wp-content/uploads/2026/01/cropped-favicon-32x32.png HTTP/1.1\r\nHost: why777.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://why777.run/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 07 Oct 2026 15:45:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 835\r\nlast-modified: Wed, 21 Jan 2026 07:39:15 GMT\r\netag: \"697082a3-343\"\r\naccept-ranges: bytes\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\npermissions-policy: accelerometer=(), ambient-light-sensor=(), attribution-reporting=(), autoplay=(), bluetooth=(), browsing-topics=(), camera=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), storage-access=(), usb=(), web-share=(), window-management=(), xr-spatial-tracking=(), aria-notify=(), captured-surface-control=(), cross-origin-isolated=(), deferred-fetch=(), deferred-fetch-minimal=(), on-device-speech-recognition=(), summarizer=(), wildcards=(), private-state-token-issuance=(), private-state-token-redemption=(), interest-cohort=()\r\ncontent-security-policy: object-src 'none'; form-action 'self'; frame-ancestors 'self';\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nreferrer-policy: no-referrer-when-downgrade\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":835,"size_decoded":2211,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"c19c1f0648ec75675895cf9a92d69b3a","sha1":"334b249c8d7737b2213c212b12c949505d9a960b","sha256":"e60b9a071b8a70e0ea675823415fd774b7d267fdd2d14f52f8122bc37c7e82b1","sha512":"cf13b9ce42b3e1f55779898c7a33253cff32bd514f5c6ed8a93fdc656c0193ea56ab7fb11d0fbe255277cfabba357b8e942edecefc91cce6872e01753f9a4934","ssdeep":"","tlshash":"3001daa32b1223a750de51ef283227d3e0fb859d6175143c1470583399ec18090e4121","first_seen":"2026-10-07T15:27:03.663706Z","last_seen":"2026-10-07T15:45:56.714253Z","times_seen":2,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":158,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"why777.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Exo+2:ital,wght@0,700;0,800;0,900;1,700;1,800;1,900\u0026family=Montserrat:wght@100;300;500;700;800;900\u0026family=Rubik:wght@300;500;600;800;900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://why777.run/","date":"2026-10-07T15:45:22.504Z","timestamp":1791387922504,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:49 GMT","end":"Fri, 11 Dec 2026 20:01:48 GMT"},"fingerprint":{"sha1":"E3:3D:17:9C:78:F1:DE:68:C7:E6:BB:8F:08:DC:78:F3:9D:DF:F2:43","sha256":"EB:D6:1D:9A:76:0B:5A:3C:08:74:83:6D:AA:A7:F4:B3:0D:17:8F:4F:3E:6B:9C:91:6C:5B:9E:F7:08:1F:00:62"}}},"request":{"raw":"GET /css2?family=Exo+2:ital,wght@0,700;0,800;0,900;1,700;1,800;1,900\u0026family=Montserrat:wght@100;300;500;700;800;900\u0026family=Rubik:wght@300;500;600;800;900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://why777.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 07 Oct 2026 15:45:22 GMT\r\ndate: Wed, 07 Oct 2026 15:45:22 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35781,"size_decoded":2227,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (651)","md5":"2bf57a65dedfbd5b76e3eeaa978f6ac0","sha1":"cd13b2ab518fa446e599e078301727b850484f2c","sha256":"5c3a5cd1e52f6d912f30bede7ea3498d420d836e858bfaab2124dc84a26e2e56","sha512":"56bfac75911a29f690e2feb0bb743c8fb5b8339833ac1d68f171737bdcf9735e16b855122845267a3c1854fe93b09b156f1caaea66b29f78936c2ce5d499b707","ssdeep":"384:1Ol7GH/ExliGuCTElFGpBNQlRn6fnd1oWUZRSTudLMrP1olSyolgHoltFolTSolK:UdCWUx4BEnK","tlshash":"8af2b9e0441b9400bb471cc623ce7e3ade4e62657494c579affe1da8acebc22236475d","first_seen":"2026-10-07T15:27:03.673923Z","last_seen":"2026-10-07T15:45:56.720354Z","times_seen":2,"resource_available":true,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":17,"send":0,"wait":36,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"why777.run/wp-content/themes/template/assets/small6172.png","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":443,"asn":44942,"as":"Digitalreti srl","country":"Italy","country_code":"IT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://why777.run/","date":"2026-10-07T15:45:22.510Z","timestamp":1791387922510,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"why777.run","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 08:20:02 GMT","end":"Tue, 05 Jan 2027 08:20:01 GMT"},"fingerprint":{"sha1":"36:4F:AF:82:F5:5B:4F:B1:D9:40:FC:F6:56:86:C4:40:93:07:FD:73","sha256":"78:95:23:B0:88:59:21:45:6A:73:3A:6E:50:2E:F2:6C:CE:C3:0F:F8:8B:89:E3:AD:FE:D2:45:D1:9D:3F:45:05"}}},"request":{"raw":"GET /wp-content/themes/template/assets/small6172.png HTTP/1.1\r\nHost: why777.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://why777.run/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 07 Oct 2026 15:45:22 GMT\r\ncontent-type: image/png\r\ncontent-length: 3042\r\nlast-modified: Wed, 21 Jan 2026 07:39:15 GMT\r\netag: \"697082a3-be2\"\r\naccept-ranges: bytes\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\npermissions-policy: accelerometer=(), ambient-light-sensor=(), attribution-reporting=(), autoplay=(), bluetooth=(), browsing-topics=(), camera=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), storage-access=(), usb=(), web-share=(), window-management=(), xr-spatial-tracking=(), aria-notify=(), captured-surface-control=(), cross-origin-isolated=(), deferred-fetch=(), deferred-fetch-minimal=(), on-device-speech-recognition=(), summarizer=(), wildcards=(), private-state-token-issuance=(), private-state-token-redemption=(), interest-cohort=()\r\ncontent-security-policy: object-src 'none'; form-action 'self'; frame-ancestors 'self';\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nreferrer-policy: no-referrer-when-downgrade\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3042,"size_decoded":4419,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit colormap, non-interlaced","md5":"f24b2b1bf281edaae3183f82b4a7e1d9","sha1":"21b04b3fed476fc8182f6aa365409133a8b2624c","sha256":"2e09715e34b24f8bb2053c9bd01a74e2795fb2eff3ec4d275cdc992d82339e68","sha512":"97d434de6c54e9d23047329bcab0ea5eb7e08061586bf9d26d2ae6f572b54494e28060a8fece0da841c2b9b81eccd776400652dd9bc0d1fc045c3daa68d05da5","ssdeep":"","tlshash":"3b512bd4a62019811b94c2c514e2a82a1e0ac980d790ee37b4cfe81f7e7627b84d91d7","first_seen":"2024-08-20T01:51:17.391957Z","last_seen":"2026-10-07T15:45:56.721048Z","times_seen":14,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"why777.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"why777.run/wp-content/themes/template/assets/bg.jpg","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":443,"asn":44942,"as":"Digitalreti srl","country":"Italy","country_code":"IT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://why777.run/","date":"2026-10-07T15:45:22.620Z","timestamp":1791387922620,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"why777.run","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 08:20:02 GMT","end":"Tue, 05 Jan 2027 08:20:01 GMT"},"fingerprint":{"sha1":"36:4F:AF:82:F5:5B:4F:B1:D9:40:FC:F6:56:86:C4:40:93:07:FD:73","sha256":"78:95:23:B0:88:59:21:45:6A:73:3A:6E:50:2E:F2:6C:CE:C3:0F:F8:8B:89:E3:AD:FE:D2:45:D1:9D:3F:45:05"}}},"request":{"raw":"GET /wp-content/themes/template/assets/bg.jpg HTTP/1.1\r\nHost: why777.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://why777.run/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 07 Oct 2026 15:45:22 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 75305\r\nlast-modified: Wed, 21 Jan 2026 07:39:15 GMT\r\netag: \"697082a3-12629\"\r\naccept-ranges: bytes\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\npermissions-policy: accelerometer=(), ambient-light-sensor=(), attribution-reporting=(), autoplay=(), bluetooth=(), browsing-topics=(), camera=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), storage-access=(), usb=(), web-share=(), window-management=(), xr-spatial-tracking=(), aria-notify=(), captured-surface-control=(), cross-origin-isolated=(), deferred-fetch=(), deferred-fetch-minimal=(), on-device-speech-recognition=(), summarizer=(), wildcards=(), private-state-token-issuance=(), private-state-token-redemption=(), interest-cohort=()\r\ncontent-security-policy: object-src 'none'; form-action 'self'; frame-ancestors 'self';\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nreferrer-policy: no-referrer-when-downgrade\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":75305,"size_decoded":76686,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=916, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1896], baseline, precision 8, 1896x916, components 3","md5":"f64bd9470855973943869d7c36d410de","sha1":"ab3635d1468e0e7aab7442d31510cf5a1eac9d50","sha256":"72fd442ca8069ee603bab7683ae0847db2cac786de942a8c22cf593b3cac418b","sha512":"567f2aeffa9b5490cdaff19e45e513d1b45372ed7ca36884a1ca373306d0c7589fd6699772596663e14b99dc5502e97b6b67fcf4ef58e3ada3fd95f3e4e66920","ssdeep":"768:hpriBpDLkHvTgg0QiU7Mh90tse/C2ze+iSiZ0w:QcvTbBiU7MkseJzpiSiZ0w","tlshash":"77735871ae6d4bd299c278634710dd71db350f84476333e6eeb83b0e666ce85882066f","first_seen":"2026-10-07T15:27:03.654516Z","last_seen":"2026-10-07T15:45:56.72158Z","times_seen":2,"resource_available":false,"data":null}},"time_used":304,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":194,"receive":110,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"why777.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"why777.run/","fqdn":"why777.run","domain":"why777.run","tld":"run"},"ip":{"addr":"92.63.227.153","port":443,"asn":44942,"as":"Digitalreti srl","country":"Italy","country_code":"IT"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-07T15:45:21.744Z","timestamp":1791387921744,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"why777.run","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 08:20:02 GMT","end":"Tue, 05 Jan 2027 08:20:01 GMT"},"fingerprint":{"sha1":"36:4F:AF:82:F5:5B:4F:B1:D9:40:FC:F6:56:86:C4:40:93:07:FD:73","sha256":"78:95:23:B0:88:59:21:45:6A:73:3A:6E:50:2E:F2:6C:CE:C3:0F:F8:8B:89:E3:AD:FE:D2:45:D1:9D:3F:45:05"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: why777.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 07 Oct 2026 15:45:22 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 15511\r\nvary: X-Forwarded-Proto,Accept-Encoding\r\nlast-modified: Wed, 07 Oct 2026 14:03:37 GMT\r\netag: \"3c97-65d4094e88855\"\r\naccept-ranges: bytes\r\nreferrer-policy: no-referrer-when-downgrade\r\npragma: public\r\ncache-control: max-age=3600, public\r\ncontent-encoding: gzip\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\npermissions-policy: accelerometer=(), ambient-light-sensor=(), attribution-reporting=(), autoplay=(), bluetooth=(), browsing-topics=(), camera=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), storage-access=(), usb=(), web-share=(), window-management=(), xr-spatial-tracking=(), aria-notify=(), captured-surface-control=(), cross-origin-isolated=(), deferred-fetch=(), deferred-fetch-minimal=(), on-device-speech-recognition=(), summarizer=(), wildcards=(), private-state-token-issuance=(), private-state-token-redemption=(), interest-cohort=()\r\ncontent-security-policy: object-src 'none'; form-action 'self'; frame-ancestors 'self';\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"W3 Total Cache","description":"W3 Total Cache (W3TC) improves the SEO and increases website performance and reducing load times by leveraging features like content delivery network (CDN) integration and the latest best practices.","website":"https://www.w3-edge.com/wordpress-plugins/w3-total-cache","common_platform_enumeration":"","icon":"W3 Total Cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":82692,"size_decoded":17028,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (49865)","md5":"8b1a4759f33c9861fb8e332e04bfc92f","sha1":"8986fdab6f24b801e1aeff3690b3e316735f5e0b","sha256":"15b2672f391a3837dbe0ea4d9da97be6aed558f2265273848fa927ac9206459b","sha512":"2eb6f5313d35416f67e238c975ddb4356943e51e45f7c8716d4827f8215756704f032cc961a5ee034169f9f27c7dcebdc72c8c75a005a0037d57f82a112e9ad8","ssdeep":"1536:SXSnypcZe64/hwSnFnczaaThBkdc89Ovjog3/8MFjll7Bk4vIsw+zWXy8vep6NDR:lyxh9xdPKvMtNV","tlshash":"3383e92553643298501be569eed4ab0c333940b9bf5b47f529f13c2993ce9b803b672e","first_seen":"2026-10-07T15:27:03.671932Z","last_seen":"2026-10-07T15:45:56.72216Z","times_seen":2,"resource_available":true,"data":null}},"time_used":342,"timings":{"blocked":-1,"dns":3,"connect":29,"send":0,"wait":209,"receive":29,"ssl":72},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"why777.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://why777.run/","date":"2026-10-07T15:45:22.652Z","timestamp":1791387922652,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://why777.run\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:54:13 GMT\r\nexpires: Tue, 05 Oct 2027 15:54:13 GMT\r\ncache-control: public, max-age=31536000\r\nage: 172269\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":38569,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-10-15T10:27:31.455026Z","times_seen":571572,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":31,"send":0,"wait":24,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459W1hyyTn89ddpROi.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://why777.run/","date":"2026-10-07T15:45:22.653Z","timestamp":1791387922653,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459W1hyyTn89ddpROi.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://why777.run\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 23776\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 06 Oct 2026 04:03:34 GMT\r\nexpires: Wed, 06 Oct 2027 04:03:34 GMT\r\ncache-control: public, max-age=31536000\r\nage: 128508\r\nlast-modified: Thu, 04 Sep 2025 17:11:55 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":23776,"size_decoded":24589,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23776, version 1.0","md5":"61611e47a80abeae7bab6335b074c70b","sha1":"6902954d25cbd00a037f12421a0d25580a0a81f7","sha256":"6e310df94df0c3e75cd1c6ecd08e22cc559eb0667d54013afdc469671ef4614a","sha512":"8207ee33de460e5f705a53a54ed45f4ad921141672b995584b2718a9bee837ae3331647f0f8fa9b62b812e6b54f9397e1da11160f9b3bf51ae39fc1ec32bb07b","ssdeep":"384:uEEi3OYr7g0sF91UG3qkcKtr40D/w18XHu3Nr/UL2s+HSeSN/Z26s6A296:fEieY/gfj1UVKSow1TVs+HY/Z/a","tlshash":"d4b2e142401cf0b1e7c76f7daacf24c095d613bacf3f95981145db7855ad5932c9c88a","first_seen":"2025-09-05T05:16:31.285834Z","last_seen":"2026-10-15T11:08:02.429448Z","times_seen":12895,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":29,"dns":0,"connect":0,"send":0,"wait":31,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}