{"report_id":"e10d7f67-eb03-42d6-8218-789ec1c5c032","version":0,"status":"done","tags":[],"date":"2026-06-21T14:00:28Z","url":{"schema":"http","addr":"1win.fyi/","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"1win.fyi/","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"title":"Play at 1win International - Bookmaker, Sport betting and Casino","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T22:57:34.772395Z","times_seen":17845104,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"1win.fyi/","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-26T14:00:28Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"1win.fyi","ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-08-17","domain_rank":497074,"first_seen":"2026-01-15T11:49:31.428909Z","last_seen":"2026-01-15T11:49:31.428909Z","alert_count":50,"request_count":50,"received_data":566652,"sent_data":29222,"comment":"","tags":null,"fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"OpenCart","description":"OpenCart is a free and open-source ecommerce platform used for creating and managing online stores. It is written in PHP and uses a MySQL database to store information.","website":"https://www.opencart.com","common_platform_enumeration":"cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:*","icon":"OpenCart.svg","categories":["Ecommerce","CMS"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"jQuery:2.1.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"1win.fyi/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-11T22:56:56.816967Z","times_seen":418258,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/common.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6da935dab9ccf3171482deb7e6b1edd4","sha1":"f56f587483b73522a704939dc2f5fb3585fbcd86","sha256":"1bda39687cd5eee92f8d041971ee7487b6fc656b8cba118786d8fa0011bdc12f","sha512":"248dc245b16120ba930544cf188b3f77a3ecd872a0c5dc4627858c350896123365fa823a1870bb58fff7d7ca52dced2de9a79c8980cddc90a3d39b95792b5203","ssdeep":"96:i2L8YxYi6vzTxAwv6lEIuUV29AA4TnKV3CRv35QGXcCT2H2Hv8ZWnQX6XqwdrKX9:iA89xAwClHuk29AA4TnAeFfTI2xnQX60","tlshash":"4fc1436cfbbc15868077305a09ae68cc123d8031b9415d7bbcbd96d41ff6e2817a9c39","size":5856,"data":"","first_seen":"2026-01-15T11:49:35.674279Z","last_seen":"2026-06-21T14:00:30.197123Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"84da21f43b3723e9336f9ff2c61e1153","sha1":"92b78a130726feaedaccc7f76a759eaac45e0d18","sha256":"4ea82cec8c75bf3686b300bb570d2c01fdce2b4adb31bf125c31e15d12bbf99d","sha512":"9d4f76d957b81eff081962acf0145577d53fd64d8c6ef5ddb99664ce7c16799fc668e1b2cd25bd40de755fbe97e4fe5743e40ff6397c02555bf45e69ee44f404","ssdeep":"384:SJU5XQm5LwhPPtEz/zB3bK5ZOv6+TvjfnhbwMkylmNxDUcOZlf27:UUwhPA2Z4jvj+MTiQ27","tlshash":"1b9275c938db705c93325c35507734ce7a3facc4a9294a1ac211e6e8f9f4798855fea8","size":20567,"data":"","first_seen":"2026-06-21T13:13:54.064592Z","last_seen":"2026-06-21T14:00:30.185277Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"5177693179dc7cd8d3cc04fe47dc6d61","sha1":"224f10528fbfe6bc667c347e38426ebfb074b772","sha256":"78877afbeebb228c1072ffb921f319c5d5c7627b307c00fb26edd9335b19b6c7","sha512":"7f97e24b33326bd9c6c1806ab5e267388eee7e750a574d06f9600ccc522782be93b3def017ba5943f758e8ff024ddada77713981a867e39464f10511b57dd414","ssdeep":"","tlshash":"80d023761db5883075dc018760fbe7a8267061606b11d344e2cddc2f5f10ed344f1658","size":217,"data":"","first_seen":"2026-06-21T14:00:30.198021Z","last_seen":"2026-06-21T14:00:30.198021Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/jquery/jquery-2.1.1.min.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e40ec2161fe7993196f23c8a07346306","sha1":"afb90752e0a90c24b7f724faca86c5f3d15d1178","sha256":"874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4","sha512":"5f57cc757fff0e9990a72e78f6373f0a24bce2edf3c4559f0b6fef3cf65edf932c0f3eca5a35511ea11eabc0a412f1c7563282ec76f6fa005cc59504417159eb","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa98:7NMnJiz6oAQKP5a98Hrh","tlshash":"db83d6d9b2c67062977730b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","size":84245,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-11T20:40:42.765988Z","times_seen":60541,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/bootstrap/js/bootstrap.min.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4becdc9104623e891fbb9d38bba01be4","sha1":"6c264e0e0026ab5ece49350c6a8812398e696cbb","sha256":"4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327","sha512":"2b5aa343e35c1764d83bf788dcceaff0488d6197c0f79a50ba67ef715ad31edc105431be68746a2e2fc44e7dae07ed49ab062a546dcb22f766f658fa8a64bfa5","ssdeep":"768:r8iUD27UwlNEMl9RqNuCqNjhqg8epm5VCoFXflR8Gf3ZsbQ:4875vhqKGvlp3ZsQ","tlshash":"16f29606b23031a107efb1e1525b020a7239696ee906907c78b99af53db9c48717bf3d","size":36816,"data":"","first_seen":"2023-03-07T01:06:46Z","last_seen":"2026-08-11T20:40:42.793489Z","times_seen":18334,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/plaza/ultimatemenu/menu.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5625fe99d6dc7884012540c58e43cfae","sha1":"1102fd742b20e9eafb3aa7cea94211ef362653db","sha256":"fd19cee1b26e95626f99d4949d4bc5d07a5a9f564a79a065cc8e9b7bf2548987","sha512":"6a3e3aeddc40390cb53585d4cb596aef2421e29e660283e4af5c48995f94cb70d003a403839d4134e6564c5b5e13b624d87dc884d7efc95f686107aabcc2525a","ssdeep":"48:NzFHXMKRhrd6ujhl+siiJYWaXvBJpdJeBLpdXCsUh9bhpd5sGUTflLLnnd9iNW0a:FZ9l/YW5UBWNGEBAE3Cwe+rXSQUHip7P","tlshash":"97324688e452815644f3337b9a798448ef298867c34a4600fdfe98a61ffa110a771fbd","size":11026,"data":"","first_seen":"2023-03-07T13:59:17Z","last_seen":"2026-07-24T21:10:01.183653Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"WebP supported","filename":"https://1win.fyi/","line_number":0,"column_number":0},{"level":"log","text":"WebP supported","filename":"https://1win.fyi/","line_number":0,"column_number":0}]},"http":[{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/bootstrap/js/bootstrap.min.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.795Z","timestamp":1782050399795,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/javascript/bootstrap/js/bootstrap.min.js HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: \"8fd0-659bba4e-faf94;br\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: text/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=3,i=?0\r\nage: 2473\r\ncache-control: max-age=31536000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vr%2Bjsvn8BOMZT%2FQNB2%2B5xNdll%2B3XVjmxl8CUBAaYOaxnUw3ekwL0DJ6Gb9qz7uevpQ0fmz9Gbbp60zQcwkPPp62zSkZzGEwfYwaQBUUHU0TUHLhb8HC%2FUAwF\"}]}\r\ncontent-length: 9345\r\ncf-ray: a0f38976bc1a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36816,"size_decoded":10130,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (32034)","md5":"4becdc9104623e891fbb9d38bba01be4","sha1":"6c264e0e0026ab5ece49350c6a8812398e696cbb","sha256":"4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327","sha512":"2b5aa343e35c1764d83bf788dcceaff0488d6197c0f79a50ba67ef715ad31edc105431be68746a2e2fc44e7dae07ed49ab062a546dcb22f766f658fa8a64bfa5","ssdeep":"768:r8iUD27UwlNEMl9RqNuCqNjhqg8epm5VCoFXflR8Gf3ZsbQ:4875vhqKGvlp3ZsQ","tlshash":"16f29606b23031a107efb1e1525b020a7239696ee906907c78b99af53db9c48717bf3d","first_seen":"2023-03-07T01:06:46Z","last_seen":"2026-08-11T20:40:42.793489Z","times_seen":18334,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/id-id/id-id.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.820Z","timestamp":1782050399820,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/id-id/id-id.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 24 Jun 2026 11:56:47 GMT\r\netag: \"26a-659bba4e-dee50;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 352992\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LNIfBnktnP2RCCcn7kKpg8eFUmDi61PI2LKfpePPa3TGE0NPLTCzMRuj37jGKVN%2BS1elRsJcYBtTTS39fu0%2F6Uc370IpqGOFvyfs0NeM6QQKSb5qJ1grwS2E\"}]}\r\ncontent-length: 618\r\ncf-ray: a0f38976ec285684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":618,"size_decoded":1391,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"d34062470198401d8ebdb6cf6f8d7981","sha1":"036fc08523396d5d6d522367a9e7c45746bc9de7","sha256":"c62cbeac6903d577ca34206ad55346c923c75f0bf650f7e9c5ef6d458741b1a4","sha512":"a4f30edee1d0deb7b97766961d34cc9fdd848085ec332a9d7ab02e555dea84a6eb00828b5b57a5e28af4569a3df9d0e35c728622015438cbe175409c0580edc3","ssdeep":"","tlshash":"e5f002c3fe8eac3482d8c2230788e312841ddd5112ba05d584ca2069a86236dd5f1924","first_seen":"2026-05-01T22:55:25.651799Z","last_seen":"2026-06-29T22:43:25.365081Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/uz-uz/uz-uz.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.825Z","timestamp":1782050399825,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/uz-uz/uz-uz.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sun, 07 Jun 2026 20:02:20 GMT\r\netag: \"19b-659bba4e-df241;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 581888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B2yzHDCHBvf3kyWmaAkQ%2FQV08s7AwYNoDNczjfCehbnQZ44MTvAwNsQ60NYUXaBOCV%2Fh1fVdZpld32pSP7alpwt%2B6jNaQC3b914bKfg9AJunIX89DJKMIxvV\"}]}\r\ncontent-length: 411\r\ncf-ray: a0f38976ec2c5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":411,"size_decoded":1188,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGBA, non-interlaced","md5":"b165dab8a21c078c6ff9ad7bddd5baac","sha1":"2190f2f03871ab757e6e1bf236ab2101ad000ca7","sha256":"26c2c218d45070f9814738ed053a9eedb5d3db6e0566e4504043275c0e73a5d1","sha512":"c5527cd1b0fbe20d55867b341182e2e124c8152aea1d75c408d8987f4641018dd61d62651f92e7f418ccf18c35e5d9ef69a5003be1a7baa3e2d432b9c8545c5a","ssdeep":"","tlshash":"03e0f1e1cb6ee85ec20e97ab94a1c545756a33d6a4415e847cb2e125010d2ec2cb97a3","first_seen":"2024-10-11T08:49:09.535588Z","last_seen":"2026-06-29T22:43:25.370072Z","times_seen":5,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/instagram.svg","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.849Z","timestamp":1782050399849,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/instagram.svg HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sun, 14 Jun 2026 01:01:36 GMT\r\netag: \"22f-679c9f12-dc22d;br\"\r\nlast-modified: Fri, 31 Jan 2025 09:59:46 GMT\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 43789\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XiwyVhmAQipofytDFuXC1vfhXS%2BuN8m%2FRXlRfK1YImvRyMehM2EtT0sCnATkCFq9Xzbd3garw%2FXIIjmXs8RjrHB4U%2BbflyzeAQD%2Fm3JQEHWOM%2FoZOUoo26xg\"}]}\r\ncontent-length: 303\r\ncf-ray: a0f389771c3c5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":559,"size_decoded":1132,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c8a4160d9db787f1590e93d6ce9f295e","sha1":"0ed79e3db7e026ef2aaaa11c44b9b0d780db5d18","sha256":"65a773f46eb7a81d4e4143bd11ab4a1debea6d4103867c3565d75ffb78c802d7","sha512":"b3860c8497028b4b15a3d8259d8eb41df247638bc1b23171779229cce137108a842a4cc9139f87fe2bbba2d49d966dfc831deedf3d1e40ab45f4fe0333aa14a5","ssdeep":"","tlshash":"aef04cf25608aa27a218072396b488d613f0f0a2f3f42515d7508970e43864bdc695c5","first_seen":"2025-11-11T13:54:05.888304Z","last_seen":"2026-06-21T14:00:30.151564Z","times_seen":14,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/logo/1win-logo.svg","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.804Z","timestamp":1782050399804,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/logo/1win-logo.svg HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 21 May 2026 13:23:42 GMT\r\netag: \"9f4-6929d542-dc220;br\"\r\nlast-modified: Fri, 28 Nov 2025 17:00:50 GMT\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 245095\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M%2BCjQdWEq0klBfBgGPW%2Bcmo6K72vDNwCstIdR8bPbFFugBFatTmQEKtRm9%2BFkj9bRDFwWbvlnWGbe%2FqR%2FXF9hBe8WYNhybTFi3i4IbV2C284%2FggghWhzg306\"}]}\r\ncontent-length: 1156\r\ncf-ray: a0f38976cc1b5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2548,"size_decoded":1987,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a8eb2b1a25043e13e9f51db987710dd6","sha1":"4e2c8f1e4b7b9865d0cddc85fd702423f0b7f102","sha256":"8f02bacc83dfc8fa982c3f42400d3c156c49e0142bfffc009fd8d279f758b8ad","sha512":"b72256d18edaaad8c0bc85f89104293b219ca17e7bcacfcf13f4b77769197e7e3f629f3c788961f9e6050f324738edd11d3fcf4ee215816669367f4c83039302","ssdeep":"","tlshash":"375183ec27595cc009c587eb5e7391ecba2760be25890848c25877f8e8068acce4dbc7","first_seen":"2026-01-15T11:49:35.620805Z","last_seen":"2026-06-21T14:00:30.153337Z","times_seen":4,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/theme/1win/image/start.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.989Z","timestamp":1782050399989,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/theme/1win/image/start.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/catalog/view/theme/1win/stylesheet/plaza/header/header3.css\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 18 Jun 2026 00:16:34 GMT\r\netag: \"6e3-66ed78ec-fad16;;;\"\r\nlast-modified: Fri, 20 Sep 2024 13:30:20 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 14:00:00 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i\r\nage: 303703\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=49sCsv5Jdv9YsouFmNI9EsaG8FR7gOEVsMIPcnKBoYJIfHik3RK09t9nRxauw%2FmaaBqOEbh5xnBiLivrMiQsLXRUdaHhCi6jSgukNPp0jLs6Co1lu5nS%2B2Oh\"}]}\r\ncontent-length: 1763\r\ncf-ray: a0f38977fc475684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":1763,"size_decoded":2537,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"1ff8ac06c573ebdedb9da55fffcc582f","sha1":"af693069137f5b6660aef4a24c058658beaaa8e8","sha256":"3ecf22e34a8a4043a21de50ff3d507dd2e44129e8bac1bfba3d41650e7e4374f","sha512":"beef0325d1e046058072531e3f3393edf27d16e7d7d959a618a12a919fd1ce726470725b892a91c40c4edc6f240f5e3281fe5ef296bd520d5f8b8f4468df7111","ssdeep":"","tlshash":"1131e9fa65bedc14fe8482203faa0974ec7b658045fe1ccc64435ed6046a9d4f899e45","first_seen":"2026-01-15T11:49:35.664375Z","last_seen":"2026-06-21T14:00:30.154657Z","times_seen":3,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-21T13:59:52.570Z","timestamp":1782050392570,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\ncontent-type: text/html; charset=utf-8\r\nset-cookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; path=/\nlanguage=en-gb; expires=Tue, 21-Jul-2026 13:59:59 GMT; Max-Age=2592000; path=/; domain=1win.fyi\nlanguage=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=1win.fyi\nlanguage=en-gb; expires=Tue, 21-Jul-2026 13:59:59 GMT; Max-Age=2592000; path=/; domain=1win.fyi\ncurrency=USD; expires=Tue, 21-Jul-2026 13:59:59 GMT; Max-Age=2592000; path=/; domain=1win.fyi\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LFZLr%2BgVfmfIwCVaJv6aevCpZh7StiPd79EBMPmpstM1KBBz7hZxoegbbuZiEObDSu3Sqo65KQqQAh06a%2BfQyqYDCE6cmwg4LJV1boRA8ynvxi6%2FpOdYViC0\"}]}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\nserver-timing: cfCacheStatus;desc=\"DYNAMIC\", cfEdge;dur=16,cfOrigin;dur=191\r\ncontent-encoding: br\r\ncf-ray: a0f38972693e5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"OpenCart","description":"OpenCart is a free and open-source ecommerce platform used for creating and managing online stores. It is written in PHP and uses a MySQL database to store information.","website":"https://www.opencart.com","common_platform_enumeration":"cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:*","icon":"OpenCart.svg","categories":["Ecommerce","CMS"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"jQuery:2.1.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39087,"size_decoded":11422,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (12680)","md5":"d8a9189cae83ff93119cb879aabedd30","sha1":"d3abed294ca6ebf2f6b876db2e9120f9f0679605","sha256":"0f62ace2924021a89c46b6bb490589d891dede98b66709bd4f874c61773d7b92","sha512":"9a2b175417c5b480cffb191cf31c200e4b59e94999acff84f03c3ac670173e31d83ff5d762461456e82d1e58b9cc453d55000dd88f81da1201450d57443ecdb1","ssdeep":"768:Ypqr704OHFhfom9xeU7OBglhB+wQUN2rVx/3N:904+FVZ9xeU7OqlhlGVx/3N","tlshash":"f50385711404aa2742ab49e9b477b71aa1f7030a9a536505faecc3e51bcbd29ce3701b","first_seen":"2026-06-21T14:00:30.155755Z","last_seen":"2026-06-21T14:00:30.155755Z","times_seen":1,"resource_available":false,"data":null}},"time_used":6746,"timings":{"blocked":0,"dns":156,"connect":1,"send":0,"wait":216,"receive":0,"ssl":6373},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/plaza/ultimatemenu/menu.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.572Z","timestamp":1782050399572,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/javascript/plaza/ultimatemenu/menu.js HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: \"2b12-659bba4e-faf9b;br\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: text/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=3,i=?0\r\nage: 2473\r\ncache-control: max-age=31536000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Er0RHRQ%2B6aIHZvq0V0AcggpjZCT4USgdNwGrKL559LlLpEWAJ2ruKtOprkzpmT8GHmMDLZkAOiMQFhjGqtmqud%2BK3A32To2PP%2FSiAw%2F61XzC8fVcyuUsxHpk\"}]}\r\ncontent-length: 1162\r\ncf-ray: a0f389755c105684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":11026,"size_decoded":1945,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"5625fe99d6dc7884012540c58e43cfae","sha1":"1102fd742b20e9eafb3aa7cea94211ef362653db","sha256":"fd19cee1b26e95626f99d4949d4bc5d07a5a9f564a79a065cc8e9b7bf2548987","sha512":"6a3e3aeddc40390cb53585d4cb596aef2421e29e660283e4af5c48995f94cb70d003a403839d4134e6564c5b5e13b624d87dc884d7efc95f686107aabcc2525a","ssdeep":"48:NzFHXMKRhrd6ujhl+siiJYWaXvBJpdJeBLpdXCsUh9bhpd5sGUTflLLnnd9iNW0a:FZ9l/YW5UBWNGEBAE3Cwe+rXSQUHip7P","tlshash":"97324688e452815644f3337b9a798448ef298867c34a4600fdfe98a61ffa110a771fbd","first_seen":"2023-03-07T13:59:17Z","last_seen":"2026-07-24T21:10:01.183653Z","times_seen":32,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/vi-vn/vi-vn.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.831Z","timestamp":1782050399831,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/vi-vn/vi-vn.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 24 Jun 2026 11:56:47 GMT\r\netag: \"1da-659bba4e-fa700;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 352991\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yEXeTMwiATCj9SMfDkH%2BcE5vxlTz4v2D77u6994mZeQkneyV9KQmct4v6MiFwnX0DHoaQarHOD7cSssH8DhQDJurpP7qeWLl%2BnCRrvGaYVdr9EPmvIS%2FLsRc\"}]}\r\ncontent-length: 474\r\ncf-ray: a0f38976fc305684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":474,"size_decoded":1249,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"638136b1a6f5dab7be6cec84fcc2cd53","sha1":"c4e3637f2de0741c3a365d14a7d1f0873198e167","sha256":"d05aa8078604f4560d99aacf12c80e400651e4ef9b0860b3ad478c2d8b08e36d","sha512":"8c6cf01536dee904feb18cf76f5455a2139d6dc5204134c7516f6c98464382bbda7d9ee96d92a1996cef4a1718e62bc6c909dc0869d9f54a925788c0405a694b","ssdeep":"","tlshash":"49f054f2b3404824c4cf4ae928870706f1734e8d942dc42d2b9efd0441e6e01b084b2a","first_seen":"2023-05-02T04:59:31Z","last_seen":"2026-08-11T17:00:39.841169Z","times_seen":1880,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/home/main-2.webp","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.846Z","timestamp":1782050399846,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/home/main-2.webp HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 10 Jun 2026 08:58:19 GMT\r\netag: \"8494-69a8b857-dcf5c;;;\"\r\nlast-modified: Wed, 04 Mar 2026 22:55:19 GMT\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 352993\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BqP9ZJFy%2FnCTVxY6YYiVRMB%2FUSATdL4%2BHNlYQKz59OCK3SXMBlalqyw4jqLElvroM%2B5pTPHSnKIPJSbxM9DtJZYU%2FsaQuRjJK7lIb4v8GxPytb6VfTvBdsHd\"}]}\r\ncontent-length: 33940\r\ncf-ray: a0f389770c3a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33940,"size_decoded":34725,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c6ae48b91c35a02a8886d79a547755ab","sha1":"6ce72f310a5a4b32b659482d9cc5d127ce3aed52","sha256":"b990a2eea1e7650c15cee6be632e1fb1935f6ec1325622ed942e5d8fcf8b29c1","sha512":"161b216bc73e926ccef81cfbe7ebdd826552ea7546ce1194288b5f7e72dcfd69a5dd6c2d0a66efadf9142977c5589261736252d9322e0877d36f526c9c425c84","ssdeep":"768:nAy2c1Djo+ouSrERknXLQ1fr9ftzDjNlowkrn/F8GLd:Aydo+pkn7Q1fr9RjNlowUn/F7d","tlshash":"57e2f1c885044766a4c333cacd31515f3add03b9a9ce2ede5d52c411e42ad83b73aab7","first_seen":"2026-06-21T14:00:30.158609Z","last_seen":"2026-06-21T14:00:30.158609Z","times_seen":1,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/bootstrap/fonts/open-sans-v40-cyrillic_latin-700.woff2","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.971Z","timestamp":1782050399971,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/javascript/bootstrap/fonts/open-sans-v40-cyrillic_latin-700.woff2 HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/catalog/view/javascript/bootstrap/css/bootstrap.min.css\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 17 Jun 2026 04:21:13 GMT\r\netag: \"5b78-670d390a-faf8a;;;\"\r\nlast-modified: Mon, 14 Oct 2024 15:30:18 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=3,i=?0\r\nage: 377822\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SZ2sLvO64VXkClLbowl1lDALJPDU454P7mWuYu11O6NfXM8iSJcXId9TThzDAp1a31NYtZUwBmc8ZZ82sWKrs0qRLpBHph8ohTHjf43eaAkqIjp4ATYXehXv\"}]}\r\ncontent-length: 23416\r\ncf-ray: a0f38977dc455684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":23416,"size_decoded":24192,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23416, version 1.0","md5":"a447d5553b6bcc11898041b737ed4836","sha1":"469010d395cbfcee8f2a27acbffcfe8ad6a791c0","sha256":"ca8ef5fd22df89dc24fec5c6e6354be5efb3bc7b3c8892d952fbb2473d5fd3d1","sha512":"fb42f0c8725f3fc2a3ca64f532dbb197dcf790fb0a29a62cabc7a2452d2900c2205261ad890e1cdc49a1946ac7e2a56d988bfd7f3e4fa1d0427e34cf28f4f5b9","ssdeep":"384:dbxgtgfZOgPDDCCEtuu4Wg0cNIuhonYxKHeWnWA8Jf4uKj9Wk2UaKIClkaqe/CA8:dbxqgfDCCouuNj0SYxKJ8Jf4r9WkaClo","tlshash":"e2b2d0a5d53c8dd581568bb16ca3e761d4d68e9b3a03dfba841fc0e15d3f888e68a04c","first_seen":"2025-06-07T15:01:25.476156Z","last_seen":"2026-06-21T14:00:30.160415Z","times_seen":10,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/cdn-cgi/challenge-platform/h/g/jsd/oneshot/f95a7f38c08f/0.1725727458015941:1782046830:5ytfIqtvQWG7PdoB5hwoDz2b8Z0jlsR-yZkfK72G91Q/a0f38972693e5685","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://1win.fyi/","date":"2026-06-21T14:00:00.299Z","timestamp":1782050400299,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/g/jsd/oneshot/f95a7f38c08f/0.1725727458015941:1782046830:5ytfIqtvQWG7PdoB5hwoDz2b8Z0jlsR-yZkfK72G91Q/a0f38972693e5685 HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 13223\r\nOrigin: https://1win.fyi\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD; jetcache_webp=1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/plain; charset=UTF-8\r\ncf-chl-out-s: DNwu9VlE5cujf1B9Hl6AkNqO+7rSANDthvdp5HoVVGsy4A2MTNNtoCCh5b6uPXWZza+VXOdMaHEsNQBj8sM2IpujfDkttwTnVPt4fC1P2FcXfpuuo+7V77Mov81XsjPKiTuz08vi5TDNsz8vaqqiLwwE7JojGWQB/4yL/NL5CDS1wx7soTbUS1Yn/Kl50o5rinIe9ttDZKOTOBw7cYiswGiJlTLG2Mkaal/EAf6dMUZjJziV18vvq4tuBLbeIK2N6OQu2IpN7lGo4dGwZchwxQ==$pnntDvSUE0nvG52wggeQiw==\r\nset-cookie: cf_clearance=QMsryh37ibAiRZyCoLxcvhBBfkb2sDWUVpx_zt2EhvM-1782050400-1.2.1.1-1hYncFx_ZFsdzhi1A82bf_KFIeC.t1bfuCJg2o1cVpdr9etHOp1j1NLHfE53RNIcwf_r04Tcvny5wFR3jLEKBcnhkPYyHCrArmPUgKpfQDO6e8BEz2H6pFWofPvgtgRIt9ai1JMThkdCIfwSvT0TJvdZ55torxzNqY6O09C4DbmM3TPMI6GafI_UVdTGm8TCbVjrrOvaK746BSHeGKCUZlBrNqgvxm7ctynHqruasAa0KFt.g7b85lGZvjk7lUSKbOOdyKZPEr.DLpAV5Srgi0vn.JPXK96TBNUgHgXADHXKKbfSAtNZ64TDGCSouiZ8oLm3HGzfpa1FeWdXEhdMUA; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=1win.fyi; Expires=Mon, 21 Jun 2027 14:00:00 GMT\r\ntiming-allow-origin: https://1win.fyi\r\ndate: Sun, 21 Jun 2026 14:00:00 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a0f38979ec575684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":15068,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T22:57:34.772395Z","times_seen":17845104,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/theme/1win/stylesheet/plaza/header/header3.css","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.552Z","timestamp":1782050399552,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/theme/1win/stylesheet/plaza/header/header3.css HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sun, 07 Jun 2026 18:52:24 GMT\r\netag: \"66c8-6807a5c6-facb0;br\"\r\nlast-modified: Tue, 22 Apr 2025 14:20:54 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\nage: 581888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BUgzXFZvuWvO6wzv%2BnuFNOvdKSzUxUTIirLfbQ3w75cn7v0akMfYr0in%2BpJUgx6ddpEgWWX0bNyh2rkQhKXM4oI1gCH3Bdb19bBwqx7qh7Wrx0oGEBbSFyWd\"}]}\r\ncontent-length: 5320\r\ncf-ray: a0f389753c0c5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26312,"size_decoded":6144,"mime_type":"text/css","magic":"assembler source, ASCII text, with very long lines (648)","md5":"e161087ab3544cb3f2f9b078053de6fb","sha1":"278d5c77042fe9ac97fed4ff3f21a2fd101d5296","sha256":"92aaf1bcf4017aece88e57787d074d9d206e015a44ce6788d960117fd557d90a","sha512":"dce49cb30c4a3e37a7bc3a9df3900bdb8e9e583b863aadda5d12f2ee4a20d3f400c0bb77dc7c51d71ad98f2390158ca2e0fd7a7f0c6cc17f32b8297aaea8eefd","ssdeep":"192:n71pz2Rbm9pEdiYYdWC7GQUcKNS6neV+uV0P5QQ2m0bJjin3l3s05J+obrIF86P/:7fzubm9ediYGUcDmJ+Je8mP7ACw4b/kp","tlshash":"a9c2a410d9e45019b137e412faa97aa963285903e34b5afbb613d62ccfca39415f2f4c","first_seen":"2025-12-31T02:38:53.428112Z","last_seen":"2026-06-21T14:00:30.163081Z","times_seen":6,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/it-it/it-it.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.821Z","timestamp":1782050399821,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/it-it/it-it.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sun, 07 Jun 2026 20:02:20 GMT\r\netag: \"e5-65bbd32c-fa656;;;\"\r\nlast-modified: Thu, 01 Feb 2024 17:21:48 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 581888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SRlRgagbkDIk1ZO2h9dtk9B%2BzfUkVTYqDMePNERJ5gNFmNva30Pti9NXBYZbV0O2z17ld0ZHye%2FzSmZx5NwFX3Hu53EHfTKeOwKT63IHdR3jAfFZm3qaKGq4\"}]}\r\ncontent-length: 229\r\ncf-ray: a0f38976ec295684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":229,"size_decoded":1001,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"55aaaff4e4e8d87a7b97e79c25ee1c64","sha1":"6831ee7ba7aaedfcd20e453c185f7e7f671f9080","sha256":"7e9e3ecb124d51abddfa73fc1d9e84412a4a914345baa360ab6c28f5c8e8a34a","sha512":"5baae148099c8512559d0d5d78d1b7c84cadb07b7ff5fbbcc69d18ba6d33475dfb94601f0e7881dc273c2517caaaf26af89a69a6a3a95e861f17e622eb40d957","ssdeep":"","tlshash":"07d0a7aba2529a7bdbdf0e6b055d1306e517456800911b3562b8569057044496588b63","first_seen":"2026-05-01T22:55:25.644366Z","last_seen":"2026-06-29T22:43:25.357394Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/youtube.svg","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.850Z","timestamp":1782050399850,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/youtube.svg HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 19 Jun 2026 06:24:41 GMT\r\netag: \"40f-67531232-dc259;br\"\r\nlast-modified: Fri, 06 Dec 2024 15:03:14 GMT\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 196911\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gEMbhzmSC0rliRX9tmYDIVgFk%2B8mL7lJPv8tLtJYOKG5Z5BLAa6Y9syT18bUZve4ksWFi6xLo2u8p19oLJi533vsMBEMb%2FomXHl4xp9lOIzGrL%2F8LajPnUiG\"}]}\r\ncontent-length: 528\r\ncf-ray: a0f389771c3d5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":1039,"size_decoded":1352,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"75ec9fde59e3dbee1cf63e69c8f5255d","sha1":"a8def12319aa3eec34cc322b421205d08f2cdfab","sha256":"496cadd6fa11c1a495f1a56afe2dd36405fe5fe58c46bd9eb81f9d94a5b7528b","sha512":"50c3f78d410d51fc3d6645f38f8ce0537c2a394bc66aa09e8075258ca783a075f9217297eae4560b0067f0171df8ff9b7a0f5c4676a1e44c3d5b38445f82fa43","ssdeep":"","tlshash":"8411effa12ca96e092874b44ed75c875737f30b7ea988d64c25198f4f02195a9dc9c88","first_seen":"2025-11-11T13:54:05.885428Z","last_seen":"2026-06-21T14:00:30.167191Z","times_seen":14,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/ms-my/ms-my.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.824Z","timestamp":1782050399824,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/ms-my/ms-my.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 11 Jun 2026 00:55:38 GMT\r\netag: \"23b-5566445e-df499;;;\"\r\nlast-modified: Wed, 27 May 2015 22:25:34 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 287780\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X3ZectOgwZOymvCrbr4XKVaYgZcxnwoODdRiO%2B4fywugIfKAIQwtDqu63ufjtV%2Fe7Ppoqi0us%2BaCKltWKSkUiXY1ejAXluVYtaBOT8Akx%2FDgN5QJLNpfaPCg\"}]}\r\ncontent-length: 571\r\ncf-ray: a0f38976ec2b5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":571,"size_decoded":1348,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"e1c0f262c141e8615f819b1cd18393d3","sha1":"95533a92f8155eda858542b540ba17799e2e079c","sha256":"1e7866925f0e0d350f2c74aa8ac3542be6e90b3c2be3c7f6b1ba0b641b53de9d","sha512":"f19492d42681b7b690916155945d2854633dd2c16cfd1f3502e391a92ddab2803fc5d26911406111f761d54441f4ee4e626d29d0c13cda9b34f3fcc3694926fd","ssdeep":"","tlshash":"aaf096d1b740d0108a3703f197d340cae4c407a820b3512f19e72e15022e4c1904dc30","first_seen":"2023-05-05T00:52:02Z","last_seen":"2026-08-11T17:00:39.949709Z","times_seen":1782,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/ro-ro/ro-ro.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.828Z","timestamp":1782050399828,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/ro-ro/ro-ro.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 17 Jun 2026 14:20:45 GMT\r\netag: \"1ef-659bba4e-df00f;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 343656\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GFZ6YfF7EHtCfDy%2BDvAsFcQfyVXo3LhL%2Fy%2BWZG0BFzkkkhSwP9RMklWn3i3CLFmb5oWFJR2ZvXnFMXxocLEBU4RkY5Pl5wnvq4h2c0fyrWQGj%2F44rZhY6gO8\"}]}\r\ncontent-length: 495\r\ncf-ray: a0f38976ec2e5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":495,"size_decoded":1272,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"d038c9c152c5e14f875c7b13afcd4711","sha1":"f141b663f5e234edabcb29e5fc69ce52f93be993","sha256":"0f83abcca7f07368819e3268d42f161edabcee4b56329c67de93779c1fba3ec5","sha512":"9859531f797639458316f2a34aae3d56e8798ff45a7fed586c2e4129c93d1246af3d3d8509975d36a2ce7f4b38723ee79026020b1fe4fde628ef082e7e283769","ssdeep":"","tlshash":"85f054c380ec5e70d77f8422ae03ed7850711bc31435d7068b1678f117c4299ca13407","first_seen":"2023-04-13T01:50:09Z","last_seen":"2026-08-09T01:54:32.713816Z","times_seen":515,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/telegram.svg","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.851Z","timestamp":1782050399851,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/telegram.svg HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 11 Jun 2026 04:06:53 GMT\r\netag: \"408-6753127e-dc20c;br\"\r\nlast-modified: Fri, 06 Dec 2024 15:04:30 GMT\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 276429\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oZunsaxhpDY8Hrf5diVyi11YgODUT6BUICVSmlNRtAmpQKIK4x%2BEK5MEYe4efsr5x5c6PAxUxxMomG0KNenZmhdc%2BjLuzIXIM7dMfoOjEf7lWmOxLlsqJlR2\"}]}\r\ncontent-length: 571\r\ncf-ray: a0f389771c3f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1032,"size_decoded":1393,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fb79b8c98173d9a5e985d9d08e17e4ee","sha1":"bd57ba3bd853a9dc713a7659c0436cc6ddb9b3a8","sha256":"c818397438de884d0cf1f9d16658edff6b46ccc3611a5ec5f512690fc674bba9","sha512":"eba6fc34226d092bb4ee0b98591a7654860c5da9f2e28b50e2784c4bfc8457caa4673c441621955b21cc5fede7dd4b84f33aba5539f4d59781dd188fe38eaf95","ssdeep":"","tlshash":"0c11ebf99bd0a7f84058e741a251a4b6777f74bab7878b08c320eae2a55c18848cdcd4","first_seen":"2025-11-11T13:54:05.889561Z","last_seen":"2026-06-21T14:00:30.169462Z","times_seen":14,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/google_play.svg","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.854Z","timestamp":1782050399854,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/google_play.svg HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sun, 07 Jun 2026 18:52:24 GMT\r\netag: \"1327-6645244e-dc24c;br\"\r\nlast-modified: Wed, 15 May 2024 21:08:30 GMT\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 581888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P9aNc19aO6QOm5beRZUvIdsesdMJZ%2B%2FKsmXtleBCTisJSVBRZ3lN8yE20X%2BFdsfXINd9ATL2mlJaVVZxT03Elh5bXF8a0kCoFsxWaxh9pkojLWgMnib4xXuy\"}]}\r\ncontent-length: 2145\r\ncf-ray: a0f389771c405684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4903,"size_decoded":2971,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"653dbecb837f6d5f54b17e36abcc71ef","sha1":"11ea561d93047a162a5cd0efe86c42f4d434aae6","sha256":"f9ed78e1ead95d749f624912f1b3c33e84edf3d7d76ad231df36efd2f1ab56bd","sha512":"0603c79d6daf3cbdd6863caec8f5709f6f4f65106280e00fe46d21e2c55de68171ae022e62d9baade7b46501aad95b2844ca65f7e54584bb0523b698ef9ad1b6","ssdeep":"96:Av0+cWKLH5D0wx1GjfDaKnnHDeeW5AOQPdAcjMg+ydPlO2wjxBUm+L:TAKd0Q1GTDaKnnjeeW5YPfQO9lO2I3UL","tlshash":"00a1f8d5077562ccb9c54d1aff2eaad9280e74ffaf73a4c4548aaa2854d3ddaf901c00","first_seen":"2025-11-11T13:54:05.855424Z","last_seen":"2026-06-21T14:00:30.170742Z","times_seen":14,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/theme/1win/stylesheet/stylesheet.css","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.549Z","timestamp":1782050399549,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/theme/1win/stylesheet/stylesheet.css HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 26 Jun 2026 16:11:57 GMT\r\netag: \"6929-67f96126-fac9d;br\"\r\nlast-modified: Fri, 11 Apr 2025 18:36:22 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\nage: 164882\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9%2BdEHA8vtdVgdwzq5LP2MYZ3oKFMe17rY1LQ8xOf2p5Zrq%2B%2F3jqsYoFf6Vlk%2F%2BA5dtszKoIBf8bdyD2nMdcAUC6f9D%2FS0nx%2BBXFpJ145GEXw2HBYQGiZth%2FY\"}]}\r\ncontent-length: 6121\r\ncf-ray: a0f389753c0b5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26921,"size_decoded":6955,"mime_type":"text/css","magic":"ASCII text, with very long lines (723)","md5":"d5eb79381be68f1990ef171d08a8fad3","sha1":"d273bdf9626a998ca445cb79b398c1b643f402cc","sha256":"df41a64c4c2e179f53070e83ade6270a37d12a8788069e0aa8314ed53a635053","sha512":"8696a36673ded31ff12efb6a09807672c3aaf380255907b4abad5c5c337f71794d7e92b5bd45dbdeafde09730267643ef7045e667d5be500ef0a063434f85e9b","ssdeep":"192:MhAmg57WPvCteopvPKbM50IywRA1Q4AwBkNMI1AD51In1/RPjnmq21CymUVbXuIc:loPKIrNpI05wfrmqMCymUVYrzDFAF4","tlshash":"47c2d9b2a510202db127c528b6d5bfd922289413ca5b4bbef647f574c7ce2e91673b0c","first_seen":"2025-11-11T13:54:05.872579Z","last_seen":"2026-06-21T14:00:30.172431Z","times_seen":17,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/en-gb/en-gb.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.806Z","timestamp":1782050399806,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/en-gb/en-gb.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sat, 13 Jun 2026 19:02:49 GMT\r\netag: \"2bb-659bba4e-deafd;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 43186\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rXniSCrHwX1Hh461Kz8n828oVoLCUID56hJlxBbxpMAk4g6WcYxerz7uqzHlxQggV9Ran28QpK85vvy6i13xSxkrVkdYAiZUSQeJUy%2FxG4DzpU8gHYpgZhQ3\"}]}\r\ncontent-length: 699\r\ncf-ray: a0f38976cc1e5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":699,"size_decoded":1469,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"8f359705b906b7b1502f6a9fad7736e2","sha1":"8d468951fbac1f7e805ba7c88eb0c20d51f48838","sha256":"f8504243946d8ec17ac6773da7802de2afb2a27cebbeaf05ece6da5e008df200","sha512":"bdeaafaeb8fe5266008818f101ca6840d6e6b3d8b77148f2204b91ef4e7e69003599e77d4ef24ff4664cea86dffc43068b0b2c0c9a5e4272edeef6e7c7d54fcf","ssdeep":"","tlshash":"650144b9d5ddcd34f10442b396c2007069238ad6461e467a9ca16c3b9b71d578b74f83","first_seen":"2023-04-07T08:06:26Z","last_seen":"2026-08-09T23:40:08.438195Z","times_seen":650,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/es-es/es-es.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.817Z","timestamp":1782050399817,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/es-es/es-es.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sun, 07 Jun 2026 20:02:20 GMT\r\netag: \"1d5-659bba4e-fa805;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 581888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w1ov6pdOCW9kJG6hLzoJmORD5rJ5Nhp%2BDvOfqwlrxIzF3BUOoE0rIFBLI2dkieBzaxh4l341sl0ASD%2FiKWF7FM%2BcIzxXaXgfyfpPN9c5%2BFmL5GjLtzHL169e\"}]}\r\ncontent-length: 469\r\ncf-ray: a0f38976dc265684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":469,"size_decoded":1246,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"d6693ce2a6346b2da89ceda335554e0a","sha1":"a88880bf0da5063d8082b66b066c4456e4d2e0d9","sha256":"e9aa6fcf5e814e25b7462ed594643e25979cf9c04f3a68197b5755b476ac38a7","sha512":"6170bc86ff2076a7211161eeb09cf950da548c5e6c6a354054319ceb1f706e747ebae3ebf758efc24f0839266594bfc45eb3438677eb8c699420b60919cdc970","ssdeep":"","tlshash":"37f054d2c590a891de1e007040828470f0b56868faa0881433c6fa5a191b40cfcb17d9","first_seen":"2023-04-07T17:29:43Z","last_seen":"2026-08-11T17:00:39.91503Z","times_seen":3697,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/sv-se/sv-se.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.829Z","timestamp":1782050399829,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/sv-se/sv-se.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 17 Jun 2026 04:21:14 GMT\r\netag: \"c05-6675434a-df412;;;\"\r\nlast-modified: Fri, 21 Jun 2024 09:09:30 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 370448\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=478yFUbaFOKLk%2BlvSc9LI8Kqcselym4QStw%2FE93NgHM4OqWxGUHv7UhGLeX5VxHe2xsdZKdL%2F6UTnTnbroRm53bUVPaRq3ZyphStaXZQu5s7uAmLNXAR4X1Y\"}]}\r\ncontent-length: 3077\r\ncf-ray: a0f38976fc2f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3077,"size_decoded":3853,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGBA, non-interlaced","md5":"8818c61952d90984cabb8779ff1dcd17","sha1":"2e931be8591cecc7fae0467a5027900277636e5f","sha256":"4d7b0175b7645ce1c9d812257d78ccb6276f11d4ac2cccdfdd6201a1a46085ad","sha512":"918ffd4d8767eed40b41a1ebb00306fe4086419544ea657e3dd55a7eac55cc3c4448867e53b072d6b3acf9ddab145e0813a98570930a56f393a56a963087efa4","ssdeep":"","tlshash":"a1514c4a644d545e100d47fa397bea024e27ea9452592f0dd9fe420e8a20c927cb6b57","first_seen":"2026-05-01T22:55:25.656773Z","last_seen":"2026-06-29T22:43:25.365771Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/kk-kz/kk-kz.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.840Z","timestamp":1782050399840,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/kk-kz/kk-kz.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 12 Jun 2026 08:43:39 GMT\r\netag: \"268-659bba4e-faa7a;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 183002\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dgu09EkPpjPgY25LWpu950k71XGK5N0%2BOefk%2FECXnDq1IGv7xW9UbSuBlxzginraD6PatCF887GgqhxcITgbDbfztn00rgWRd1mmCh1xA77sK9uzaCKKZRuK\"}]}\r\ncontent-length: 616\r\ncf-ray: a0f389770c375684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":616,"size_decoded":1389,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"6d51066ba152b15fd05d761745333135","sha1":"07c0b6e1b6b80dbd1ee8cc7c274f4755df3e56af","sha256":"b639f1e1e00cf0973f7feaf673326300e13de6e830aad5eb08937bf56ee77c3b","sha512":"ef0852e89527168dfd7b1cdddfabd2f9cd1c5990d28ee7e1e4e3199a01823ee7286bb2418ca6e803b585fcca4b7af1e1507bd16aefb9b2ca4fb2df4f297a4571","ssdeep":"","tlshash":"92f062a426215835c334a1b217f3a130c017c8e42d92227d2d02c11592b75544eeb0e3","first_seen":"2023-05-16T09:48:39Z","last_seen":"2026-07-05T01:09:35.881714Z","times_seen":84,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/home/main-1.webp","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.847Z","timestamp":1782050399847,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/home/main-1.webp HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 24 Jun 2026 08:24:00 GMT\r\netag: \"a272-67ae03be-dc1e0;;;\"\r\nlast-modified: Thu, 13 Feb 2025 14:37:50 GMT\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 365758\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0%2BLD6j8SR3aJNORD7dFUvun8EhERCkuInt%2F6OUR2547SFSIXY6Mtaa0eXpCoijlMWemIc2ED0R7skV2lLfCd%2Foq7%2F0OoRgdEeBqYJKj3srd%2FY%2FIFJ1diRz75\"}]}\r\ncontent-length: 41586\r\ncf-ray: a0f389771c3b5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41586,"size_decoded":42371,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a49a5030df04860bba79ee7d7d8e01d9","sha1":"2918f5353f198d1da103d48e67a1c89c260e5100","sha256":"6c77ee6e2a172de4243a83ba219d38fd762f56d6dba33cb12c8e46db9835cfba","sha512":"01fc45a6471d66e30a2f9bcdfa42f21a4ec269d1e3f9bdc7bd865b3912a2c6964f052eb6b43f51e642880750ee3b460dafef5ec08c6cf1dcb5a02230ee0261cd","ssdeep":"768:vjdHYfGe4b7TmXxEpT13wOslCTyHQJC5FU995vhzNVoE8akN0rr88XXHvGZ6LOlh:vjdzmBEp8lCmHQCwhNVoN+rrXP26ylh","tlshash":"b213f1890f19faa53f6f055d8682173a0987375386d25b136258bc0b9749faa03df8fc","first_seen":"2026-01-15T11:49:35.62163Z","last_seen":"2026-06-21T14:00:30.177929Z","times_seen":3,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1win.fyi/","date":"2026-06-21T14:00:00.152Z","timestamp":1782050400152,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD; jetcache_webp=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 \r\nlocation: /cdn-cgi/challenge-platform/h/g/scripts/jsd/f95a7f38c08f/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\npriority: u=3,i=?0\r\ndate: Sun, 21 Jun 2026 14:00:00 GMT\r\nserver: cloudflare\r\ncf-ray: a0f38978fc505684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T22:57:34.772395Z","times_seen":17845104,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/bootstrap/css/bootstrap.min.css","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.547Z","timestamp":1782050399547,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/javascript/bootstrap/css/bootstrap.min.css HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 12 Jun 2026 07:18:53 GMT\r\netag: \"153de-67af2186-faf84;br\"\r\nlast-modified: Fri, 14 Feb 2025 10:57:10 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\nage: 191180\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G8EpqAv5cc%2FcLbvQcfTrynvs694liNNTFUMragXjz3ZvWvpFcwtkTAKZWWuPZpnys0nJC4BQbxgc9fdelkimMb6kfyw7qbou8rGcrOJm1CxlXJOxDYIrlkLY\"}]}\r\ncontent-length: 14242\r\ncf-ray: a0f389752c0a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":87006,"size_decoded":15064,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"21b4cfe6e0f036c062c06e1934fbf02a","sha1":"04298c4a2efd47b34d8c2a9edd2f1900eb876fdf","sha256":"7942ca15dcd3605c78565a1b818b216b932bd24ac88604689ae8d5bbc95ec73e","sha512":"1cc2c26b4847e034f27f39c37ff4083555412b9d8a3fafcdbfafcc20f30447c87075507fb102f678abd53fbcf61778bf6b0f70d0cd0ab2f6a0d8299815eec7fb","ssdeep":"768:IGjvdGIi7JzLMyGHhwmOe6QR2Bxw23+GZwJqliKvS1F3ePn:4cyGHKmO/HNuGyw","tlshash":"ae83d660b62034aa71a7c65d70d0edc326192153e5668ff7f17b29e88b491cb2733f1a","first_seen":"2026-01-15T11:49:35.667805Z","last_seen":"2026-06-21T14:00:30.179211Z","times_seen":3,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/cz-cz/cz-cz.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.834Z","timestamp":1782050399834,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/cz-cz/cz-cz.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sat, 20 Jun 2026 06:29:35 GMT\r\netag: \"3e8-659bba4e-fa6d1;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 111201\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kfORZxVp6QZLOjJpx%2BrECFD0IuTNJ2oouUtq%2F%2BWA96gg5jNkDpk57A4RinJvUbCk48WV3tBkrG8N7m5ldkfNnDsSYZMDnTFuCT2iHsc8Cy9GwdgL0mx4Yhe2\"}]}\r\ncontent-length: 1000\r\ncf-ray: a0f38976fc325684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1000,"size_decoded":1776,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGBA, non-interlaced","md5":"76c7ebee377266514ad8e93ad0ffb4ab","sha1":"122e1769695d9c7a048d73d3c7189634d7c97558","sha256":"3bcdc0f87b82e2d31f8f2d0da675b34be2df8e7645ff05526dc27e44edf8e37c","sha512":"9530c072810864f417aef75e24da0d8d5cb677d96a13158b9d23ec5139595580498e39984bec8459e8261a012ce7d349880ea6b70bedb9d40e941f435a9cd190","ssdeep":"","tlshash":"6d11504a5f6082e7db4d1a3365f24202db37cd412a949e45b6dd886b0f402c22f9a4ee","first_seen":"2026-05-01T22:55:25.640903Z","last_seen":"2026-06-29T22:43:25.349056Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/fr-fr/fr-fr.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.818Z","timestamp":1782050399818,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/fr-fr/fr-fr.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sun, 07 Jun 2026 20:02:20 GMT\r\netag: \"221-659bba4e-deef5;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 581888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sJq8OMofFuWNBz73EKPPPQ%2BOHdtFkPcPoDbi4DkMxstGcqYs4zudI8Hu%2FapvWCzSNXOqKuPPGPf78zbcVTk2sZTFW6hvMTG9GH0GVjgVcBrkkMFAk4xIx%2Fy%2B\"}]}\r\ncontent-length: 545\r\ncf-ray: a0f38976dc275684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":545,"size_decoded":1322,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"c1cf1874c3305e5663547a48f6ad2d8c","sha1":"0f67f12d76a0543772a3259a3b38935381349e01","sha256":"79a39793efbf8217efbbc840e1b2041fe995363a5f12f0c01dd4d1462e5eb842","sha512":"c00e202e083f703e39cafbb86f3e3f6b330359906e3a6c7a6a78364d6adeb489f8b8ab1b2d6a1b8d9ef1a17702cfc8fc17219cf1aae3e5a7c18833f028037843","ssdeep":"","tlshash":"02f075e32bccc07cc90a0572b79ba030f4b2c9c85a5493d9509210f92f6078cdec2a28","first_seen":"2023-04-10T00:37:21Z","last_seen":"2026-08-11T17:00:39.924386Z","times_seen":3797,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/hi-in/hi-in.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.842Z","timestamp":1782050399842,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/hi-in/hi-in.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 10 Jun 2026 12:39:41 GMT\r\netag: \"414-65a6eef2-fac31;;;\"\r\nlast-modified: Tue, 16 Jan 2024 21:02:42 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 334381\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3W077jAf7Gut7QrvoV12v4%2Bx1SpqCl2BQvbs%2BtgQZpruFrEWXCRkkjIp4JZG4zuejTSUSxjrpcil9Rw6Q0JQRuvvykJdfAoXfbgfV1uQIeSHt4iJ5eVlUDAR\"}]}\r\ncontent-length: 1044\r\ncf-ray: a0f389770c385684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":1044,"size_decoded":1818,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGBA, non-interlaced","md5":"0ba38d22ca2b0e7156b913b9bd702454","sha1":"c8e769a9f398b2f2c9fd2ed0c271936db08c8a8e","sha256":"e916fa087727f0669d83b17b9aac3e9c9db8ad7fc4d80f1d37dc58b81f0d863d","sha512":"f43e4ba2e666e2bf9ca54e0574ae489c0ab9547cf9fc0e55f1a3f40225e5840c3a2482edcd91d922f3a849d3fd0406e618d4aa8a1c5675a0476cf97920109c78","ssdeep":"","tlshash":"97113e460fa08481e74d473198e75243e6b3cd421e89cb08b9cd8cb65f102c12edf6c9","first_seen":"2026-06-21T14:00:30.181759Z","last_seen":"2026-06-21T14:00:30.181759Z","times_seen":1,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/jquery/jquery-2.1.1.min.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.568Z","timestamp":1782050399568,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/javascript/jquery/jquery-2.1.1.min.js HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: \"14915-659bba4e-fafdc;br\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: text/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=3,i=?0\r\nage: 2473\r\ncache-control: max-age=31536000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k9IBX68P6707qAHWfj%2FxbHmg%2B5Xe0%2BsCD8Ad5ZsB0W5EEH79bDY3D5BpTHZ%2B%2BhIL1vZ5s0evuyTGO04yIjqbFfAFpKD3JXoH771IFC9TlMnGE5u630QsQ1AN\"}]}\r\ncontent-length: 28644\r\ncf-ray: a0f389755c0f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":84245,"size_decoded":29431,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (32061)","md5":"e40ec2161fe7993196f23c8a07346306","sha1":"afb90752e0a90c24b7f724faca86c5f3d15d1178","sha256":"874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4","sha512":"5f57cc757fff0e9990a72e78f6373f0a24bce2edf3c4559f0b6fef3cf65edf932c0f3eca5a35511ea11eabc0a412f1c7563282ec76f6fa005cc59504417159eb","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa98:7NMnJiz6oAQKP5a98Hrh","tlshash":"db83d6d9b2c67062977730b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-11T20:40:42.765988Z","times_seen":60541,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/de-de/de-de.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.812Z","timestamp":1782050399812,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/de-de/de-de.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 18 Jun 2026 14:41:14 GMT\r\netag: \"221-659bba4e-dec8c;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 235900\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JBuBJYJ4MsPhSW7APbGD7lkhPj7ByedWTFhLDlUSTgespHIaGr%2FCcehd3sWQbaMEMgpYE0LO3PatwZ8M2IC3iK0wiF3zutMLqA6oOo14Igze0p13EOvSjTUm\"}]}\r\ncontent-length: 545\r\ncf-ray: a0f38976dc235684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":545,"size_decoded":1316,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"ddabae687ecae5edaaeb808d440543e6","sha1":"1daf2d67ccaa5be01a330a231ac996a9d5575594","sha256":"3323814006fe6739493d27057954941830b59eff37ebaac994310e17c522dd57","sha512":"5bfbe453e635ede38a7e495badb349a2ebaa152a794d26d5b69b657f8e8fd5188436542bfe8c35d0c1117c3a25500d0404069d4b854faece914e07684d07a928","ssdeep":"","tlshash":"46f026d6514092d3ca1910de2c031651f5b3dc91498dc070011a8e8055f68c9ddf2650","first_seen":"2023-04-07T17:29:43Z","last_seen":"2026-08-11T17:00:39.840025Z","times_seen":5736,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/et-ee/et-ee.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.816Z","timestamp":1782050399816,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/et-ee/et-ee.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 26 Jun 2026 17:38:05 GMT\r\netag: \"a4-65bbd324-fa575;;;\"\r\nlast-modified: Thu, 01 Feb 2024 17:21:40 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 159714\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i%2BdPzRV7k8NXGWnV1uBexsHLA83WZ%2Bpc6gq7A889wmKZQmQRvgZOe2th3fjYLv4De%2Fl%2F1j2x8nZN4Fnyft%2FtK83fAH5mf8ci9JvAr%2FgYm5CC%2F7NRhhY4toCT\"}]}\r\ncontent-length: 164\r\ncf-ray: a0f38976dc255684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":164,"size_decoded":946,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGBA, non-interlaced","md5":"f0bdef78ecfb5bf12217ba78faf1f929","sha1":"28049195defdb9ab766b1618f3baa53fb4422ee6","sha256":"0572ba01c3f93c19689ffd957332db7e6a32a8eb0c0be1db1cf6edf2c21ed658","sha512":"21eab508b516730abf3c3815635337505b79e5ce9e68f28a20ad32177f71070901985dc0d14a1b9f7b3acfb797a584115b55ed7978330c75d6eab858bdab9a82","ssdeep":"","tlshash":"66c080d71d90543f554c15519876009145733b7c1294370455da39987392b5247e6756","first_seen":"2026-05-01T22:55:25.650972Z","last_seen":"2026-06-29T22:43:25.356363Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/cdn-cgi/challenge-platform/h/g/scripts/jsd/f95a7f38c08f/main.js?","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1win.fyi/","date":"2026-06-21T14:00:00.187Z","timestamp":1782050400187,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f95a7f38c08f/main.js? HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD; jetcache_webp=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ndate: Sun, 21 Jun 2026 14:00:00 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a0f389792c515684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20567,"size_decoded":9250,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (20567), with no line terminators","md5":"84da21f43b3723e9336f9ff2c61e1153","sha1":"92b78a130726feaedaccc7f76a759eaac45e0d18","sha256":"4ea82cec8c75bf3686b300bb570d2c01fdce2b4adb31bf125c31e15d12bbf99d","sha512":"9d4f76d957b81eff081962acf0145577d53fd64d8c6ef5ddb99664ce7c16799fc668e1b2cd25bd40de755fbe97e4fe5743e40ff6397c02555bf45e69ee44f404","ssdeep":"384:SJU5XQm5LwhPPtEz/zB3bK5ZOv6+TvjfnhbwMkylmNxDUcOZlf27:UUwhPA2Z4jvj+MTiQ27","tlshash":"1b9275c938db705c93325c35507734ce7a3facc4a9294a1ac211e6e8f9f4798855fea8","first_seen":"2026-06-21T13:13:54.064592Z","last_seen":"2026-06-21T14:00:30.185277Z","times_seen":4,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/hu-hu/hu-hu.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.822Z","timestamp":1782050399822,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/hu-hu/hu-hu.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 12 Jun 2026 08:43:38 GMT\r\netag: \"1b0-659bba4e-fa8b6;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 183003\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KYd%2Fs7lr3BOLfZXKGxW%2FrWZkDdgpYi%2F%2F90p%2FXapsVHZ4gmejbOFkwmEt9KSycxwfdK%2B1Yf0CESmyMEMZghrBVj7upn0zPUECHJ8BkbUpDEWHJplH7Grkl6xm\"}]}\r\ncontent-length: 432\r\ncf-ray: a0f38976ec2a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":432,"size_decoded":1213,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"6c6fce8a6fd09c340964b00c5e82a8c3","sha1":"9a189d123170ec8c611c6ea83910e5988ada03f6","sha256":"61a2cecf8326a8da732499312a098f89d050d13546f6204e6204de38c550437e","sha512":"cea40c030ed55b43c643df4cc75a47315b39ca3816797ecd406533bed7e7d8cb8e76aa453f1d316377e4220ff48c710d489d438262e9b9353f8e3626806db3a3","ssdeep":"","tlshash":"6ae023e4f1c1816ac16b51e38ba79231b02e45680635cbac2d46e487877aea180a8303","first_seen":"2023-05-05T00:52:02Z","last_seen":"2026-08-09T01:54:32.692063Z","times_seen":1293,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/pt-br/pt-br.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.826Z","timestamp":1782050399826,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/pt-br/pt-br.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sun, 07 Jun 2026 20:02:20 GMT\r\netag: \"251-659bba4e-faa05;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 581888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=99BnjNlm1bBOynDDMPiYkCrMqUVjfAhhaEOLzBM1gSH4R3%2FPil1G%2BQU7ECiQTp5pwSVi0avXqW%2Fs71rkhil%2FOKtPb14Eo0wgKjVm22u43pkOqJaqXmBWwRcQ\"}]}\r\ncontent-length: 593\r\ncf-ray: a0f38976ec2d5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":593,"size_decoded":1370,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"54c40b8a9ad7df4783d19acc05910f8e","sha1":"8cf2122c23d375e4d752ad742f2f54e6a270bc63","sha256":"dff6f4d907290bdbe74812bf73b590f268694e0a30e64b4bb24b803a47b3e319","sha512":"7245213a9d1468d18a75cd96d91e7b8b602374902c2a852dbfc9d5d6e341d6183d8b5517651d3d546085ec490b196ab6e0b37ae9f5f140009a29c99201da7ef4","ssdeep":"","tlshash":"54f041c5fb5098accdb89ce63887923130eb6d3106be08bea480fc186fc302c815af01","first_seen":"2023-05-15T21:14:03Z","last_seen":"2026-08-09T07:01:05.038484Z","times_seen":649,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/ru-ru/ru-ru.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.838Z","timestamp":1782050399838,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/ru-ru/ru-ru.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 17 Jun 2026 16:55:43 GMT\r\netag: \"d3-659bba4e-df567;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 334382\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nTYYWIYw42nLI1pqlwi%2BolXP4pIcGkfwDgc%2FSGKkUdPTXEnVXOcUM6U4vhVYNX5P%2BQKJGJiien2z0quZaemPdAlULMbMx9JcImh6Iiw0kzntRUb%2Fge0fnro6\"}]}\r\ncontent-length: 211\r\ncf-ray: a0f38976fc355684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":211,"size_decoded":987,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGBA, non-interlaced","md5":"5ccd9a5d2f6d9dcdb0a23563b29a2c8b","sha1":"d91470d79557763b11b701fc5b62686c87a2cd7e","sha256":"80bdd8624943431cb05c845f7d6ab19a85e524362f9f60d337a18add5acab0fe","sha512":"1aaf858b95ff441beac1f35384ec867524159f630f9ce0b3259365c8dfa394fc9f36384e76b03ef80615e0ef1034f5eb62a95129241642181d78ae17529f3ff5","ssdeep":"","tlshash":"70d023c67b045d6d9a0d8477117600618c3f654a8545114cf9c4f528f4155c974b1311","first_seen":"2026-05-01T22:55:25.657539Z","last_seen":"2026-06-29T22:43:25.370644Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/uk-ua/uk-ua.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.839Z","timestamp":1782050399839,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/uk-ua/uk-ua.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 10 Jun 2026 22:18:55 GMT\r\netag: \"1be-659bba4e-debdb;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 287778\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=r%2ByPnbg4VAb3KUm4QMHhhAHBNT7O2t%2FuduxNihj88WqdJh49xmLEu%2BLdWgtkwQdaniNySkee2bZnmZz345jfDv24r9YT%2B4VmvhSLDLH4qlgErS5d5%2B8%2Fqv63\"}]}\r\ncontent-length: 446\r\ncf-ray: a0f38976fc365684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":446,"size_decoded":1227,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"7ef7a6f5def3a4117d5c2f08e37008ff","sha1":"9fd21d733a8d9d551c5880c8f0b6a5e5c6916f57","sha256":"9ae2f204178855c4fdb29ce75a0a1b2588fc3db3a7084d29715876bacd293508","sha512":"ab9d39fedf5a1e0c7fcc8226a4e43a0e241dfe3e08dfb3eeec028dc44a48431c56e7c434d99c75e11024aa36a1c383ca4fb1749126719acc9ff1bc7f7d311d71","ssdeep":"","tlshash":"cef0dcc576105038cea908e245d900609026871a6aa3623f598389eb4614eaaceb8a02","first_seen":"2023-05-04T07:37:06Z","last_seen":"2026-08-09T17:30:00.206978Z","times_seen":429,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/ko-kr/ko-kr.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.844Z","timestamp":1782050399844,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/ko-kr/ko-kr.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 11 Jun 2026 10:29:37 GMT\r\netag: \"250-659bba4e-df1b5;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 270924\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8YtcxYkCqlVT1P2z0tQJ54iQ3Oz8VfTIkzCg86MWz5Yiahp1VOQqnsJLPYLlgqm90MVXFRmqvUqDf2S5%2FPch3rMcu4mHQYymklHxRkBX%2B03m3nbTbhPOANhY\"}]}\r\ncontent-length: 592\r\ncf-ray: a0f389770c395684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":592,"size_decoded":1365,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"cf63c15bf955e54afed8061497c7f7ea","sha1":"8f58e042f4b2047c6f8a83da65b8b329fc764125","sha256":"6fdd24bd96b3a482bc058d5c9bcfd6f1c664d91bbd47658d65ac5d852535f7fd","sha512":"2c6fdd60a7f555ce52c7c54e9a3e475067be9de952c74bf7dd00f5b1ae57ca9d31640a2e436c9268c93723351a80d7cbf32e5855f8bf333333ed88b3eb96e8a9","ssdeep":"","tlshash":"a0f041c3b3e00160c9ae0676b493a271fb3e2bb5c52c026586c2e50e309073584da84a","first_seen":"2023-05-10T00:06:02Z","last_seen":"2026-08-11T17:00:39.911763Z","times_seen":2850,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/el-gr/el-gr.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.835Z","timestamp":1782050399835,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/el-gr/el-gr.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 19 Jun 2026 02:35:26 GMT\r\netag: \"17a-659bba4e-fab6e;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 204952\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U9VzTmfI2rN5KgvKmS2o8a9MGNXP%2BLtD4eCm%2FHq39KnYm5egXvsd8MLJxwceY9EpGxm%2BnROztnJFvU3RXdx2DezOMkJM9VmUfzg3gBiytlsN9P39vW%2FugNsD\"}]}\r\ncontent-length: 378\r\ncf-ray: a0f38976fc335684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":378,"size_decoded":1155,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"3a07f9614caf9ad4d41747a1ba41b445","sha1":"a5abebad0a9f81630e077f623434d58191c28835","sha256":"72180e106bba9e5b220cd73149f387f886beaae86b785738f12e430da744c52f","sha512":"34831c91afc185c0bf0e69a4ba9788d6ee7166353612e3476368929f92110fc0363fa5a673b2674e2d7dcdc45b5f500e4f1fd53d4e785670a64128a480a82b96","ssdeep":"","tlshash":"bce0c0c2686dbaddd24f2637986678e2f4310ab603d30900fe07c4b106554c472c1a72","first_seen":"2025-02-01T22:17:08.193874Z","last_seen":"2026-06-29T22:43:25.353736Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/cart.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T14:00:00.150Z","timestamp":1782050400150,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/cart.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD; jetcache_webp=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 18 Jun 2026 00:16:35 GMT\r\netag: \"936-67498528-dc240;;;\"\r\nlast-modified: Fri, 29 Nov 2024 09:11:04 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 14:00:00 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=6,i=?0\r\nage: 287781\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Vsqvp1dw%2BrFnrO2QGtMeZcgl23TRYgB8Qv23CbYxUFuwRE1ELlM5wwnqTqOPOM1Vpt%2B%2Bjga50gQcTx7Mx89mBTfE61brBe5Defz8aVsyxiXaWj%2BJ14q%2Bu3%2Bp\"}]}\r\ncontent-length: 2358\r\ncf-ray: a0f38978fc4f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":2358,"size_decoded":3143,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"ce1ce806ab0db5d9764954993adc5d17","sha1":"d17dfe07443a4ae302f2e8fc7e6afbca72b33ef0","sha256":"989aa098c21e360f7cd277affd2df3405e8c2d23afc17d60ec7ef59c88ef2af4","sha512":"17fe2d8a5bb9a310c0b168c0fe0811d659bea3b47c944b29ef71ceeb750b2277a787d543d5cf3d92869db18ca1b0c8f7369819ee9a7a9f28e394f7b6be9ca3db","ssdeep":"","tlshash":"97411bc6bae51f44b16ef9b13613250566abac452fe6439c1a5fc41178c719dc288b11","first_seen":"2026-06-21T14:00:30.190619Z","last_seen":"2026-06-21T14:00:30.190619Z","times_seen":1,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/tr-tr/tr-tr.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.832Z","timestamp":1782050399832,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/tr-tr/tr-tr.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sun, 07 Jun 2026 20:02:21 GMT\r\netag: \"1ec-659bba4e-dee0e;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 581888\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O8gJFpxqrVPR02jGmqrAsYdhs6OfGCsxSfEj90H5Nuqc2x0zM0jDhNS1k6BITu3LG%2BWao8hDXZpBhx0vhYhtKbaj1InW3MFKQLDAS2CrJKDrx%2BgY7uZU7aTZ\"}]}\r\ncontent-length: 492\r\ncf-ray: a0f38976fc315684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":492,"size_decoded":1265,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"31ea1f705854ad57c432845068bd05d3","sha1":"e1821d04141354bfdeb2e25e488ac8a7face8900","sha256":"292d592f7fa1df2fa653ecc1e03d5eb2ae68277c6df264f762aefb8218e23454","sha512":"48258f8dd8184851243f72ba042d00acec6c3fade4b3acb6265a41ec078802505352c7f09a307567ee9331583568bcc8165e806648a462e637856e2d272413b5","ssdeep":"","tlshash":"3ef00eaa65a25770c0870ad2b6c2b321cc6b869a0232cb0e1c0ac89ba71b483c49130e","first_seen":"2023-05-08T17:27:13Z","last_seen":"2026-08-10T08:40:05.745832Z","times_seen":1029,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.566Z","timestamp":1782050399566,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Tue, 23 Jun 2026 13:59:59 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FJ0CnA1l0Eg%2FikjcGjAE4FLEDYHupOzFJSQmcfUODEfrFvrtI6CYwoDsTjcLmZ7SX0%2Ffma%2FNnPutUCTQwTW77VXD0v27O7iUAbr%2BC4mqLjoYv8E3kvG%2BEE%2Be\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\ncf-ray: a0f389755c0d5684-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1230,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-11T22:56:56.816967Z","times_seen":418258,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/nl-nl/nl-nl.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.814Z","timestamp":1782050399814,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/nl-nl/nl-nl.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Tue, 23 Jun 2026 05:12:04 GMT\r\netag: \"250-65ccc9f2-df343;;;\"\r\nlast-modified: Wed, 14 Feb 2024 14:10:58 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 463675\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U6l6AsaV5p0kAp%2BZOzQS4D5OTFwyCfFWri04DWKH9uFIE5%2BNHlf9tmF7SaBeVKNnw2euFx04BfxbpG3E0Bvx4tIiO91E8Xy%2BKMIgqU%2FtFEQcWvaEToHnGyGg\"}]}\r\ncontent-length: 592\r\ncf-ray: a0f38976dc245684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":592,"size_decoded":1369,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGBA, non-interlaced","md5":"5a5a45ba9ac0c48c178e9315879ddfcf","sha1":"6e00897d4ebf1e077f4e5012961ba661a6aa91f5","sha256":"d88aaaa6c6870278e04f56f928edb625c4f8c53ee9e00339838891e244f5b3eb","sha512":"56c9b8f43d6d55d2af643f2a7cec5b42a82a234a594f439ede3a00f60bd0856c913a27cde40d2e1741379850d3430e11312db38cbac66a5ca28dcdb04948c4f7","ssdeep":"","tlshash":"7bf0e1824ed022d1c64e87328de66102cd2685401bc0d606b68d9cb71f002c2359f1c9","first_seen":"2026-06-21T14:00:30.192441Z","last_seen":"2026-06-21T14:00:30.192441Z","times_seen":1,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/bg-bg/bg-bg.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.836Z","timestamp":1782050399836,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/bg-bg/bg-bg.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 18 Jun 2026 08:11:56 GMT\r\netag: \"1ce-659bba4e-df0fa;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 270924\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pDmXIidJMGs5UQz8ze7rNJXCalAIpdy5%2BTaFD3WtpoqCOjozXRIlPr4xZbUi6zxD%2BGZQ0Qr5blyi9bTdRa%2BGaRpWA%2B11znltBP46PZaCyrGsiEk9ay49SfZF\"}]}\r\ncontent-length: 462\r\ncf-ray: a0f38976fc345684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":462,"size_decoded":1239,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced","md5":"77b2183ab10cd26ee4e79fdfc12b8621","sha1":"c46dc6e0512560af14fceef6be24e8448e0f85f3","sha256":"c4838a24ad388f934b04dbf9dba02a8bc6e9e58d0a1076477b47b5987a5c2d64","sha512":"50ddb2ce4bc0597bd3abba49ccfed0bc57484bffad6d44b8eaf2e8bdbffb52576167c7c575d218693c984d94775f6dd4b573038740d95cd6c402b8aeea49b885","ssdeep":"","tlshash":"a1f02bb477416a38cd1559fc52d34211c531cd51d1368fb4ddc6dc3d53fa05960803d1","first_seen":"2023-05-08T17:27:13Z","last_seen":"2026-08-06T07:00:56.947914Z","times_seen":290,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/appstore.svg","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.852Z","timestamp":1782050399852,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/appstore.svg HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Sat, 06 Jun 2026 03:11:23 GMT\r\netag: \"16d1-6645244e-dc24d;br\"\r\nlast-modified: Wed, 15 May 2024 21:08:30 GMT\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 115081\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zqrfyfYVXngz1IhappuAnHRjxKsJhUpvKB5N1fYxz8%2BXsHgOPsYf48bUZiQ9Faa6kMCzjbVmO8vYfY2SIcKTXEGe9FXK%2FkrL5tAo9%2BNtYwvz1Ze7lJvbVSy7\"}]}\r\ncontent-length: 2397\r\ncf-ray: a0f389771c415684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5841,"size_decoded":3223,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"29ecd268ef87b93ba5c095169533c185","sha1":"d6450cc39dbe07446d7c4fda21739875bbbca2ae","sha256":"e133c3a14ee607aadef586f3dd26bc2f9a9e2d60828a23e7c867edf6dc5a3ee7","sha512":"490c1e1af375c6abbd7604d9e1f1b3795c7daefaa297004d11636359853c2acd6c7a2f3be95f5abd21fea3317939ea210800f1b3181fecbc18d07ec08ed91043","ssdeep":"96:qrKpLoMWpf5U0N5UJfwdqQP6w+PyWXLfg41C2pGyW5lGRLf+OQbIuX/:qepLaphU0XUFwdGpPyYfgsC2pGyW5EfO","tlshash":"78c195da2f70668c64db0cafff16255ca106b8fb7ff64741928ae42a9c83dc4e109d10","first_seen":"2025-11-11T13:54:05.852654Z","last_seen":"2026-06-21T14:00:30.193976Z","times_seen":14,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/image/catalog/h-img.webp","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.986Z","timestamp":1782050399986,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /image/catalog/h-img.webp HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/catalog/view/theme/1win/stylesheet/plaza/header/header3.css\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Tue, 23 Jun 2026 05:12:03 GMT\r\netag: \"752a-67af5688-dc27b;;;\"\r\nlast-modified: Fri, 14 Feb 2025 14:43:20 GMT\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i\r\nage: 463676\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LDzoe7EpI6nzjmB6ujnY6xc9A17H%2BthObM%2BlwejO8SSZJf5WFmtKZG9Efgr8%2FKN65kLOvC6vELzrRrv%2FSArcQvIGYklLtJBCiw8JWOQbnQ1kDcAy1Y7AJELO\"}]}\r\ncontent-length: 29994\r\ncf-ray: a0f38977ec465684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29994,"size_decoded":30775,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6b81886bb768025e030ae5dd4ebdf677","sha1":"1e002614209499d5b848536edfd7641151a5fcaf","sha256":"8cb7839ed8be60949d3f2247ea5fa1b571df514367def838cfb232c61f46ffce","sha512":"1e4811525b7ed85578bd6d54a49e57bbc8bf4e64d3f61cbde1a5e97542995f9ee313496b06ce3f4e8367085be3f7bfeda8e1e9808f8ece83a7adbabd64a103c4","ssdeep":"768:hXOASZ34LtBgIT2mv1wlf1pNal7p+QTmSdEFYdP3z:h+ArL4IT24G1Pa3+QZZdP3z","tlshash":"ced2e11e6c3c2dcbc88a650b06087ceb53997bcf70d16b612b4a3c59917a5ca89f9c0d","first_seen":"2025-11-11T13:54:05.849241Z","last_seen":"2026-06-21T14:00:30.194909Z","times_seen":14,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/language/az-az/az-az.png","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.808Z","timestamp":1782050399808,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/language/az-az/az-az.png HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Thu, 18 Jun 2026 14:41:14 GMT\r\netag: \"160-659bba4e-def82;;;\"\r\nlast-modified: Mon, 08 Jan 2024 09:03:10 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=5,i\r\nage: 250525\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wHAK1VMy%2Bikdg3y%2BLVn0CqMYaAbRKX2TuwfhcTX7I%2BbqLxKgkP3IcrEP%2FALewxOxdn9M2dbdzjZPiYnJpJHfDZHEql%2FW2tRr7zm6%2FnbEeyIPMJNzs4rZvLWD\"}]}\r\ncontent-length: 352\r\ncf-ray: a0f38976cc1f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":352,"size_decoded":1133,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit colormap, non-interlaced","md5":"eaf5a78edb36e1145431fffd612810f0","sha1":"db6661d82c7426ddb855686d54efe44b13025500","sha256":"e6210c8c16e25c7d892f391a7903542530bd4e4d565b910e297d6639485a0169","sha512":"df93e74890e58e1b4c12c3dba596804c36d73a5249814b8b715dbc0476b216e661781dc6c8f027e9c34a18ab6442ee5d23fc5aa1c1e0bfa4196eec34e64db755","ssdeep":"","tlshash":"0ae0c0da56151dfcde0e0520465581a8e389d6c6180baf21384d8d3b4701a000455bf2","first_seen":"2023-10-13T16:45:27Z","last_seen":"2026-06-29T22:43:25.346079Z","times_seen":7,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/bootstrap/fonts/open-sans-v40-cyrillic_latin-regular.woff2","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.969Z","timestamp":1782050399969,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/javascript/bootstrap/fonts/open-sans-v40-cyrillic_latin-regular.woff2 HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/catalog/view/javascript/bootstrap/css/bootstrap.min.css\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=31536000\r\nexpires: Fri, 19 Jun 2026 06:24:41 GMT\r\netag: \"5de4-670d390a-faf8e;;;\"\r\nlast-modified: Mon, 14 Oct 2024 15:30:18 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=3,i=?0\r\nage: 196578\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yZW%2B9QtjBY%2BQvJ982xaBcv2u9FQPFygrRmHlbHr9%2FifoqL%2FRPK47ppoSq2HBWr0SPeCGbEjYeiIRCMLIy%2FnEXKqVzHpbN9YL9VXHBRwKvuSDCBi7ZYNO9q%2Fp\"}]}\r\ncontent-length: 24036\r\ncf-ray: a0f38977dc445684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":24036,"size_decoded":24824,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 24036, version 1.0","md5":"b3c185e6394a96a35e914242dbb614d1","sha1":"2df672787f27f9286c2a54e0f10573e6c29bab7b","sha256":"3ac3e93b4db671eecebccc03a2a32cafcce5e07e695900cd43e304b037e99113","sha512":"83a3c5b0d1e7c2918579204936fd7597ef4f046115eda1a85edbc39c1cd8a3bd15fb219171aa2fc84450abe040e460f192aadd6b707cfc9b96873cfb35c00030","ssdeep":"384:aMR+QAIgAvRSFB+MRGmZ7h5AIrLmf1ygyZLHhYqZOS5pvz6sG7SJ0H8zUO1luN55:VRXg2RyB/Vgsrg0BZOUvzZUi0czT4I+","tlshash":"b9b2d0663f32e1d8771f3974653bc7f47cc00971422e1caa12a7d3a8872b28a75b5b42","first_seen":"2025-06-07T15:01:25.420965Z","last_seen":"2026-08-09T09:19:09.741677Z","times_seen":37,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1win.fyi/catalog/view/javascript/common.js","fqdn":"1win.fyi","domain":"1win.fyi","tld":"fyi"},"ip":{"addr":"172.67.68.97","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1win.fyi/","date":"2026-06-21T13:59:59.574Z","timestamp":1782050399574,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1win.fyi","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 25 Apr 2026 20:30:18 GMT","end":"Fri, 24 Jul 2026 21:30:16 GMT"},"fingerprint":{"sha1":"9F:A3:76:E5:B5:1A:D4:C7:C2:74:D3:CA:77:77:C0:01:9F:54:13:D0","sha256":"0C:DB:1D:08:F4:D2:DF:19:90:EA:2D:CF:80:30:59:63:36:A0:C6:BF:14:D6:01:D0:D9:1F:1E:E4:32:0F:7E:80"}}},"request":{"raw":"GET /catalog/view/javascript/common.js HTTP/1.1\r\nHost: 1win.fyi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://1win.fyi/\r\nCookie: OCSESSID=9e434e5e26d0e7b4b176ea6116; language=en-gb; currency=USD\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: \"16e0-668a8548-fafb6;br\"\r\nlast-modified: Sun, 07 Jul 2024 12:08:40 GMT\r\ncontent-type: text/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 21 Jun 2026 13:59:59 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=3,i=?0\r\nage: 2473\r\ncache-control: max-age=31536000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1xhMmy4%2F1bD2a8Z%2FqjzFneUE4jgmXhbhBwe6MIPcB8RI%2Fas4jw%2Fir7PikB5Na9X6b9tB0WtE2nkgKAUdvxxcZsdvEWfU8mJLYeiNYDTmIaozP%2F7sA29OD23Y\"}]}\r\ncontent-length: 1724\r\ncf-ray: a0f389755c115684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":5856,"size_decoded":2509,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"6da935dab9ccf3171482deb7e6b1edd4","sha1":"f56f587483b73522a704939dc2f5fb3585fbcd86","sha256":"1bda39687cd5eee92f8d041971ee7487b6fc656b8cba118786d8fa0011bdc12f","sha512":"248dc245b16120ba930544cf188b3f77a3ecd872a0c5dc4627858c350896123365fa823a1870bb58fff7d7ca52dced2de9a79c8980cddc90a3d39b95792b5203","ssdeep":"96:i2L8YxYi6vzTxAwv6lEIuUV29AA4TnKV3CRv35QGXcCT2H2Hv8ZWnQX6XqwdrKX9:iA89xAwClHuk29AA4TnAeFfTI2xnQX60","tlshash":"4fc1436cfbbc15868077305a09ae68cc123d8031b9415d7bbcbd96d41ff6e2817a9c39","first_seen":"2026-01-15T11:49:35.674279Z","last_seen":"2026-06-21T14:00:30.197123Z","times_seen":3,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-21","alert":"Sinkholed","trigger":"1win.fyi","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}