{"report_id":"e1a0304c-5183-4bf5-aff1-24626a10ed78","version":6,"status":"done","tags":[],"date":"2026-04-15T12:40:47Z","url":{"schema":"https","addr":"robloxwatersplash.pages.dev","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.215","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"title":"(1) New Message!","dom":{"size":8205,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3805)","md5":"ef5ed05e611efa5ab61a8e0eae750c9b","sha1":"65ff0312658093d57d7ed97e062f98848c83c01a","sha256":"a1ff0f1386476feeae4d8f39a44e188e68d9cc9e67cb7e4d1ab8c344f5fc63b2","sha512":"5c1e6f9d53797d5dd2c425dde72dce1775d4ddedc9f5f9f18f5779d2b7a7e6609dababe5f57fd3fab248ee769bbe7592db0d5ab07e674ced242c1ee56790f13d","ssdeep":"192:WcgUJgIhx3DaKgHkEoG/cXKm9mQzCIhx3DaKgHkEoG/cXKm9vSV3VCkCaO:BJn3DaKJPQczLn3DaKJPQRl2","tlshash":"f8024c7cdd5d08a975ba70ff245a7559ac93a127b490c9c3b59cc68097317b00ebbcc2","dom_hash":"domhashdc54fbe1ae197f2d0347c91caad45e38","first_seen":"2026-04-15T12:40:55.022568Z","last_seen":"2026-04-15T12:40:55.022568Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.215","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-20T12:40:47Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":20}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-15T12:40:25Z","timestamp":1776256825,"ip_dst":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":57718,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)","source":"{\"timestamp\":\"2026-04-15T12:40:25.808215+0000\",\"flow_id\":1873789125737262,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.24\",\"src_port\":57718,\"dest_ip\":\"172.66.45.41\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2057746,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_11_20\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_11_20\"]}},\"tls\":{\"sni\":\"robloxwatersplash.pages.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3492,\"start\":\"2026-04-15T12:40:25.801582+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-creative1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-creative1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-04-12T22:20:19.752051Z","alert_count":0,"request_count":2,"received_data":34862,"sent_data":860,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"kettledroopingcontinuation.com","ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-09-01","domain_rank":196057,"first_seen":"2025-07-30T15:18:19.355595Z","last_seen":"2026-04-09T04:42:26.419925Z","alert_count":16,"request_count":4,"received_data":3248,"sent_data":2355,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.show-creative1.com","ip":{"addr":"104.21.15.229","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-08-20","domain_rank":392451,"first_seen":"2024-08-27T12:23:01Z","last_seen":"2026-04-09T04:42:26.094879Z","alert_count":2,"request_count":1,"received_data":2489,"sent_data":544,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.nightdestruct.com","ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-03-30","domain_rank":0,"first_seen":"2026-03-30T18:41:21.656654Z","last_seen":"2026-04-13T20:25:04.58189Z","alert_count":0,"request_count":10,"received_data":337816,"sent_data":4975,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"robloxwatersplash.pages.dev","ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":4,"received_data":60825,"sent_data":1954,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"preferencenail.com","ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-07-01","domain_rank":20606,"first_seen":"2025-07-08T12:55:47.271261Z","last_seen":"2026-04-09T07:32:55.676894Z","alert_count":9,"request_count":3,"received_data":257868,"sent_data":1275,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"links.mtevor.com","ip":{"addr":"172.67.199.161","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-10-31","domain_rank":0,"first_seen":"2026-03-10T23:35:42.996415Z","last_seen":"2026-04-14T16:50:33.449658Z","alert_count":0,"request_count":1,"received_data":717,"sent_data":465,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.show-sb.com","ip":{"addr":"104.21.95.140","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-08-20","domain_rank":187612,"first_seen":"2024-08-31T03:46:04Z","last_seen":"2026-04-09T06:59:34.230556Z","alert_count":3,"request_count":1,"received_data":2095,"sent_data":520,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"immigrationacre.com","ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2026-01-21","domain_rank":0,"first_seen":"2026-01-30T08:57:45.831225Z","last_seen":"2026-04-03T00:33:35.464089Z","alert_count":8,"request_count":4,"received_data":291332,"sent_data":1852,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"tse1.mm.bing.net","ip":{"addr":"150.171.27.10","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"domain_registered":"1997-09-03","domain_rank":17960,"first_seen":"2014-03-13T14:42:52Z","last_seen":"2026-04-15T12:34:54.503783Z","alert_count":0,"request_count":1,"received_data":43702,"sent_data":491,"comment":"","tags":null,"fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"192.178.25.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-04-12T22:16:45.621325Z","alert_count":0,"request_count":4,"received_data":175884,"sent_data":2248,"comment":"","tags":null,"fingerprints":null},{"fqdn":"mtevor.com","ip":{"addr":"104.21.21.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-10-31","domain_rank":3995008,"first_seen":"2019-11-04T00:42:52Z","last_seen":"2026-04-03T04:05:44.921993Z","alert_count":0,"request_count":1,"received_data":7817,"sent_data":426,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"adxpy.pages.dev","ip":{"addr":"172.66.47.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-09-02","domain_rank":0,"first_seen":"2025-12-08T23:25:40.439519Z","last_seen":"2026-04-03T00:33:36.563634Z","alert_count":0,"request_count":4,"received_data":13709,"sent_data":1771,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.storageimagedisplay.com","ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"domain_registered":"2024-09-13","domain_rank":170153,"first_seen":"2024-09-13T12:56:32Z","last_seen":"2026-04-09T23:27:08.016505Z","alert_count":0,"request_count":3,"received_data":181922,"sent_data":1385,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"protrafficinspector.com","ip":{"addr":"3.72.196.114","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2025-06-18","domain_rank":614186,"first_seen":"2025-07-25T22:45:21.95813Z","last_seen":"2026-04-08T20:17:12.531035Z","alert_count":0,"request_count":2,"received_data":1414,"sent_data":940,"comment":"","tags":null,"fingerprints":null},{"fqdn":"sourshaped.com","ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-09-03","domain_rank":0,"first_seen":"2025-10-06T14:35:38.581947Z","last_seen":"2026-04-12T13:21:12.374899Z","alert_count":27,"request_count":9,"received_data":226446,"sent_data":15400,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"wayfarerorthodox.com","ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-09-03","domain_rank":0,"first_seen":"2025-08-08T11:06:50.216151Z","last_seen":"2026-04-10T06:55:22.229014Z","alert_count":39,"request_count":13,"received_data":23126,"sent_data":12802,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"bb27232549abd814635dde5a338cbc9e","sha1":"90b24ec16b789453aec40bcd9b3b620ac4721335","sha256":"2f136d970baa2f3c28b182172051502e723fd8ce872321a266be73da9cf97afa","sha512":"7575109e4beefb0aadde26992f1016198461e154e0a5b94d05dc718373963f73de511184d1e072acf5bbb6ccb4feef0184d2d26e61497c22f18e2abda1285bc4","ssdeep":"","tlshash":"cfc04cad5044b54830b2cdf42979c644e120cdd4354abc3526e2541155cc64e9c7677d","size":147,"data":"","first_seen":"2025-12-18T23:27:07.103769Z","last_seen":"2026-08-05T18:54:41.301049Z","times_seen":350,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eventHandler","is_inline":false,"md5":"a73d26dd421e931fcd8e269f07769d64","sha1":"1a82dcc6914fcd0bde9ad067afe327f864f417ef","sha256":"dbec47c6cca1b7f4d56e8ceb1d4cfa69d78067c7480a8c04bd9b96afe74e0af9","sha512":"f02e979135efca3b320a922788bfa4647013506e61a50d0e000b576eb984bca5f399213ee9ea56ba4a33825ab8c3aaf4c212ab233d340107df27759b16a5347e","ssdeep":"","tlshash":"107000080a0ae0a8080a0a023822c00c02800082000ae0a200000a0020000088820220","size":18,"data":"","first_seen":"2025-01-05T08:04:41.550371Z","last_seen":"2026-08-05T18:54:41.287425Z","times_seen":387,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"b95f4dd12cb47f93177bf025a73da4e5","sha1":"c5e4d2cc995383934df9d1719aaab748ef9b363d","sha256":"d15f6018b95e316e3f09e5d4a9f054654dc4cd1e837e4505e8e580ec74b8a874","sha512":"e07c4d2dbfcdcdf60d3a054e4ace30331731595aa9e10b79962b797d4e68348c287abc2e783760fd660710211d7cacfb84ece9db4d3187162dc588e8afcd28e2","ssdeep":"","tlshash":"bb014704e22627f8d13b2b646f7f638a19a3020dc5c9c51e21ec7be73c3345656d6c29","size":693,"data":"","first_seen":"2026-03-08T14:06:21.503706Z","last_seen":"2026-07-20T06:22:39.058294Z","times_seen":44,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/d0/89/ea/d089ea049f0f7b1eacfa2b5bb99d3bdc.js","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4d5e1c3fd6337b200e4d103651f5a193","sha1":"e5a4cf25c97fb3c87c7c45bfc05904a4b00c512e","sha256":"34538af87ee1fc84376642b4806c544c64df3778b52e0f57ca366274f389ad8b","sha512":"9b9cc142c46cd7b2a379d1f593f40fb0e86d9d39d2cf8b9be91af7e77129123957646e0367f7f0965df4a1d1c4e24f74de735b5ed5ee0b36e4423333d39dd3c9","ssdeep":"1536:gS7xg4asY51M18N222qysMHBPMDAVpFoRJv932rO3tus/1z:bosu1MQBsMj92rO3Hh","tlshash":"27a3c48c7fe2b05b522a7077352fa52bf02d4c2c248cf468f1569de42a7c71ae53ae51","size":99384,"data":"","first_seen":"2026-04-03T00:33:38.788131Z","last_seen":"2026-04-15T12:40:55.050123Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2fb9d9f348fa0a0990998b66b89c4ec2","sha1":"8481e9b564ff4e2fa90683619d91eda81e1aed13","sha256":"9f5ec1e50a5d95990fe2387d7f3d364febb0cca8ff70b58cc3f3e9b78c342a8e","sha512":"0ae6b7bddc57879c8eeea09d7d37c35a0b60315cee9f6d604b1d01929e13a006bfc06a878f2a7e28ff839d5c336da46000fa0e9a4346c8bb00d48b582d1ef0eb","ssdeep":"","tlshash":"9821bb6b276543f1766af137b10a5bcbd5211a8ab485520f392cc18e0ee237533f9792","size":1276,"data":"","first_seen":"2026-01-05T23:26:03.820576Z","last_seen":"2026-07-18T05:45:03.63046Z","times_seen":57,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"immigrationacre.com/c2/07/ec/c207ec84c2456af201cc563cadc36c46.js","fqdn":"immigrationacre.com","domain":"immigrationacre.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6395d3d6def70922fe1c4bf8b5d93cec","sha1":"9898560eeaa010c2fa7318fbb42142eec89fee01","sha256":"210f291df3a952ab95a27f4aed5d4c0e139c547ebb77f592470d7c96f8573d5e","sha512":"8836f3bf2e8e8c5dfeed4ee45e1e52202c5dc708039446a08b05d61d6286b187be4bd64eac8ac6e5f67ed909f72843ff7e648b659279ff087e650495a488bb05","ssdeep":"1536:1sgv0NC4Y5Tll1apjTHlxn0WuXvon8USxNKo4hRl+GdLALWEf7J:agvA25lIpZxn0WuXvon8pCTLs7J","tlshash":"7793e8887fb272ed439a307b362fb006f22a5d512498f4f4d586b8e52e7876da437704","size":91777,"data":"","first_seen":"2026-04-15T12:40:55.081204Z","last_seen":"2026-04-28T22:10:41.12071Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","size":85379,"data":"","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-08T07:35:47.192337Z","times_seen":26038,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"0ea125831655b58a46c56f3e0466bf2a","sha1":"cf05495109bd8fa61bac8762f2062cf43f398525","sha256":"60e808fd5c4ec9946553a3086c00ee9625cd3db2db642f3f92bb67e1d95aa88e","sha512":"bf37f0d2629fa5de2637c6858dc80b089854e34d2b36290fa83de95bbd06b3e0e06261e543652fbde303757c9bfea19cce2c364fb1192d8dd049485431587f72","ssdeep":"","tlshash":"afa002b5719e14592510c02dd51194751dddd452dd6b4449f81d34489b57511440d99e","size":84,"data":"","first_seen":"2026-04-15T12:40:55.096381Z","last_seen":"2026-04-15T12:40:55.096381Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/af/25/da/af25da8381e0bd0494ba4018c76898a2.js","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"93c1ee2a8aadd74b43857527c887bef5","sha1":"536409db2542c14ba56b08b342181fab7dcdfc7c","sha256":"ee6d2ba375d70ddc885e23d42cd9c36e0d9872a85c2b23acd48a0abd1c82fb37","sha512":"8c4f118ff850a9fe147164a8f4487128506c4824ce59137a092234a3fd14731c9d4fbdf9fff4ef55437321d6a4187de044d1d27bef72e5497dfa4c4b8a5f0b0c","ssdeep":"1536:1sgv0NC4Y5Tll1apjTHlxn0WuXvon8USxNKo4hRl+GdM9LyEf76:agvA25lIpZxn0WuXvon8pCTM976","tlshash":"5293e8887fb272ed439a307b362fb006f22a9d512498f4f4d586b4e52e7876da437704","size":91790,"data":"","first_seen":"2026-04-01T14:54:57.545551Z","last_seen":"2026-04-15T12:40:55.091294Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"cdff84c03f2bf6c918ec8d96b2197591","sha1":"43bbbcb25cace0fb74cb20da7f26db3e2c736026","sha256":"b32c4da53a489fab5ca1d894338420626205a9bcf534247fc591875cad2a0a27","sha512":"b84be7587738f4a06e0ea609921a187f4c0f574bdbe4ba31f89e087890f00a76e751147974c617ccaaf07d2937e1279c22d3ce89a9fa9c970f983895164b8493","ssdeep":"96:mozAnj6R2CC9G9moym4Jk/M+q6sQh9xwcXKzBZb1jDUCfMEDaH:TzANV9Mv4JkmNQhv6zBrvUCkCaH","tlshash":"e89139396d82507c745a74fe31625604bea0818f1509ce49f95ceb022f60b915e56edc","size":4308,"data":"","first_seen":"2026-04-15T12:40:55.097664Z","last_seen":"2026-04-15T12:40:55.097664Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","size":85379,"data":"","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-08T07:35:47.192337Z","times_seen":26038,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"adxpy.pages.dev/ads.js","fqdn":"adxpy.pages.dev","domain":"adxpy.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"28a8ee5b231d6993efeaeb288506fba6","sha1":"185e282511210752916a8d4fcc28642f02e4dc5e","sha256":"81496c62f33c7090e09cd8ea1d016980fc4432fb6ca00450ccea59b926daa7e1","sha512":"b1cf24abc589692314ada61a5a266b280ce2ad1297f5be58b94ececb90e2d718021795ca3998cb142e5937cff260d4aaeaffe5759bb8e67dff20e76bec939658","ssdeep":"","tlshash":"cb81011920a100651eb7236a7be3625dfba43053b81281a4bdccdb185fb9d1091f7fed","size":4034,"data":"","first_seen":"2025-10-25T03:17:17.993778Z","last_seen":"2026-08-05T18:54:41.26013Z","times_seen":411,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","size":85379,"data":"","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-08T07:35:47.192337Z","times_seen":26038,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"d6c61116072a3aed150693303749f3a3","sha1":"5ffb5b5427225efd2d592d1bf4bf3613027e69e8","sha256":"7f098ee0db613906e057c8814237ba1a33c352d04c1fd2b72ab5235d24082287","sha512":"f3498eb18f02a60e53e802581e42658f2d0b280610791645ebcd50374bc951aeab13f30e244c6167f3bfd1c1c38eb3aa52ec2f0aba865742abeadf817bffc8d8","ssdeep":"","tlshash":"0dc09b8c9f00185575327cdd7b261384fcd542dbb836dd555297c04265cd36bf04157c","size":145,"data":"","first_seen":"2025-12-18T23:27:07.113909Z","last_seen":"2026-08-05T18:54:41.285766Z","times_seen":307,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"eval","is_inline":false,"md5":"88a7ed7b777144ee3bf7460d8650a497","sha1":"786318684bb3c225004c4d59112e55d0e99680b5","sha256":"bd1801acec8c1f74548525d30d9dace99454291d3b91315423ba1f756272c35d","sha512":"2b35afa63ba765b311d252e70e0f576acb7c927a85cf05d52b7eae6c5ecf0492182963559bf9667d3101bda8e07118b75f9e19dd4a12680f24c2090b4d1263f1","ssdeep":"","tlshash":"462108745203807e614ca0f96a8683207fe9093ebaadd76ce1258f923b908433a02958","size":1390,"data":"","first_seen":"2026-04-15T12:40:55.099743Z","last_seen":"2026-04-15T12:40:55.099743Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/ssp/vpn/classic-push/small/js/jquery.min.js","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4a356126b9573eb7bd1e9a7494737410","sha1":"8258d046f17dd3c15a5d3984e1868b7b5d1db329","sha256":"22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5","sha512":"005c3102459dbf145df6a858629d6a6de4598fafe24cd989d86170731b0c3b3c304da470cf66bfd935f6db911b723df0857b5ed561906f7f1c5c4e63ed9430de","ssdeep":"1536:/P10iSi65U/dXXeyhzeBuG+HYE0mdkuJO1z6Oy4sh3J1A72BjmN7TwpDKba98HrZ:++414Jiz6fh6lTqya98HrZ","tlshash":"dc83d6d9b2c67062977734b851bf510bb17a98dab40c8c60f0a4d8e47eb4a8d517bf2c","size":84380,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-08-08T07:23:12.638737Z","times_seen":20085,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eventHandler","is_inline":false,"md5":"a73d26dd421e931fcd8e269f07769d64","sha1":"1a82dcc6914fcd0bde9ad067afe327f864f417ef","sha256":"dbec47c6cca1b7f4d56e8ceb1d4cfa69d78067c7480a8c04bd9b96afe74e0af9","sha512":"f02e979135efca3b320a922788bfa4647013506e61a50d0e000b576eb984bca5f399213ee9ea56ba4a33825ab8c3aaf4c212ab233d340107df27759b16a5347e","ssdeep":"","tlshash":"107000080a0ae0a8080a0a023822c00c02800082000ae0a200000a0020000088820220","size":18,"data":"","first_seen":"2025-01-05T08:04:41.550371Z","last_seen":"2026-08-05T18:54:41.287425Z","times_seen":387,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"81f04c41f8acbe1896a04adf683a5f50","sha1":"c43780b476488b7b723c6e463397263d268c0612","sha256":"d7c38975e1b16aa76895318026d67c2ca83a41ae43b9419041a898facd34720b","sha512":"f477f31fc8d52891075cc8889855386d8705476038e9d646ca0b6001cefab5bd0f438c72c4fd0d9654bf25092223c7a4dd7d25ff9419f97744adecec35990616","ssdeep":"","tlshash":"58d05b340d00021604721dec6c959fb47e367c41b3742160f9bcd91591d1947c162feb","size":258,"data":"","first_seen":"2023-03-09T05:07:28Z","last_seen":"2026-08-05T19:49:52.768532Z","times_seen":1675,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b73f73772a980d0b71c8097aeb93ba73","sha1":"dbd8ebdebe2e0f452407bb38a76deec742b80027","sha256":"496ed8b94f856087f1a4384dc7fa33b769c1c9439932825b506455b5bf4930b7","sha512":"a00b2f097b0624952e4c5ca29ba1c6fddd0187080cadb301185692695abe516a7d3c38d3a4d2d8f1357c0f6ffd80fb61519dbe59f028ee25fba80f30d19720c9","ssdeep":"","tlshash":"b9019eff24004c7448de19eeb2a8778ae8b6005b7d19142424194c7576a4b7603d2fb6","size":668,"data":"","first_seen":"2023-03-09T05:07:28Z","last_seen":"2026-08-05T19:49:52.774504Z","times_seen":1647,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"3043924babea44e8e94b0aa19f11d89d","sha1":"c6ccf78fba768952994a37ad33a8309fe9454b5f","sha256":"5f96af838dd14f1b76712ba6f84df12026e8c0431a381c5e062361d390970d36","sha512":"9c78e351a02bfcc7181420b6ec071906e24734f3421c5d1b8e4a92a9973fd5125242fb6b22d6cfa53dea13a2aa99685055b52bcc8cc4a2fe88c8e0742621b6c5","ssdeep":"","tlshash":"7dd02bb1d12c0332029da14a7423c394713434daf3423080a01f87f950c4f96d41fcbd","size":273,"data":"","first_seen":"2023-03-09T05:07:28Z","last_seen":"2026-08-05T19:49:52.775031Z","times_seen":1696,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"adxpy.pages.dev/magic.js","fqdn":"adxpy.pages.dev","domain":"adxpy.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9bcbb02a6bf94ae8762ddcda5d1c80d3","sha1":"fade830681bb5b7b138db5482e7a495c1c9b296a","sha256":"b26277e44f2fe29283a55a632166f8a45dd1407a0970c13e08287406f94a0772","sha512":"54914b0f4d7625f4e40e13b11bb2bfd47c87dc6a14714c427c48c75e955980826d6605abbac7b3ca6c043356f1b91618b6f16abaf6be339be38d8ffa825e71e5","ssdeep":"","tlshash":"c101fe6e229200a84d7a509803a3fa0cfda832577160c0e1bacedb602f35f20419e4d8","size":671,"data":"","first_seen":"2025-12-08T23:25:47.209165Z","last_seen":"2026-08-05T18:54:41.256186Z","times_seen":391,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"immigrationacre.com/52f212bca95373aed7ead32398143db7/invoke.js","fqdn":"immigrationacre.com","domain":"immigrationacre.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c87c7538e16a4c325e5eb9147c623b92","sha1":"71a28065d22a34b2509f1cfc5027f3d6a82e63fa","sha256":"cbe6eba409bf820e71da14524656e2898bf8b02b7f90ad492baa57d7ae007808","sha512":"38f4b2bfa4a46eff6830c780ba46a303409a10772119896c7abcc2d9fef26d5c0ac26b71996c18243420904aff9781c1de8221622d2278e093899a185255fdcf","ssdeep":"768:xILsjP3R5MaFvQ00hE9ZnANn7aw++nxKDpOI6sxt4U2CNFQb+1UIbGR:x/MaFvQhOsKpN6+2hb+rw","tlshash":"1033c88c7fe1f0e416567c73323f60abf11a1c12958cd48cd906e4ae6ae8795e937b18","size":51227,"data":"","first_seen":"2026-04-14T16:50:39.799687Z","last_seen":"2026-04-17T04:00:19.714482Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"eval","is_inline":false,"md5":"c1f014c15f63ef9d875a552faa31934d","sha1":"6c486e23928d2a5327df49d59cafc8d4f29e8ab2","sha256":"39aeb8a6dce7e3882b11b5988fe2679c99658120b15e219c50fa5137b3af81b1","sha512":"7bd8ee327f90df9ab644bb48525553fd91cf4e7ac4f6153520f0ecf8f72b7d842c54e5d0bd7d2ad3daf150fbc92f29cee4681d57c82ff27d0622c68915bf8d03","ssdeep":"","tlshash":"c721e97c866e0bcd77feb0db1c19365add836436e4e1c84351ed418195025a00bfe0d3","size":1442,"data":"","first_seen":"2026-04-15T12:40:55.10312Z","last_seen":"2026-04-15T12:40:55.10312Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"349edacf65d0ff272bf6fd11233c1ead","sha1":"34b1fdbc95156d9d6b499a739a7ce1f8b57926b4","sha256":"82eb474cb30703539541a5d27d13890cc5d5af5633f642fb4d24666b4ff98848","sha512":"c474a12003f50e2206febb6e7d8fd2ca37e5dfee3b949c9fdbf5288207c1932bcfb5b78ed46706ea8675c34ed493dca4c05e3886a5685a6826f82307630581a3","ssdeep":"","tlshash":"2ed0c23a1d110b7104c619ea38d8a6987a3d384577293450e47ed900a0a4a898063ff7","size":276,"data":"","first_seen":"2023-03-09T05:07:28Z","last_seen":"2026-08-05T19:49:52.775501Z","times_seen":1636,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fb73c9c1f5ecb08f9a0205a14e2841e0","sha1":"dd5807b9d4c32d9dff08f8f14c726804f49bfd5e","sha256":"63578fe671a2d9eeff56bb7df57695eb7728b49bfb50db91bf2cf74430df93c9","sha512":"b18875be5353ae7972e16617a0eadc0adbe806c68cd098cd54f462b4308c7dff48e7ce73da68968f66d9dcc00ac1cc891e8d1b1312298a75990eeecdbc8187ca","ssdeep":"","tlshash":"7fc08cf68004b21820e7caf02028c0c0a324ec20300a383166e0081082ac50d0cb2bb8","size":146,"data":"","first_seen":"2025-12-16T03:50:13.724775Z","last_seen":"2026-08-05T18:54:41.303071Z","times_seen":326,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8d6dfb165351ae4b95d970f3453ebd9","sha1":"815658327046c506c393f8ff48056093b7fe9546","sha256":"3e299e0b6280333c35e807c60f39634ebff662600df9436c8a95e7af0773dd18","sha512":"05689006d49e0c2cbad00747574c79597c747c924ad6962ef5afd548078647c264d3865eb713a1915fd352ef5c6eb600985461e4456830fce3b447be6ffdbd28","ssdeep":"96:LPoz03BCHHhcfxs3Djx4439qHk/wTzQzLG/cwENK+3vfBMru1jDSV3VCfMEDaH:LQzCIhx3DaKgHkEoG/cXKm9vSV3VCkCM","tlshash":"2a913b7c9dad08a874bb30bf146a74597c52a117b450c983f98cd7809b31bb00ebacc1","size":4390,"data":"","first_seen":"2026-04-15T12:40:55.105568Z","last_seen":"2026-04-15T12:40:55.105568Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"eval","is_inline":false,"md5":"41ea1cdd86038a6890a165308fa7ce02","sha1":"0211333215fa1158a979f8416db8fe7f8c0d80fc","sha256":"ead56a31bbc6a16e53e041699cc03e6f0b6bce3879cb357255a7262a2289a136","sha512":"4ea8be73f713f374b4fe455bb046793224edd553c6d9eba67edb058f897fef4816bd21acbdde52a734ada5fa76a62428c960354706905457613459ea3cb5ecd4","ssdeep":"","tlshash":"ae31087ea42d3c92f57671b7004e28287c6346937180c2d36514cbd0612fa650277ec6","size":1716,"data":"","first_seen":"2026-04-15T12:40:55.107141Z","last_seen":"2026-04-15T12:40:55.107141Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtevor.com/hg/pages-dev.js","fqdn":"mtevor.com","domain":"mtevor.com","tld":"com"},"ip":{"addr":"104.21.21.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"63f71502fe125358818a0825aae4ee16","sha1":"98934593ae75876db5a51fbb4a0d6f990576a2c9","sha256":"5dedd670c8604a3b077f14aac976a0b91441afe370ecc449c9e3df2cf077027b","sha512":"d426126273d42b38f24bd9b8d1780346cc1b6cee83468b887e0eaeecaff19e4a89a0636620ab41efc977e6c2b559e88e55b670f3dfd5b7c7205f848a55e2ebdc","ssdeep":"192:c4Mpsto0LV8YteZbDVj/poiPqpyj4ZYzwIxpsQkhHC:/++j8YteZfJ/ptPqcj46zNxpsQ8C","tlshash":"0ee1d6a9bc8f89390bf2f758d6358519fd3cc0221602505af0c8525b8a69f1e471ffd8","size":7180,"data":"","first_seen":"2026-03-10T23:35:48.093011Z","last_seen":"2026-08-05T18:54:41.273315Z","times_seen":134,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"immigrationacre.com/c6/4a/a1/c64aa11db612c16c65959b87a44dac81.js","fqdn":"immigrationacre.com","domain":"immigrationacre.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c07bffdca12ca6fb0b61c800b1b64fd","sha1":"ed5fcaab9955910c8a69ba89fd2358a7043a9c2f","sha256":"8c71ef206a4139e0886dd4a39d5031ad22620ece057e3d7507df3696565edef2","sha512":"d36c2637e35cacbde8ec188c2a3588b6dd456268bb2d7b06a0cf0582243a3b0f865b615951b4c0a1fc9bb0afc72dcd014b03ff3637e1b4948ec8636889217074","ssdeep":"1536:751PqZWem5Kvg/+UriOXwaHe4J+LLFk8Xmj8sV:Cpv4WUR+1HFw9V","tlshash":"dd93e78c3fc1f0a513a5203b222f714ef0994d95546ce468f783f56a2f7ca4ae536b98","size":93658,"data":"","first_seen":"2026-03-28T05:54:55.765725Z","last_seen":"2026-04-17T03:55:50.484068Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"immigrationacre.com/6dd5e3d7ac37d33b5abc87810f6ac7f3/invoke.js","fqdn":"immigrationacre.com","domain":"immigrationacre.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"717025c468ab704cdde89f0f7d44d6e5","sha1":"c4879a45c6a424d28d25a87c01b151aa711bae57","sha256":"70b9b48608716d4c5ed559a58842c355a48da0858b42a0e87eae5ebd2622b075","sha512":"d36256330cd3a2c14a55fbc0a056266c148edbe7281cd83d749fd5303dd5e2393268c08536ccb840c7e6ef5306f95bf6576809c1e38f4dcd872ae79ff55d9161","ssdeep":"768:xIL7jP3R5MaFvQ00hE9ZnANn7aw++nxKDpOI6sxt4F2CNFQb+TLIbbR:xcMaFvQhOsKpN6L2hbk4F","tlshash":"9633d88c7fe1f0e416567c73323f60abf11a1c12958cd48cd906e4ae6ae8795e937b18","size":51290,"data":"","first_seen":"2026-04-15T12:40:55.064477Z","last_seen":"2026-04-27T10:28:01.208713Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/1b/50/e5/1b50e57a5911fd0a5b46962ab48ca22b.js","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2f7f534aa475f2ab416f5768f5eb1abf","sha1":"0e264d3826ec4cea33eb1d05bc113200a9ca55b1","sha256":"18821fa5e86c1240947fc976e78c43d849789cda4360578383adcfbd873d133a","sha512":"c24f6cff97cb6e0cf363714e9073f5f0533cfd228d16665aa6be8fc2527f88f5f3fa156e6dff75bcd4f581a1a3e8f7e0e7242ce4eb3d98d5af950a497b98ee7d","ssdeep":"96:JPczm1siDwcWu0HAGMUJhSENesmRmTj8pdkZ:Bc0DwBLAGtvArmjZ","tlshash":"c2b1b79c3f40b0a017a2a0776f6f2429f1396c10ab6be894d527a1dc3f29d29c2b2755","size":5119,"data":"","first_seen":"2026-03-12T08:34:48.0486Z","last_seen":"2026-04-30T07:10:40.662541Z","times_seen":2445,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"a529894d3286d527219ac471e1cd5a47","sha1":"4ac04d024d5e097b20a2ec99493a5b40a07def7f","sha256":"de7f25c63f8aee85b80dc11ecb1878e4487e52e537205d76023746f9786aea27","sha512":"c0ac07fabc2441e29f9db33a992c001edce654c4d7341f71a75ea85824d38231a304d8463bca7c03cfaf9341c0e3104e9d73c634267a94ba30ce855ef9a6b9a2","ssdeep":"","tlshash":"e0c08ca4eb04087071ac3ebd330aa3e2e8e876123030088296948090e2b92330420c80","size":145,"data":"","first_seen":"2025-12-16T03:50:13.718611Z","last_seen":"2026-08-05T18:54:41.30032Z","times_seen":304,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"558c3779ce5aac4481c86687cd8f15c3","sha1":"474fa56198ee722ebad4041dce2dcfc716fd923d","sha256":"7b2515a2c400be25e6daa78e4c6f35f43d67d244acb76818f1599f815b1995a8","sha512":"280f5da312b232e8638235a1b6094abc4abf38d94b8c327c668a848d830d0fe94d2b2830fb53be53076a724286b3c5b3f290f0e240267a71a57bddf00c8cd6e2","ssdeep":"","tlshash":"e1019c3d326407bb22ee0e3b23779e5476732844b40210b05e2d9da86410df112afabe","size":797,"data":"","first_seen":"2023-10-28T10:41:14Z","last_seen":"2026-08-05T18:54:41.293863Z","times_seen":418,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"eval","is_inline":false,"md5":"0a2c5b0a0df6d76a6a1be791e0045a4c","sha1":"ba7df7e1845ec8fb04fbec4b943deafd39a76738","sha256":"c1c0f361e94650ac7fc954c52d80682791328caf90410fcf6dca25c9e6bb524e","sha512":"37957e4bbda7b40de74a629d55780e5824df26cd6d5f10d13198a7787d54a2aa5e178de766930e5952c6f62f1326080f2475c533b95b9d18b189a8954836e842","ssdeep":"","tlshash":"b231187bb016307694afbcb130822b15beb155ca02090ee4d868b7015e689d64317e9d","size":1664,"data":"","first_seen":"2026-04-15T12:40:55.109625Z","last_seen":"2026-04-15T12:40:55.109625Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sourshaped.com/impr.gif?sid=H4sIAAAAAAAC_1STPYwcNRvHPZe8bxMJxGeJtkhBELtnjz0fJqKJ-CjIByJBKage2-OLudmZyXhmd7MNF4JCQXMUSDRIc8_e5QoiBA012qMCCSnbbZGjQEKiRkqN9rLSgYvnw3_Lev7Wz_f32mMywBaW718ppy7PYTMa0N6rN11hyrHvXb3RY3RAL_ZuuiIWF3uTVahHbzAuBvRC791Mb5ebIWWUMsp677g6s-Vk80RFVz2UbCDpQIQDFgmc1P_tfRughwDN6Jg8j84snv3DfoROz7EYfv9W5rebsnr97WGbQ1PWODKHHxbbRTkucHha2jpAWxyuT2PpF4R8vYFlcbh2gOVof-UAlVuQjZcfoyoO12OiGh08nVTlmBWozDkcj-aY5UfoYI66vIfOPCKI2uDVa1gMH1wt6zHcearCSl2Qs0_-RjdekLOPX8Ri-N2l3E1618u8bVxZeJzYDt1kjm5rjlV7hM10A934CHXzKTrzG9l8chmL4f41n5fozPJ8aKTR2pg-SMX7gidRP6Uc-kpaxZRWjAE_eSJn5wh-A1sfYOsCbG2AbRXg0Cx7gqZCM-CxlUYnVIAQJlNUpiGlIHWCrb6Lzuyirnewqndw2325IMFLV9DfWv6ogIIAsCoVkAohEmkizniaSEW5ARPHSSQpiJBFUsRxGhsJnCkZh8rKhKVRqqMoS2KdGMEEhRg0GK5FyGKgnMeRkCKNwzDSicx4pqmhNhFRbKlWkspQ6AyEpjJMdZImyoZUspCllBqwaQxRpISORaSNBhFTGemQhUaiNwH6huDIdAcm96HvHpjct4qtc7jOvJuVzdYeHJTNVlYQhHoXa9Ptu-q2v4e6OTObWm9m5SqAaroZKNPNnGkI1reX5ymTRrIw7YtU2n6SWdaXgsl-kobKGpUlXOi96pg8t4Ij-Oqbb3E7W_ZiY6KMmwQ0TwznKgKl0yRl1MagE8vRuw6d30DwAU7dgrxnL2DlFuSV-3-hgiP0-RFqdwah_R_CeMYpRbg1CyOK0-KhdYUZOZ0NdDlEU3ZYNWexuRPs5cfkhdkHNy79dELq5SufYKZ_JeuFuu6wqjv82P1McCu_-8O1qnFDN4UVutcbaLL_I7hH2S-o3YI88-fo5A-99sU51NUO-ur0Jl8SVBXB3BHMs9N9UB36f_XqtN7zn-FWHaDKg5nKa7Kv8jrfRe-WPcuzUFOaJjHjqc0YF0bbKBXSnACUYeMX7vfP3_wnAAD__18HG5O8BAAA","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.721Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /impr.gif?sid=H4sIAAAAAAAC_1STPYwcNRvHPZe8bxMJxGeJtkhBELtnjz0fJqKJ-CjIByJBKage2-OLudmZyXhmd7MNF4JCQXMUSDRIc8_e5QoiBA012qMCCSnbbZGjQEKiRkqN9rLSgYvnw3_Lev7Wz_f32mMywBaW718ppy7PYTMa0N6rN11hyrHvXb3RY3RAL_ZuuiIWF3uTVahHbzAuBvRC791Mb5ebIWWUMsp677g6s-Vk80RFVz2UbCDpQIQDFgmc1P_tfRughwDN6Jg8j84snv3DfoROz7EYfv9W5rebsnr97WGbQ1PWODKHHxbbRTkucHha2jpAWxyuT2PpF4R8vYFlcbh2gOVof-UAlVuQjZcfoyoO12OiGh08nVTlmBWozDkcj-aY5UfoYI66vIfOPCKI2uDVa1gMH1wt6zHcearCSl2Qs0_-RjdekLOPX8Ri-N2l3E1618u8bVxZeJzYDt1kjm5rjlV7hM10A934CHXzKTrzG9l8chmL4f41n5fozPJ8aKTR2pg-SMX7gidRP6Uc-kpaxZRWjAE_eSJn5wh-A1sfYOsCbG2AbRXg0Cx7gqZCM-CxlUYnVIAQJlNUpiGlIHWCrb6Lzuyirnewqndw2325IMFLV9DfWv6ogIIAsCoVkAohEmkizniaSEW5ARPHSSQpiJBFUsRxGhsJnCkZh8rKhKVRqqMoS2KdGMEEhRg0GK5FyGKgnMeRkCKNwzDSicx4pqmhNhFRbKlWkspQ6AyEpjJMdZImyoZUspCllBqwaQxRpISORaSNBhFTGemQhUaiNwH6huDIdAcm96HvHpjct4qtc7jOvJuVzdYeHJTNVlYQhHoXa9Ptu-q2v4e6OTObWm9m5SqAaroZKNPNnGkI1reX5ymTRrIw7YtU2n6SWdaXgsl-kobKGpUlXOi96pg8t4Ij-Oqbb3E7W_ZiY6KMmwQ0TwznKgKl0yRl1MagE8vRuw6d30DwAU7dgrxnL2DlFuSV-3-hgiP0-RFqdwah_R_CeMYpRbg1CyOK0-KhdYUZOZ0NdDlEU3ZYNWexuRPs5cfkhdkHNy79dELq5SufYKZ_JeuFuu6wqjv82P1McCu_-8O1qnFDN4UVutcbaLL_I7hH2S-o3YI88-fo5A-99sU51NUO-ur0Jl8SVBXB3BHMs9N9UB36f_XqtN7zn-FWHaDKg5nKa7Kv8jrfRe-WPcuzUFOaJjHjqc0YF0bbKBXSnACUYeMX7vfP3_wnAAD__18HG5O8BAAA HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyNjU4MjQ0MywiayI6IjZkZDVlM2Q3YWMzN2QzM2I1YWJjODc4MTBmNmFjN2YzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo0OTQxMzUzLCJwaWQiOjIwMDA2MTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJtZWVtNXlqOGUiLCJjcGtzIjp7IjI4IjoiZDA4OWVhMDQ5ZjBmN2IxZWFjZmEyYjViYjk5ZDNiZGMiLCIyOSI6ImFmMjVkYTgzODFlMGJkMDQ5NGJhNDAxOGM3Njg5OGEyIn0sInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJjdCI6eyJpZCI6MzE0MzI0NCwibiI6Ik9zbG8ifSwicmciOnsiaWQiOjE4NDQsIm4iOiJPc2xvIENvdW50eSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsIml3ZiI6dHJ1ZSwidXAiOnRydWUsInIiOiJodHRwczovL3JvYmxveHdhdGVyc3BsYXNoLnBhZ2VzLmRldi8iLCJ0eiI6MiwiaWR1YyI6MCwiYXIiOltdfX0.MUU_bnpmvZY7xaW4qUE31hcoeEbwUQkxU36aM_PI_5c; pdhtkv=true; uncs=1; pdhtkv5=true; uncs5=1; u_pl26582443=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 9\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: d1e93cdbd66634873994352e0bc78a4d\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":103,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.25.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.859Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 08:38:37 GMT","end":"Mon, 15 Jun 2026 08:38:36 GMT"},"fingerprint":{"sha1":"F8:24:5E:5A:B0:FB:57:E0:D6:E9:33:BD:54:27:DC:BF:50:74:4A:59","sha256":"A4:18:08:9F:87:3F:1D:A2:3B:7A:25:AA:E0:FF:C8:CB:B1:74:9C:8B:FF:A2:C5:D6:74:BB:B0:A7:97:7E:5B:02"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 14 Apr 2026 02:23:48 GMT\r\nexpires: Wed, 14 Apr 2027 02:23:48 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nage: 123401\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43136,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-08T08:24:37.940663Z","times_seen":257068,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":68,"dns":0,"connect":7,"send":0,"wait":8,"receive":9,"ssl":58},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/ssp/vpn/classic-push/small/js/jquery.min.js","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/ssp/vpn/classic-push/small/js/jquery.min.js HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 15 Apr 2026 12:40:31 GMT\r\ncontent-type: application/javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h8UDZxSExigPfEAINVtcUMo6ln3OVUNwAqqqLlafcnK7oXnKRuGBXLxQ6JRQ0Q5AbPnzdARdgCVHEL6LTBIRUG4kB0naDuVKNVU9HIhFRZtyqwYhh%2BCnW3M8EN%2BPpSlZ8U03KFIXdUY%3D\"}]}\r\nlast-modified: Fri, 19 Jan 2024 14:19:42 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\ncontent-encoding: br\r\nage: 1361760\r\ncf-cache-status: HIT\r\netag: W/\"65aa84fe-1499c\"\r\ncf-ray: 9ecb04eb3ded783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":84380,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32025)","md5":"4a356126b9573eb7bd1e9a7494737410","sha1":"8258d046f17dd3c15a5d3984e1868b7b5d1db329","sha256":"22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5","sha512":"005c3102459dbf145df6a858629d6a6de4598fafe24cd989d86170731b0c3b3c304da470cf66bfd935f6db911b723df0857b5ed561906f7f1c5c4e63ed9430de","ssdeep":"1536:/P10iSi65U/dXXeyhzeBuG+HYE0mdkuJO1z6Oy4sh3J1A72BjmN7TwpDKba98HrZ:++414Jiz6fh6lTqya98HrZ","tlshash":"dc83d6d9b2c67062977734b851bf510bb17a98dab40c8c60f0a4d8e47eb4a8d517bf2c","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-08-08T07:23:12.638737Z","times_seen":20085,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/ssp/vpn/classic-push/small/js/script.js","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.278Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/ssp/vpn/classic-push/small/js/script.js HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 15 Apr 2026 12:40:31 GMT\r\ncontent-type: application/javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qm3VHkTK1LBpM5YTIyuPY7OMTCnBZGcX00jHZKfEWl2p2udanBCwf8Y9rPf98eq1gFIb%2Bc8980rKkOGA1Qwub9VE%2Bw1h2F%2FS%2FSGu7pbTa9QMMLSRGQho4YCuBmLlXVm1qtvZVVr6Klc%3D\"}]}\r\nlast-modified: Fri, 19 Jan 2024 14:19:42 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"65aa84fe-3c2\"\r\ncf-ray: 9ecb04eb7918b51b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":962,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"0013fbb3bd9e7300fa1bc9f62501dcf0","sha1":"447e4a8994979e2e158b9beff79b94e7d1b29508","sha256":"4cf18df81115ddab6967dc82096077ee024223dac3c6ffc9b810bffb7780a20e","sha512":"288a5e82fdbfdadf11f5a15ed40b54b67dd43fd83f0666abf85ebc0f14ef3b6e5e9104c3491fdb85b40e5556b252d933ee8cbe6e381e96e01170e76c60003dc6","ssdeep":"","tlshash":"e7117d37156882f06257f027a15729d6ee32029ee81a5707721c06cd0ec47b913fa6e7","first_seen":"2023-06-25T06:36:24Z","last_seen":"2026-08-08T04:08:50.861041Z","times_seen":3556,"resource_available":false,"data":null}},"time_used":459,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":459,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.25.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 08:38:37 GMT","end":"Mon, 15 Jun 2026 08:38:36 GMT"},"fingerprint":{"sha1":"F8:24:5E:5A:B0:FB:57:E0:D6:E9:33:BD:54:27:DC:BF:50:74:4A:59","sha256":"A4:18:08:9F:87:3F:1D:A2:3B:7A:25:AA:E0:FF:C8:CB:B1:74:9C:8B:FF:A2:C5:D6:74:BB:B0:A7:97:7E:5B:02"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 14 Apr 2026 02:23:48 GMT\r\nexpires: Wed, 14 Apr 2027 02:23:48 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nage: 123404\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43136,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-08T08:24:37.940663Z","times_seen":257068,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":8,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mtevor.com/hg/pages-dev.js","fqdn":"mtevor.com","domain":"mtevor.com","tld":"com"},"ip":{"addr":"104.21.21.167","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.341Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtevor.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 27 Mar 2026 16:10:55 GMT","end":"Thu, 25 Jun 2026 17:08:44 GMT"},"fingerprint":{"sha1":"1D:90:33:9C:3D:4D:50:02:77:2C:32:67:1E:87:33:CC:BD:89:04:6D","sha256":"72:55:21:53:6A:A2:E9:F9:08:9D:13:A1:4F:FC:E2:CD:E9:5C:53:05:B8:B0:36:72:24:AB:FD:DA:7A:F9:7C:C4"}}},"request":{"raw":"GET /hg/pages-dev.js HTTP/1.1\r\nHost: mtevor.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 14 Apr 2026 16:54:25 GMT\r\nage: 71160\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1LOye2UQMc9C5dSPcuIwGd9fYi0BJAAd%2BgeRc1%2FO%2FUBTBObk5WiwqYRUhAVxipllSuyjZHDFnSuY6kwyRwX8quFkUMi4Hevry50ySzlnv28raXblRCuLmvpi0LrF\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9ecb04ccfb900afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7180,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"63f71502fe125358818a0825aae4ee16","sha1":"98934593ae75876db5a51fbb4a0d6f990576a2c9","sha256":"5dedd670c8604a3b077f14aac976a0b91441afe370ecc449c9e3df2cf077027b","sha512":"d426126273d42b38f24bd9b8d1780346cc1b6cee83468b887e0eaeecaff19e4a89a0636620ab41efc977e6c2b559e88e55b670f3dfd5b7c7205f848a55e2ebdc","ssdeep":"192:c4Mpsto0LV8YteZbDVj/poiPqpyj4ZYzwIxpsQkhHC:/++j8YteZfJ/ptPqcj46zNxpsQ8C","tlshash":"0ee1d6a9bc8f89390bf2f758d6358519fd3cc0221602505af0c8525b8a69f1e471ffd8","first_seen":"2026-03-10T23:35:48.093011Z","last_seen":"2026-08-05T18:54:41.273315Z","times_seen":134,"resource_available":true,"data":null}},"time_used":113,"timings":{"blocked":49,"dns":27,"connect":1,"send":0,"wait":13,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/favicon-96x96.png","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.646Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"robloxwatersplash.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Apr 2026 08:43:13 GMT","end":"Tue, 14 Jul 2026 09:41:01 GMT"},"fingerprint":{"sha1":"6F:C9:03:56:21:27:05:BF:C0:6F:19:75:6A:0D:95:4B:AE:E3:5F:A1","sha256":"8E:AA:DC:34:9A:45:35:5B:98:DF:2B:D6:78:EE:95:A5:07:38:AB:51:E6:89:3B:FA:74:BF:93:F8:56:BA:6E:38"}}},"request":{"raw":"GET /favicon-96x96.png HTTP/1.1\r\nHost: robloxwatersplash.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:26 GMT\r\ncontent-type: image/png\r\ncontent-length: 3415\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\netag: \"207249c5b01c104202965011f95037dc\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Txw4hzFXBelL5m%2FVqxlVTA7aThZWAGj2oULIZ%2F80kaMXKr4PJERAdUNBl75lblSScbDn8JNPLG3b7GNpjzRTYXkMqYfQGcQQ%2BP4aAoQ2MpnAw5qzNA9%2B82KX4wwmbdufqMEOyKVT5Y%2BdDyMmGQU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-ray: 9ecb04ce8858c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3415,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"18432ea15c0c7b7ef50ee1b42b9b29e3","sha1":"2b656e7a76d7a8d11ff020bd8bac15c6780c39ec","sha256":"27a2d2727b2c93679c945f8107ce5bd270d8dfc426c7abca1e975e46ac0d78e9","sha512":"0d9dfdd5af753545acac4819105170d4358fa8a619ee99f9754eaec45b48cbc8875409744d35d10676843b635bf1b065c0129e1ffdac68d921a39bd7e4632f87","ssdeep":"","tlshash":"0d615be0818b9c3abc969201820ac603fb35a0ce0e5a1a7e54f717c87f133bbb52c157","first_seen":"2025-10-29T04:02:15.906591Z","last_seen":"2026-08-05T18:54:41.246003Z","times_seen":406,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.25.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 08:38:37 GMT","end":"Mon, 15 Jun 2026 08:38:36 GMT"},"fingerprint":{"sha1":"F8:24:5E:5A:B0:FB:57:E0:D6:E9:33:BD:54:27:DC:BF:50:74:4A:59","sha256":"A4:18:08:9F:87:3F:1D:A2:3B:7A:25:AA:E0:FF:C8:CB:B1:74:9C:8B:FF:A2:C5:D6:74:BB:B0:A7:97:7E:5B:02"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 14 Apr 2026 02:23:48 GMT\r\nexpires: Wed, 14 Apr 2027 02:23:48 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nage: 123401\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43136,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-08T08:24:37.940663Z","times_seen":257068,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":115,"dns":1,"connect":20,"send":0,"wait":8,"receive":6,"ssl":90},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"immigrationacre.com/52f212bca95373aed7ead32398143db7/invoke.js","fqdn":"immigrationacre.com","domain":"immigrationacre.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.015Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"immigrationacre.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 22:44:59 GMT","end":"Sat, 20 Jun 2026 22:44:58 GMT"},"fingerprint":{"sha1":"C5:C0:F1:09:DF:66:79:21:CE:6B:25:C3:DC:5A:3B:4E:6C:24:00:FD","sha256":"14:5E:A4:DE:46:F2:FF:8F:7D:14:D8:7C:E6:33:BC:41:57:AD:BF:24:AC:C4:3C:0F:A7:EE:34:BE:D3:48:56:5B"}}},"request":{"raw":"GET /52f212bca95373aed7ead32398143db7/invoke.js HTTP/1.1\r\nHost: immigrationacre.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:32 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 20379\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 6\r\nHost: immigrationacre.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: bdb49cd1925740239b7ba9943c9cb41c\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51227,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (51227), with no line terminators","md5":"c87c7538e16a4c325e5eb9147c623b92","sha1":"71a28065d22a34b2509f1cfc5027f3d6a82e63fa","sha256":"cbe6eba409bf820e71da14524656e2898bf8b02b7f90ad492baa57d7ae007808","sha512":"38f4b2bfa4a46eff6830c780ba46a303409a10772119896c7abcc2d9fef26d5c0ac26b71996c18243420904aff9781c1de8221622d2278e093899a185255fdcf","ssdeep":"768:xILsjP3R5MaFvQ00hE9ZnANn7aw++nxKDpOI6sxt4U2CNFQb+1UIbGR:x/MaFvQhOsKpN6+2hb+rw","tlshash":"1033c88c7fe1f0e416567c73323f60abf11a1c12958cd48cd906e4ae6ae8795e937b18","first_seen":"2026-04-14T16:50:39.799687Z","last_seen":"2026-04-17T04:00:19.714482Z","times_seen":7,"resource_available":true,"data":null}},"time_used":103,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":102,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/favicon.svg","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.648Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"robloxwatersplash.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Apr 2026 08:43:13 GMT","end":"Tue, 14 Jul 2026 09:41:01 GMT"},"fingerprint":{"sha1":"6F:C9:03:56:21:27:05:BF:C0:6F:19:75:6A:0D:95:4B:AE:E3:5F:A1","sha256":"8E:AA:DC:34:9A:45:35:5B:98:DF:2B:D6:78:EE:95:A5:07:38:AB:51:E6:89:3B:FA:74:BF:93:F8:56:BA:6E:38"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: robloxwatersplash.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:26 GMT\r\ncontent-type: image/svg+xml\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=6,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k2vFknRNN7egHvHfn5so5IgX3DRmCqKWwMCXJ7KqzK863P4cce0jC7ZA7NhydmgdjNAgYIGVhSpxh5iyyaS%2BJnloZsdY4RlMWfBwh5D3%2BisOxww4rQq6gnoDFmJ39a1PXMut%2BRJWTWPTwph2nPY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"c32bf1839a02c28417636e2fbfe32b83\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ecb04ce885fc272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1039,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3e5eb335b0265fa668f3b7a8bb83dd62","sha1":"3a7497bfe01d5f0dd7f93b25400ff8dd4410b033","sha256":"4183fc50d0ecbe4f28d32f897b93b712a6e90df092b0b5d921b51ce9da6931ee","sha512":"b3fb01f8dce34190449c733e25a5818ce09b3957fbe5088be6877f89d0f32ed35e793a245ae2d736cd17031d8183183d0e4188b2d93f7faaa286b5b88f8179e6","ssdeep":"","tlshash":"bf11ef5fc341983af23ed341eab4da49863568cb91f523d8fed06d29b43a5d61409788","first_seen":"2025-05-31T11:23:43.744066Z","last_seen":"2026-08-05T18:54:41.273958Z","times_seen":494,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"adxpy.pages.dev/magic.js","fqdn":"adxpy.pages.dev","domain":"adxpy.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"adxpy.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 05 Apr 2026 00:44:54 GMT","end":"Sat, 04 Jul 2026 01:43:34 GMT"},"fingerprint":{"sha1":"B9:0E:27:18:36:32:2C:B8:F2:E5:2F:50:96:88:4F:CF:54:4C:10:3C","sha256":"ED:9F:40:13:F5:DC:3F:FE:75:A2:AF:61:F4:2D:D7:17:14:E2:C8:D4:C5:19:DB:9E:88:D1:73:59:BF:13:F7:D1"}}},"request":{"raw":"GET /magic.js HTTP/1.1\r\nHost: adxpy.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:26 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=3,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KJ7kTh4mf29KDLKheSXnSFtV3Lhr8B8Qkyt69jvlxxd7oxVPeSn1ArE4MSMib8FLdsKHAVW2%2B5WeKgCtxX4KLAeJCEg6jqs7sNdCpWUQyyPaGhZFDhzDFsUDgNYr3LarLJY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"c49d59185af245830cb91e4818c56238\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ecb04d08e6a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":671,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"9bcbb02a6bf94ae8762ddcda5d1c80d3","sha1":"fade830681bb5b7b138db5482e7a495c1c9b296a","sha256":"b26277e44f2fe29283a55a632166f8a45dd1407a0970c13e08287406f94a0772","sha512":"54914b0f4d7625f4e40e13b11bb2bfd47c87dc6a14714c427c48c75e955980826d6605abbac7b3ca6c043356f1b91618b6f16abaf6be339be38d8ffa825e71e5","ssdeep":"","tlshash":"c101fe6e229200a84d7a509803a3fa0cfda832577160c0e1bacedb602f35f20419e4d8","first_seen":"2025-12-08T23:25:47.209165Z","last_seen":"2026-08-05T18:54:41.256186Z","times_seen":391,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:27.611Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"preferencenail.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 01:24:35 GMT","end":"Thu, 28 May 2026 01:24:34 GMT"},"fingerprint":{"sha1":"66:45:2B:BB:A2:6D:D3:A2:B6:16:36:65:94:BA:4A:C6:5E:05:66:09","sha256":"A4:2E:A7:56:DB:44:FF:55:9A:FA:4D:EC:2A:78:CB:C5:02:CD:CF:B2:FB:A7:A7:75:77:EC:01:DB:19:71:C0:77"}}},"request":{"raw":"GET /sfp.js HTTP/1.1\r\nHost: preferencenail.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:27 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 32181\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nP3P: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\nAccess-Control-Allow-Origin: *\r\nVary: Accept-Encoding\r\nHost: preferencenail.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 14c6d8c9cdb3af5c18c7a8fbd1840966\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":85379,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators","md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-08T07:35:47.192337Z","times_seen":26038,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":64,"dns":0,"connect":20,"send":0,"wait":90,"receive":21,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"adxpy.pages.dev/arrow-up.gif","fqdn":"adxpy.pages.dev","domain":"adxpy.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"adxpy.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 05 Apr 2026 00:44:54 GMT","end":"Sat, 04 Jul 2026 01:43:34 GMT"},"fingerprint":{"sha1":"B9:0E:27:18:36:32:2C:B8:F2:E5:2F:50:96:88:4F:CF:54:4C:10:3C","sha256":"ED:9F:40:13:F5:DC:3F:FE:75:A2:AF:61:F4:2D:D7:17:14:E2:C8:D4:C5:19:DB:9E:88:D1:73:59:BF:13:F7:D1"}}},"request":{"raw":"GET /arrow-up.gif HTTP/1.1\r\nHost: adxpy.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:26 GMT\r\ncontent-type: image/gif\r\ncontent-length: 4491\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\netag: \"abc38753b71c3201854a4e8b3ffdce52\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=epKGJJ%2BViG2libjy%2B5tinZY94f2MG1ydtKbul0kPZy08JfML%2FyOCYqBFzmVpWF9lcV4XD%2BP1%2F0elG%2B6dO0EESXa7UE%2BeFg6LLKGiYy%2F1ZpcPJuklG6Yrmva1DbP0U04C2rM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9ecb04d08e625ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4491,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 28 x 150","md5":"8b78a541eaa521c8bd946b84a46feb92","sha1":"31a6411c7051332a4aff0d338cf721f513bd1f8b","sha256":"8794063dced5ec3d5035d4fd6e7cce885671224284469fe85e7b392a0fabf0a8","sha512":"ca4f07b46c061bcc141b763e32da638e835f207106f8d5ea90dfab473487114081fbd3e12768cfe3d374c0eecba53e2a085fd0af4cb068f4efed559fbd9fa26d","ssdeep":"96:kRXW9wwXp9lM6jb7xLD3hFG2G/3dtGSQp60NfzpAMK:kVW9Jp9JjbBDRFG2G/3mjrpAMK","tlshash":"c791e7121a798d4cf0335934c9a8ac5f332a5da2811183db29d4329ee93c4bd596e67c","first_seen":"2025-05-30T17:14:42.053302Z","last_seen":"2026-08-05T18:54:41.239788Z","times_seen":498,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"immigrationacre.com/c6/4a/a1/c64aa11db612c16c65959b87a44dac81.js","fqdn":"immigrationacre.com","domain":"immigrationacre.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:27.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"immigrationacre.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 22:44:59 GMT","end":"Sat, 20 Jun 2026 22:44:58 GMT"},"fingerprint":{"sha1":"C5:C0:F1:09:DF:66:79:21:CE:6B:25:C3:DC:5A:3B:4E:6C:24:00:FD","sha256":"14:5E:A4:DE:46:F2:FF:8F:7D:14:D8:7C:E6:33:BC:41:57:AD:BF:24:AC:C4:3C:0F:A7:EE:34:BE:D3:48:56:5B"}}},"request":{"raw":"GET /c6/4a/a1/c64aa11db612c16c65959b87a44dac81.js HTTP/1.1\r\nHost: immigrationacre.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:27 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 34110\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 4\r\nHost: immigrationacre.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 999b461fa99b34423feff52cc0f99ff1\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93658,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"2c07bffdca12ca6fb0b61c800b1b64fd","sha1":"ed5fcaab9955910c8a69ba89fd2358a7043a9c2f","sha256":"8c71ef206a4139e0886dd4a39d5031ad22620ece057e3d7507df3696565edef2","sha512":"d36c2637e35cacbde8ec188c2a3588b6dd456268bb2d7b06a0cf0582243a3b0f865b615951b4c0a1fc9bb0afc72dcd014b03ff3637e1b4948ec8636889217074","ssdeep":"1536:751PqZWem5Kvg/+UriOXwaHe4J+LLFk8Xmj8sV:Cpv4WUR+1HFw9V","tlshash":"dd93e78c3fc1f0a513a5203b222f714ef0994d95546ce468f783f56a2f7ca4ae536b98","first_seen":"2026-03-28T05:54:55.765725Z","last_seen":"2026-04-17T03:55:50.484068Z","times_seen":7,"resource_available":true,"data":null}},"time_used":853,"timings":{"blocked":332,"dns":53,"connect":91,"send":0,"wait":97,"receive":92,"ssl":185},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2FProgamer%2Fflip_icon%2Foct2024%2F3%2Fcss%2Fstyle.css\u0026l=10008\u0026fd=510","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2FProgamer%2Fflip_icon%2Foct2024%2F3%2Fcss%2Fstyle.css\u0026l=10008\u0026fd=510 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl26582471=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/watch.124076308138.js?key=52f212bca95373aed7ead32398143db7\u0026kw=%5B%221%22%2C%22new%22%2C%22message%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /watch.124076308138.js?key=52f212bca95373aed7ead32398143db7\u0026kw=%5B%221%22%2C%22new%22%2C%22message%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1 HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyNjU4MjQ0MywiayI6IjZkZDVlM2Q3YWMzN2QzM2I1YWJjODc4MTBmNmFjN2YzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo0OTQxMzUzLCJwaWQiOjIwMDA2MTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJtZWVtNXlqOGUiLCJjcGtzIjp7IjI4IjoiZDA4OWVhMDQ5ZjBmN2IxZWFjZmEyYjViYjk5ZDNiZGMiLCIyOSI6ImFmMjVkYTgzODFlMGJkMDQ5NGJhNDAxOGM3Njg5OGEyIn0sInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJjdCI6eyJpZCI6MzE0MzI0NCwibiI6Ik9zbG8ifSwicmciOnsiaWQiOjE4NDQsIm4iOiJPc2xvIENvdW50eSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsIml3ZiI6dHJ1ZSwidXAiOnRydWUsInIiOiJodHRwczovL3JvYmxveHdhdGVyc3BsYXNoLnBhZ2VzLmRldi8iLCJ0eiI6MiwiaWR1YyI6MCwiYXIiOltdfX0.MUU_bnpmvZY7xaW4qUE31hcoeEbwUQkxU36aM_PI_5c; pdhtkv=true; uncs=1; pdhtkv5=true; uncs5=1; u_pl26582443=1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 307 Temporary Redirect\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:32 GMT\r\nContent-Type: text/html\r\nContent-Length: 0\r\nConnection: keep-alive\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://robloxwatersplash.pages.dev\r\naccess-control-allow-credentials: true\r\nlocation: https://sourshaped.com/watch.124076308138.js?key=52f212bca95373aed7ead32398143db7\u0026kw=%5B%221%22%2C%22new%22%2C%22message%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1\u0026shu=5d031bc56e75c31f00536b22eaf150d3f9ce4e5f0b3d217f6c4ecc29b351f861507d443bcce276b6af0376669d321059e21b759036ed75ae5682fa7e929fccaa4595dc14d075b9a293057fbd1f8398dc4c1468b63129aa95e0147c\u0026pst=1776256892\u0026rmtc=t\u0026shv=1\u0026sht=QIuIyqGDkieOTPWAjoUw7tU-pJ_5aNCvJAuFi7RNpd4\u0026fstu=019d9128-52df-77d5-a78e-dc11c124b89e\u0026st1=3f010d8c8315716cc0b1567e5c539c37\u0026ps1=1776256832\r\nset-cookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; expires=Wed, 22 Apr 2026 12:40:32 GMT; path=/; secure; SameSite=None\nain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyNjU4MjQzNiwiayI6IjUyZjIxMmJjYTk1MzczYWVkN2VhZDMyMzk4MTQzZGI3Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo0OTQxMzUzLCJwaWQiOjIwMDA2MTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MSwiYWlkIjozMiwicHQiOjQsInBrIjoienZlNHhhcmlwciIsInQiOjF9LCJ1Ijp7InUiOjIsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJjdCI6eyJpZCI6MzE0MzI0NCwibiI6Ik9zbG8ifSwicmciOnsiaWQiOjE4NDQsIm4iOiJPc2xvIENvdW50eSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsIml3ZiI6dHJ1ZSwidXAiOnRydWUsInIiOiJodHRwczovL3JvYmxveHdhdGVyc3BsYXNoLnBhZ2VzLmRldi8iLCJ0eiI6MiwiaWR1YyI6MCwiYXIiOltdfX0._1j0wHRp9g_zV2AXC4EDonaO37A32l2nvmJKFh42GZ8; expires=Wed, 15 Apr 2026 12:41:32 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 3\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: a42937407413ce28fa8930e8c0833ca3\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":4422,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-15T12:40:25.794Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"robloxwatersplash.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Apr 2026 08:43:13 GMT","end":"Tue, 14 Jul 2026 09:41:01 GMT"},"fingerprint":{"sha1":"6F:C9:03:56:21:27:05:BF:C0:6F:19:75:6A:0D:95:4B:AE:E3:5F:A1","sha256":"8E:AA:DC:34:9A:45:35:5B:98:DF:2B:D6:78:EE:95:A5:07:38:AB:51:E6:89:3B:FA:74:BF:93:F8:56:BA:6E:38"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: robloxwatersplash.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:26 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FZchrUfR9Ciy8YjeKFSousHoH5bK5kjIoMby%2FDFSB1jqRejXH2JzlfQdFj0fw%2F4tv2ZTG9f4F9RZl8LDjTTOD4tKvIkHQ0OrxJ8vrQaLGuGBF8OaN5PAbkQihHmhlegUW8bwkbtr0dCQUzAiJnM%3D\"}]}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ecb04c95933a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35631,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (18745)","md5":"ad9c9ce470a0dbdbcaaa75e64f1e0dc0","sha1":"6b510d1c94c8d8ee1d9cde766014e43dd4541184","sha256":"93cea1b811039533bb34a8d4ca9ad55c05b1ded782147c8613278f68d3facd0c","sha512":"1b512e18b04a66c004b9c4b4e0bfe7a598adc178bbec8c7802339de189ed4c6e1b2dd6d4354d4d57cd9199adb6d10f1ecd3df4babae92f3664a23ad40c98b9a3","ssdeep":"768:gJOUVceXBqsQUKRBebPuNkoRpXzzdz3JJ/QS4wI:RUvQzRxJpPQp","tlshash":"35f20afbd3440379134103add31e7aeeaa7b903adb638094ec5da16c2543d79413adea","first_seen":"2026-04-15T12:40:55.043521Z","last_seen":"2026-04-15T12:40:55.043521Z","times_seen":1,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":26,"dns":9,"connect":1,"send":0,"wait":234,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"adxpy.pages.dev/ads.js","fqdn":"adxpy.pages.dev","domain":"adxpy.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.995Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"adxpy.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 05 Apr 2026 00:44:54 GMT","end":"Sat, 04 Jul 2026 01:43:34 GMT"},"fingerprint":{"sha1":"B9:0E:27:18:36:32:2C:B8:F2:E5:2F:50:96:88:4F:CF:54:4C:10:3C","sha256":"ED:9F:40:13:F5:DC:3F:FE:75:A2:AF:61:F4:2D:D7:17:14:E2:C8:D4:C5:19:DB:9E:88:D1:73:59:BF:13:F7:D1"}}},"request":{"raw":"GET /ads.js HTTP/1.1\r\nHost: adxpy.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:27 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=3,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7p7n63wVrfNz1Ax66n6U1g4dg81xNM%2BnQ3eeQa7jbS%2BMSajla92QNHC5hOeSSzcr5FtoMTWBUBR0ttxbvqQkqvopPkbEAm%2FCbXxLSeczlb%2BM6e6K3rJfjosISTqlHtQ1ZQk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"1bc4a8b41519c6fae69917cf3ea9f576\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ecb04d0bef15ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4034,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"28a8ee5b231d6993efeaeb288506fba6","sha1":"185e282511210752916a8d4fcc28642f02e4dc5e","sha256":"81496c62f33c7090e09cd8ea1d016980fc4432fb6ca00450ccea59b926daa7e1","sha512":"b1cf24abc589692314ada61a5a266b280ce2ad1297f5be58b94ececb90e2d718021795ca3998cb142e5937cff260d4aaeaffe5759bb8e67dff20e76bec939658","ssdeep":"","tlshash":"cb81011920a100651eb7236a7be3625dfba43053b81281a4bdccdb185fb9d1091f7fed","first_seen":"2025-10-25T03:17:17.993778Z","last_seen":"2026-08-05T18:54:41.26013Z","times_seen":411,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/ren.gif?sid=H4sIAAAAAAAC_1RSzYscRRytXhcvHsQo3pQGczDgzFZ_TG934in4cVB3xUSCeKqP7s3P6enqdHXPTOa0MRKv60EQQeh5s5u9BNH_QGYFD4qQuc0hK-jJs5CzzO7Aah1-H_WK4v3e-z2YNqesi0YsP_zATCjPxVavy93Xb1Ghzci6Ozddj3f5NfcWFVF4zR2vQjW86gVhl19x301V32z53OPc4577DlVpZsZbZyiofJR43YR3Q7_r9UKMq__3tnFghQM9PGWXQHrx_F_ZpyA1RzH44a3U9mtTvvH2oMlFbSoM9fHHRb8wowKDizKrHGTF8fo1jF0w9s0GTHG8ngBmeLiaAJIWbOPlJ5DF8Zom5PDonKnMkRaQ-jmMhnOk-Rwk5lDmPkg_ZoDS2NlFMXi4Y6qRuHuOihW6YJtP_wGNFmzzyUsoBt9fz2ns3jB5U5MpLMZZCxrPQXtzlM0J6skGaHQCVX8O0r-zrafvoxgc7trcgPTysq8TrZTWHZHIoBMG271OzAPRkUkmPamk54ngTCLK5hB2A4110JCDJnPQlA4GeumGPA6VJ4IoS7Ta5qEIQ51KnsQ-5yJR22jUPZA-gKr2UVb76NMB7O0WVjuwNcNQt0c6t75tH-rcNtJbZ3-dg3Zm6r2pODL1XlowiOoAlW4Pqbxj70PVz8wmmdUzswpC1u1MSN3OSNcM1Z3lZe4lOvH8uBP6mdfZ5jHviCj1OjLUcS9O_TTwg2l5yl5YCex8_d0v6KdLV_l8O1VxqPywF4nM555SvShQQqsgUmEESy3IbkBYBxNasPeyKyhpwV598DekOIHNT6DIgWhegRi1ELdbTIpHGRV6SCrtKjOANi3KehP1XWean7IXZx_dvP7Tmc-f_OkgVb-y9YGqWpRVi8_oZ4a9_N6Pu2VNA5qIlfE3alGnz0LQ49d8KFqwS9-mZxvo_3YVqtyHLS9-soZBlg5yYsjTi3shW9j_9PKintovsFc5kLkzk3nlHMq8yr86J2lp6fZ8GURxHKVZpLNAB36gkx5Pk1AkUZiEPdR2QX98-ea_AQAA__-aDp01_wMAAA==","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1RSzYscRRytXhcvHsQo3pQGczDgzFZ_TG934in4cVB3xUSCeKqP7s3P6enqdHXPTOa0MRKv60EQQeh5s5u9BNH_QGYFD4qQuc0hK-jJs5CzzO7Aah1-H_WK4v3e-z2YNqesi0YsP_zATCjPxVavy93Xb1Ghzci6Ozddj3f5NfcWFVF4zR2vQjW86gVhl19x301V32z53OPc4577DlVpZsZbZyiofJR43YR3Q7_r9UKMq__3tnFghQM9PGWXQHrx_F_ZpyA1RzH44a3U9mtTvvH2oMlFbSoM9fHHRb8wowKDizKrHGTF8fo1jF0w9s0GTHG8ngBmeLiaAJIWbOPlJ5DF8Zom5PDonKnMkRaQ-jmMhnOk-Rwk5lDmPkg_ZoDS2NlFMXi4Y6qRuHuOihW6YJtP_wGNFmzzyUsoBt9fz2ns3jB5U5MpLMZZCxrPQXtzlM0J6skGaHQCVX8O0r-zrafvoxgc7trcgPTysq8TrZTWHZHIoBMG271OzAPRkUkmPamk54ngTCLK5hB2A4110JCDJnPQlA4GeumGPA6VJ4IoS7Ta5qEIQ51KnsQ-5yJR22jUPZA-gKr2UVb76NMB7O0WVjuwNcNQt0c6t75tH-rcNtJbZ3-dg3Zm6r2pODL1XlowiOoAlW4Pqbxj70PVz8wmmdUzswpC1u1MSN3OSNcM1Z3lZe4lOvH8uBP6mdfZ5jHviCj1OjLUcS9O_TTwg2l5yl5YCex8_d0v6KdLV_l8O1VxqPywF4nM555SvShQQqsgUmEESy3IbkBYBxNasPeyKyhpwV598DekOIHNT6DIgWhegRi1ELdbTIpHGRV6SCrtKjOANi3KehP1XWean7IXZx_dvP7Tmc-f_OkgVb-y9YGqWpRVi8_oZ4a9_N6Pu2VNA5qIlfE3alGnz0LQ49d8KFqwS9-mZxvo_3YVqtyHLS9-soZBlg5yYsjTi3shW9j_9PKintovsFc5kLkzk3nlHMq8yr86J2lp6fZ8GURxHKVZpLNAB36gkx5Pk1AkUZiEPdR2QX98-ea_AQAA__-aDp01_wMAAA== HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl26582471=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:28 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 1\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 0c056ba4095f36099debe8bd95af726f\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/css/style.css","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/css/style.css HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:29 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Thu, 15 May 2025 09:23:31 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"6825b293-2718\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wwfGL7axuuU5Rc7PgC1ddGu8LGo5KkPIDCeJOxoC9o7s7Pc5exPaG5b5iI636LolpxfbsjxCrrT7QxHQMj901wSQS09EIjlv8%2B%2Fj4gD1huvaCUkOITHS9ao3I9ZGIQWuZfwlP1hBg20%3D\"}]}\r\ncf-ray: 9ecb04dc6dd00daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10008,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"8e2b823b6de6509e79ba3d1e1ef6ef55","sha1":"b937a4666fe32721cac699123ea78872acc839a0","sha256":"6a0a6ae471e19a24f9f9a463718deb8570927f2c4ff9f0e292b2e44186d54a6a","sha512":"53e6fcdc3ac2bd5f34db6cf73deede4c889175d13078d9e0d92c61340a40c07f21b4c4ac1939338d4e142a3975bd17cb761dce2cd88c99cf03feb8a5266c0595","ssdeep":"192:qcl/O9UHhyTFH5jQvsymvaJxMX5/+0p0AF5zFzDa49wF5F33SAHhZtBFQF5ntoHw:4jFjanMX1FdFzDbwF5F33/tBFQFxtoD8","tlshash":"6a220e825ab70d09740fe15b3f66a74726180043be1fc8297fc972588f851a8d6a3f9f","first_seen":"2025-04-13T04:21:39.853055Z","last_seen":"2026-07-22T02:48:25.210064Z","times_seen":657,"resource_available":false,"data":null}},"time_used":511,"timings":{"blocked":27,"dns":5,"connect":1,"send":0,"wait":455,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.storageimagedisplay.com/cti/0c/64/c9/0c64c955cb1d51da0e58e57419b66631/1708270232.jpg","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.storageimagedisplay.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 02:33:25 GMT","end":"Fri, 05 Jun 2026 02:33:24 GMT"},"fingerprint":{"sha1":"4A:66:11:51:1F:1F:F3:84:B6:E4:4F:81:C1:03:83:9F:01:17:7E:82","sha256":"DA:55:E3:02:D5:3C:4E:3A:51:ED:21:0D:F4:32:52:C2:C5:31:87:50:DC:AB:13:D9:93:4A:15:0C:D9:8C:D6:4F"}}},"request":{"raw":"GET /cti/0c/64/c9/0c64c955cb1d51da0e58e57419b66631/1708270232.jpg HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:29 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 79010\r\nserver: nginx/1.21.6\r\nlast-modified: Sun, 18 Feb 2024 15:30:40 GMT\r\netag: \"65d222a0-134a2\"\r\nexpires: Fri, 17 Apr 2026 12:40:29 GMT\r\ncache-control: max-age=172800\r\nx-cdn-host-id: AH0543\r\nx-proxy-cache: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79010,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 24.5 (Windows), datetime=2024:02:16 15:04:57], progressive, precision 8, 300x250, components 3","md5":"325d5a8fd98bd4abebe19e1ea0bfa6b5","sha1":"724b06f3b7fd7b0e958b59c4c4afb2813a5f5c17","sha256":"710e54e782c441ef1ce60c52642dae8084dbbaa413343ff13f86c1e53c981318","sha512":"3ac5762c73d75005bd47370eafd2e87179812aa375cbe33f0043efa8be4efd6cd14ec6779a16e69f3afed6892e56ec45c722d87d45a9365d80df2230b94b4cf9","ssdeep":"1536:aty2ndOty2ndnaUv0qBj6RDLOErXGw0M2t4AD23v3EbPGz2OrM:cykgykaUvXmRGwoiX3EOSOrM","tlshash":"bf73f10cb348cd36c4e4b379c6dad5c222219de536c21ae4bd5eea02b7be7a19d48344","first_seen":"2024-02-21T19:37:55Z","last_seen":"2026-05-18T05:37:40.676742Z","times_seen":985,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":74,"dns":29,"connect":19,"send":0,"wait":21,"receive":49,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"preferencenail.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 01:24:35 GMT","end":"Thu, 28 May 2026 01:24:34 GMT"},"fingerprint":{"sha1":"66:45:2B:BB:A2:6D:D3:A2:B6:16:36:65:94:BA:4A:C6:5E:05:66:09","sha256":"A4:2E:A7:56:DB:44:FF:55:9A:FA:4D:EC:2A:78:CB:C5:02:CD:CF:B2:FB:A7:A7:75:77:EC:01:DB:19:71:C0:77"}}},"request":{"raw":"GET /sfp.js HTTP/1.1\r\nHost: preferencenail.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 32181\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nP3P: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\nAccess-Control-Allow-Origin: *\r\nVary: Accept-Encoding\r\nHost: preferencenail.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 5907ebb19f130422217e54d906b3c44d\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85379,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators","md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-08T07:35:47.192337Z","times_seen":26038,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":21,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"192.178.25.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.144Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 08:38:37 GMT","end":"Mon, 15 Jun 2026 08:38:36 GMT"},"fingerprint":{"sha1":"F8:24:5E:5A:B0:FB:57:E0:D6:E9:33:BD:54:27:DC:BF:50:74:4A:59","sha256":"A4:18:08:9F:87:3F:1D:A2:3B:7A:25:AA:E0:FF:C8:CB:B1:74:9C:8B:FF:A2:C5:D6:74:BB:B0:A7:97:7E:5B:02"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 14 Apr 2026 02:23:48 GMT\r\nexpires: Wed, 14 Apr 2027 02:23:48 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nage: 123404\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43136,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-08T08:24:37.940663Z","times_seen":257068,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.storageimagedisplay.com/cti/71/2f/6f/712f6f8200ca47337a0bbfe70de0aea2/1756656539.jpg","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.storageimagedisplay.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 02:33:25 GMT","end":"Fri, 05 Jun 2026 02:33:24 GMT"},"fingerprint":{"sha1":"4A:66:11:51:1F:1F:F3:84:B6:E4:4F:81:C1:03:83:9F:01:17:7E:82","sha256":"DA:55:E3:02:D5:3C:4E:3A:51:ED:21:0D:F4:32:52:C2:C5:31:87:50:DC:AB:13:D9:93:4A:15:0C:D9:8C:D6:4F"}}},"request":{"raw":"GET /cti/71/2f/6f/712f6f8200ca47337a0bbfe70de0aea2/1756656539.jpg HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:32 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 31253\r\nserver: nginx/1.21.6\r\nlast-modified: Sun, 31 Aug 2025 16:09:00 GMT\r\netag: \"68b4739c-7a15\"\r\nexpires: Fri, 17 Apr 2026 12:40:32 GMT\r\ncache-control: max-age=172800\r\nx-cdn-host-id: AH0543\r\nx-proxy-cache: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31253,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 26.3 (Macintosh), datetime=2025:08:29 18:41:14], progressive, precision 8, 320x50, components 3","md5":"baf2c3796d05cc719e167b2a84f0c0d7","sha1":"afc6dc0d9e128cb192058f7dc7cf5bf21dbd1e0b","sha256":"93bf456aded7a37ca2304cdec3f3faa3ab5b47bf0fa7a4805d037870ccf85771","sha512":"fa7e51c7f2c1e3d70f5a1b268d35e1a77b0632b5dcb94e24a653534cef8ee208086efb50bd67f185cdbef2115cff1214553bfd33b7c168ee79a0f11c4fa538b6","ssdeep":"768:kTvjiXTv1H3zYyho8u5Fjwg0FqPLQ6tomjp3ii1g1:Mvav1H3zmzjUQPL/9tg","tlshash":"82e29e19abe2cf13f4e1ba3858e1d3c25351ba80a36371d67cfd742637716905d4e11a","first_seen":"2025-09-02T22:24:28.308394Z","last_seen":"2026-05-20T07:37:59.038346Z","times_seen":327,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbs?c=1","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbs?c=1 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl26582471=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/ren.gif?sid=H4sIAAAAAAAC_1RSvY8bRRydddIBQnyIDrTFFUTCvpndtb1LJCIiAuLrDkhQCgo0H7t3g9e7m51d2zEFCYFQIKGjI1TrZ98dxSmC_wD56E4gsZ2LHAUVNVIkOmSfpcArfl_vV7zfzLs7KU9JCyVfvPduOtZxzDfbLWq_eF0nKh0ae-uazWiLXrSv66TjXbRHy5APXmau16IX7DdC2Us3HcooZZTZr-s8jNLR5oqFzo4C1gpoy3NarO1hlP-_N2UDhjegBqfkaWhVP_ln9BG0nCPp__haaHpFmr10pV_GvEhzDNThh0kvSYcJ-o_KKLcQJYfrbaSmJuS7BtLkcH0B0sFseQGErknjuQcQyeFaJsRg_0ypiBEmEOoxDAdzhPEcms8h0zvQ6ncCSIWtbST9g600H_KbZyxfsjU5__Bv6GFNzj94Fkn__uVYj-yraVwWOk0MRlEFPZpD78yRlccoxg3o4TFk8Tm0-o1sPnwHSX-2beIUWi02HBUoKZVq8kC4Tc_ttps-dXlTBJFgQgrGuLt6Ih3NwU0DpbFQagtlZKHMLPTVwvao70nG3U4UKNmlHvc8FQoa-A6lPJBdlPI2tNqDzL88KBNpnGDCjsqPs9jptH3H67IJO8jUbtEbzIq8DGfLnQn74WzkBKshsvwWenoPZreCUedgippY73-Ggar2VWwcUx2o2JSCrbOzzm41TYudCd9Pi50wIeD5HnJVzXR2w9yBLM5Nx5FR03QZuCiqKReqmmpVEOQ3FhuUBSpgjt_0BOs0u9KlTdEVrEm73PWiIGp3OZtkp-Sp5e9Y9795Ar1wYfPIaSvuuz4LqVDUCzzBPcp82e34gc8dGF1Bmwa4sTDWNXk7uoBM1-SFu39B8GOY-BhSW-Dl8-DDCny3wjg5inSiBlqGLZn2odIKWXEexU1rEp-SZ6YfXLv888okr_5zD6E8ubS4t8T3kHmFLK_wif6FYCe-_dN2Vui-HvOla64WvAjPgeuaWJ_-Cqlr8vhbV1YG3njza8jsFkx2cunYXQEmJRCZhVgTxOEJWQNcVDD_6cWjemK-wE5uQcTWVMS5NRNxHn97JtPohd12hNvx_U4YdVTkKtdxVdCmYeDxoOMFXhuFqfUfX73ybwAAAP___K-Rij4EAAA=","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:30.529Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1RSvY8bRRydddIBQnyIDrTFFUTCvpndtb1LJCIiAuLrDkhQCgo0H7t3g9e7m51d2zEFCYFQIKGjI1TrZ98dxSmC_wD56E4gsZ2LHAUVNVIkOmSfpcArfl_vV7zfzLs7KU9JCyVfvPduOtZxzDfbLWq_eF0nKh0ae-uazWiLXrSv66TjXbRHy5APXmau16IX7DdC2Us3HcooZZTZr-s8jNLR5oqFzo4C1gpoy3NarO1hlP-_N2UDhjegBqfkaWhVP_ln9BG0nCPp__haaHpFmr10pV_GvEhzDNThh0kvSYcJ-o_KKLcQJYfrbaSmJuS7BtLkcH0B0sFseQGErknjuQcQyeFaJsRg_0ypiBEmEOoxDAdzhPEcms8h0zvQ6ncCSIWtbST9g600H_KbZyxfsjU5__Bv6GFNzj94Fkn__uVYj-yraVwWOk0MRlEFPZpD78yRlccoxg3o4TFk8Tm0-o1sPnwHSX-2beIUWi02HBUoKZVq8kC4Tc_ttps-dXlTBJFgQgrGuLt6Ih3NwU0DpbFQagtlZKHMLPTVwvao70nG3U4UKNmlHvc8FQoa-A6lPJBdlPI2tNqDzL88KBNpnGDCjsqPs9jptH3H67IJO8jUbtEbzIq8DGfLnQn74WzkBKshsvwWenoPZreCUedgippY73-Ggar2VWwcUx2o2JSCrbOzzm41TYudCd9Pi50wIeD5HnJVzXR2w9yBLM5Nx5FR03QZuCiqKReqmmpVEOQ3FhuUBSpgjt_0BOs0u9KlTdEVrEm73PWiIGp3OZtkp-Sp5e9Y9795Ar1wYfPIaSvuuz4LqVDUCzzBPcp82e34gc8dGF1Bmwa4sTDWNXk7uoBM1-SFu39B8GOY-BhSW-Dl8-DDCny3wjg5inSiBlqGLZn2odIKWXEexU1rEp-SZ6YfXLv888okr_5zD6E8ubS4t8T3kHmFLK_wif6FYCe-_dN2Vui-HvOla64WvAjPgeuaWJ_-Cqlr8vhbV1YG3njza8jsFkx2cunYXQEmJRCZhVgTxOEJWQNcVDD_6cWjemK-wE5uQcTWVMS5NRNxHn97JtPohd12hNvx_U4YdVTkKtdxVdCmYeDxoOMFXhuFqfUfX73ybwAAAP___K-Rij4EAAA= HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=2; pdhtkv29=true; uncs29=2; u_pl26582471=1; u_pl28216845=1; slecaf25da8381e0bd0494ba4018c76898a2=[4323737]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:30 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: close\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 3\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: f6b982c7ab7462381b905e844cdbd6ac\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/d0/89/ea/d089ea049f0f7b1eacfa2b5bb99d3bdc.js","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /d0/89/ea/d089ea049f0f7b1eacfa2b5bb99d3bdc.js HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 36036\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 7\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 57b211ec5261bdfe18c819071a03e491\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":99384,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4d5e1c3fd6337b200e4d103651f5a193","sha1":"e5a4cf25c97fb3c87c7c45bfc05904a4b00c512e","sha256":"34538af87ee1fc84376642b4806c544c64df3778b52e0f57ca366274f389ad8b","sha512":"9b9cc142c46cd7b2a379d1f593f40fb0e86d9d39d2cf8b9be91af7e77129123957646e0367f7f0965df4a1d1c4e24f74de735b5ed5ee0b36e4423333d39dd3c9","ssdeep":"1536:gS7xg4asY51M18N222qysMHBPMDAVpFoRJv932rO3tus/1z:bosu1MQBsMj92rO3Hh","tlshash":"27a3c48c7fe2b05b522a7077352fa52bf02d4c2c248cf468f1569de42a7c71ae53ae51","first_seen":"2026-04-03T00:33:38.788131Z","last_seen":"2026-04-15T12:40:55.050123Z","times_seen":2,"resource_available":true,"data":null}},"time_used":772,"timings":{"blocked":285,"dns":1,"connect":93,"send":0,"wait":104,"receive":95,"ssl":186},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/watch.841799266977.js?key=6dd5e3d7ac37d33b5abc87810f6ac7f3\u0026kw=%5B%22roblox%22%2C%22water%22%2C%22splash%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1\u0026shu=ba0a4aafb84a844479d5313879b03dad667590a4215946686d9a31b962bf971858c55e76c7d4140a6acad3c4216a0336549486225c79e3ec0d0f7456f0cb90924cea4c0928c787bf209121800daf86a55b4c645cdca46095c212d9\u0026pst=1776256889\u0026rmtc=t\u0026shv=1\u0026sht=_WRSSSZgdS9ml-a1iLAfAKrfuZ6SyZpF3m8dGjZvCxQ\u0026fstu=019d9128-4838-735f-8919-0518069a9785\u0026st1=6db5af016499e2e6181b09e474b2bc18\u0026ps1=1776256829","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.550Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /watch.841799266977.js?key=6dd5e3d7ac37d33b5abc87810f6ac7f3\u0026kw=%5B%22roblox%22%2C%22water%22%2C%22splash%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1\u0026shu=ba0a4aafb84a844479d5313879b03dad667590a4215946686d9a31b962bf971858c55e76c7d4140a6acad3c4216a0336549486225c79e3ec0d0f7456f0cb90924cea4c0928c787bf209121800daf86a55b4c645cdca46095c212d9\u0026pst=1776256889\u0026rmtc=t\u0026shv=1\u0026sht=_WRSSSZgdS9ml-a1iLAfAKrfuZ6SyZpF3m8dGjZvCxQ\u0026fstu=019d9128-4838-735f-8919-0518069a9785\u0026st1=6db5af016499e2e6181b09e474b2bc18\u0026ps1=1776256829 HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://robloxwatersplash.pages.dev\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyNjU4MjQ0MywiayI6IjZkZDVlM2Q3YWMzN2QzM2I1YWJjODc4MTBmNmFjN2YzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo0OTQxMzUzLCJwaWQiOjIwMDA2MTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJtZWVtNXlqOGUiLCJjcGtzIjp7IjI4IjoiZDA4OWVhMDQ5ZjBmN2IxZWFjZmEyYjViYjk5ZDNiZGMiLCIyOSI6ImFmMjVkYTgzODFlMGJkMDQ5NGJhNDAxOGM3Njg5OGEyIn0sInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJjdCI6eyJpZCI6MzE0MzI0NCwibiI6Ik9zbG8ifSwicmciOnsiaWQiOjE4NDQsIm4iOiJPc2xvIENvdW50eSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsIml3ZiI6dHJ1ZSwidXAiOnRydWUsInIiOiJodHRwczovL3JvYmxveHdhdGVyc3BsYXNoLnBhZ2VzLmRldi8iLCJ0eiI6MiwiaWR1YyI6MCwiYXIiOltdfX0.MUU_bnpmvZY7xaW4qUE31hcoeEbwUQkxU36aM_PI_5c\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Type: text/html\r\nContent-Length: 3061\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://robloxwatersplash.pages.dev\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\nset-cookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; expires=Wed, 22 Apr 2026 12:40:29 GMT; path=/; secure; SameSite=None\npdhtkv=true; expires=Thu, 16 Apr 2026 12:40:29 GMT; path=/; secure; SameSite=None\nuncs=1; expires=Thu, 16 Apr 2026 12:40:29 GMT; path=/; secure; SameSite=None\npdhtkv5=true; expires=Thu, 16 Apr 2026 12:40:29 GMT; path=/; secure; SameSite=None\nuncs5=1; expires=Thu, 16 Apr 2026 12:40:29 GMT; path=/; secure; SameSite=None\nu_pl26582443=1; expires=Thu, 16 Apr 2026 12:40:29 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 23\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: a48f42abb84da18d879db590b59ea1f9\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":4341,"size_decoded":0,"mime_type":"text/html","magic":"JavaScript source, ASCII text, with very long lines (3465)","md5":"13d6d5d33075926d5543e807e0ef9c88","sha1":"6c3717558de4b90318daf7579750b192f4cf7371","sha256":"8f54b04a07906ea6d029f08ead3a5fafc3a5fb4aa5632f2b8cc862c93a501c29","sha512":"6b0acf268f735cde35e5961c2e889930d37155e68df52712f79cd0f658d8cf5f4a59e61bc1e4548b2ab251d5020cbfde1606e156a8ae58073cbeac3437308de5","ssdeep":"96:xozAnj6R2CC9G9moym4Jk/M+q6sQh9xwcXKzBZb1ZDUCfMEDaH:uzANV9Mv4JkmNQhv6zBrVUCkCaH","tlshash":"85915a3aad82907c745b74fe31a35614beb0818f1608ce59f95cfb022f60b915e66edc","first_seen":"2026-04-15T12:40:55.052996Z","last_seen":"2026-04-15T12:40:55.052996Z","times_seen":1,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":119,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"protrafficinspector.com/stats","fqdn":"protrafficinspector.com","domain":"protrafficinspector.com","tld":"com"},"ip":{"addr":"3.72.196.114","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:27.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"statistics.it.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Tue, 14 Apr 2026 00:00:00 GMT","end":"Wed, 28 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"8F:66:77:D7:9E:99:80:D4:C4:22:4B:79:2F:16:2B:49:2C:08:07:99","sha256":"54:26:39:E0:45:11:B3:20:EE:6C:3E:B3:C0:57:5D:F2:28:8C:E0:E1:C4:F0:BD:56:E7:8C:91:6B:40:CC:0E:0D"}}},"request":{"raw":"GET /stats HTTP/1.1\r\nHost: protrafficinspector.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 40\r\nserver: fasthttp\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://robloxwatersplash.pages.dev\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\nset-cookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; expires=Sat, 12 Apr 2036 12:40:27 GMT; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"784bd292d95faaccd6623a99c45f7cf0","sha1":"4a5e0220d363e37fadf6f7f92445b5a7b2016a1f","sha256":"4ec73ff0c7471f9b1d09dcfc25aa3b8f9c3bdac2c8cf1693c43c96f502dd6d05","sha512":"aeb6ed6e8aad8a2c732cc6bd5a41939d9148ce3bc958d8e8eec4703e78433daac2b31bf21937cafe5f1590e8cde3122d90b0bb18df4d6e62f0f1b3dff140ff6c","ssdeep":"","tlshash":"6b9004417d7050415d4cc714f7003dcc4541c0d4303d300415c5c3f743045075137c11","first_seen":"2026-04-15T12:40:55.055419Z","last_seen":"2026-04-15T12:40:55.055419Z","times_seen":1,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":100,"dns":0,"connect":22,"send":0,"wait":23,"receive":0,"ssl":76},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2FProgamer%2Fflip_icon%2Foct2024%2F3%2Fjs%2Fscript.js\u0026l=445\u0026fd=647","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.469Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2FProgamer%2Fflip_icon%2Foct2024%2F3%2Fjs%2Fscript.js\u0026l=445\u0026fd=647 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl26582471=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":50,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto:300,400,700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.233Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 30 Mar 2026 08:36:54 GMT","end":"Mon, 22 Jun 2026 08:36:53 GMT"},"fingerprint":{"sha1":"89:9D:A0:A4:A4:3B:62:A3:D0:B3:63:4B:5B:C3:1D:9B:09:43:3C:91","sha256":"DB:10:40:08:19:EF:D7:9C:5F:11:BC:78:DC:9F:81:F3:9E:A7:30:2F:1F:06:C8:C4:A4:DD:BC:C3:27:6F:2A:AA"}}},"request":{"raw":"GET /css?family=Roboto:300,400,700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 15 Apr 2026 12:40:31 GMT\r\ndate: Wed, 15 Apr 2026 12:40:31 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16755,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"1936a90eef3ebd4c6b40eb59d72e164d","sha1":"4c698f8dc97e2e6186d46215e209aca1b1194a5d","sha256":"412d98c2f4410a048131a7d9362fb38456ce2ff67cd4731ea411708a7996a021","sha512":"07ad2431175e5566ae435738d94d4da3e96e4856a1fe1d5917c52474cab28808cd940fec0e8f75eb2f3d573e6fe8497fc12636ef4738d1b67e9144725192b580","ssdeep":"384:p9f59g9P9r9yU9/qY4+949Y9p9fM919W969yh9/qY4X9N9t949fd9k9D939yQ9/O:pDS99YURRuWDyjooYhREHPWP2ZZYQRVs","tlshash":"48721091041704009b834ce223cebf35fe1f52117142d0b5abfd9b6b9ddbca6526939d","first_seen":"2026-02-19T22:28:01.752187Z","last_seen":"2026-08-08T07:35:47.156415Z","times_seen":10431,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/img/icon.jpg","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/img/icon.jpg HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:28 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 71004\r\nserver: cloudflare\r\nlast-modified: Thu, 15 May 2025 09:23:32 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6825b294-1155c\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\naccept-ranges: bytes\r\nage: 1361433\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cOELRFVWQA%2BAFYaFJEXdLE5XaG7u6uNM89uHW75gxVhySHxkNVG1IzO1bOrSTOh7YvdiXBwU3%2FclkhJ8ypn4Gde5GWNVMz5yS5Ll6S1DIoU3Cd82wtw5Py5%2B5uut3PyFtp5H%2FDfWdUE%3D\"}]}\r\ncf-ray: 9ecb04dccf140daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":71004,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 24.5 (Windows), datetime=2024:10:08 12:50:38], progressive, precision 8, 300x250, components 3","md5":"7c4ef61da9a1b31964e978f85f0822c5","sha1":"74b0f0eeafb15241274671b1199c8eb4e21ab181","sha256":"99225a61cd24642b3467e77a6e23eda7cdd6273f898451e71e4bb9a9eebd262f","sha512":"cd0d387879d62c7aea3cb003267f4fb376e11822367ad4cf53084c13833a6f863ba11235fec44e99296f5ace2f51cd2a193829d57e2f6264e3f459efebd3f9ab","ssdeep":"1536:SvSXF00vSXF0pr5xQIHcSK/toSXJCKeg6CYxMEtjuJb:yS10AS10jxzcDpfuu3Jb","tlshash":"9363f119bf50dca6fdfc803ae062970b5a114ba419b77b283ccf61a5bf341e29d19187","first_seen":"2025-04-13T08:19:34.710818Z","last_seen":"2026-07-06T14:19:55.865974Z","times_seen":590,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"immigrationacre.com/6dd5e3d7ac37d33b5abc87810f6ac7f3/invoke.js","fqdn":"immigrationacre.com","domain":"immigrationacre.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.014Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"immigrationacre.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 22:44:59 GMT","end":"Sat, 20 Jun 2026 22:44:58 GMT"},"fingerprint":{"sha1":"C5:C0:F1:09:DF:66:79:21:CE:6B:25:C3:DC:5A:3B:4E:6C:24:00:FD","sha256":"14:5E:A4:DE:46:F2:FF:8F:7D:14:D8:7C:E6:33:BC:41:57:AD:BF:24:AC:C4:3C:0F:A7:EE:34:BE:D3:48:56:5B"}}},"request":{"raw":"GET /6dd5e3d7ac37d33b5abc87810f6ac7f3/invoke.js HTTP/1.1\r\nHost: immigrationacre.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 20447\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 3\r\nHost: immigrationacre.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 1d9dd4d3879d9a5524fca1c57d26a8c0\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":51290,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (51290), with no line terminators","md5":"717025c468ab704cdde89f0f7d44d6e5","sha1":"c4879a45c6a424d28d25a87c01b151aa711bae57","sha256":"70b9b48608716d4c5ed559a58842c355a48da0858b42a0e87eae5ebd2622b075","sha512":"d36256330cd3a2c14a55fbc0a056266c148edbe7281cd83d749fd5303dd5e2393268c08536ccb840c7e6ef5306f95bf6576809c1e38f4dcd872ae79ff55d9161","ssdeep":"768:xIL7jP3R5MaFvQ00hE9ZnANn7aw++nxKDpOI6sxt4F2CNFQb+TLIbbR:xcMaFvQhOsKpN6L2hbk4F","tlshash":"9633d88c7fe1f0e416567c73323f60abf11a1c12958cd48cd906e4ae6ae8795e937b18","first_seen":"2026-04-15T12:40:55.064477Z","last_seen":"2026-04-27T10:28:01.208713Z","times_seen":3,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":101,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/sbar.json?key=af25da8381e0bd0494ba4018c76898a2\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:30.179Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /sbar.json?key=af25da8381e0bd0494ba4018c76898a2\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl26582471=1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:30 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 3434\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://robloxwatersplash.pages.dev\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\nset-cookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; expires=Wed, 22 Apr 2026 12:40:30 GMT; path=/; secure; SameSite=None\nuncs=2; expires=Thu, 16 Apr 2026 12:40:30 GMT; path=/; secure; SameSite=None\nuncs29=2; expires=Thu, 16 Apr 2026 12:40:30 GMT; path=/; secure; SameSite=None\nu_pl28216845=1; expires=Thu, 16 Apr 2026 12:40:30 GMT; path=/; secure; SameSite=None\nslecaf25da8381e0bd0494ba4018c76898a2=[4323737]; expires=Wed, 15 Apr 2026 12:40:35 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 243\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 086e544b30b223196bf907ce92662276\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":5766,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"JSON text data","md5":"96dcc56277700c8e2046604ab39417db","sha1":"bc4c1254b7f64cf9aa75f58871bf6ef404aad707","sha256":"00b2b2b1b3cf67ea63546b819a704c94567c6dc377d866ff2550e2d87199bd5a","sha512":"45bf59378002aa8d481e35733f1f6d45f40d6ea246f5ca2595d065243e7deefa4b86db333b5c99534cee0384ebdbcaba010d6e8f3dd09fa331c93e4a50baca4b","ssdeep":"96:9zW2RWybLqPC7RTJYW2BTHVdWiW8dY61t7YuprsDHAn2BTHVdWiW8dDEyYsnzL6K:9zWwLqP6mWqHV4iWZ6r1SgnqHV4iWZyL","tlshash":"4ec16dbdd41000e20bfa5b1f481a3c6d49988fe7f39ccea549b3bf5e6b28159583112d","first_seen":"2026-04-15T12:40:55.069759Z","last_seen":"2026-04-15T12:40:55.069759Z","times_seen":1,"resource_available":false,"data":null}},"time_used":342,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":342,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/ssp/vpn/classic-push/small/img/close.png","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.237Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/ssp/vpn/classic-push/small/img/close.png HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 15 Apr 2026 12:40:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 591\r\nlast-modified: Fri, 19 Jan 2024 14:19:42 GMT\r\npriority: u=4,i=?0\r\netag: \"65aa84fe-24f\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\naccept-ranges: bytes\r\nage: 1361761\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dDbsE4pL%2ByF48gY16KSuMRRkeJQLK%2BO4xxgbxeIHpwz%2B1CLKnv2sOvOOp8OAYpigL9lz09shuTtAAUT2zegEddMHNdgm%2BIics8nvg0xxmK0s8WeyTDVWY8cI%2BC5dT8%2BxGRjkfoi4J5A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9ecb04eb3dec783d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":591,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced","md5":"9fd5bcb6103d86e317bd1eb019bcbe71","sha1":"6b5a52ea669dcb74946f2bed4bdd7ec985026113","sha256":"0ddd3be104ac7945fb062096df62034a6a24ecc76ba92493c35c62c3c25982ae","sha512":"e244a8842c009fa83e8d9d1088ec5b76ca2a42660568b7886e01724977b9ebd4e43690e0c651e25287c64dcc4826391b34cae6a106e2148139450dd05fc5a562","ssdeep":"","tlshash":"b0f0414e7c5903a1874caf3b18dd00119c27898077c82e0db689eed20e008e215471da","first_seen":"2023-04-11T11:09:41Z","last_seen":"2026-08-08T04:08:50.860413Z","times_seen":6404,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kettledroopingcontinuation.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fanimate.css\u0026l=78689\u0026fd=577","fqdn":"kettledroopingcontinuation.com","domain":"kettledroopingcontinuation.com","tld":"com"},"ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.698Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kettledroopingcontinuation.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 21:44:44 GMT","end":"Sun, 24 May 2026 21:44:43 GMT"},"fingerprint":{"sha1":"4C:9B:DC:71:4E:6F:7E:04:5A:F2:21:54:DA:06:E8:A0:34:82:CB:86","sha256":"23:FF:1C:4C:C9:81:C7:C0:A0:EB:2B:81:77:68:85:F3:47:33:36:DE:71:C4:DB:B4:66:77:5F:24:24:B9:A7:89"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fanimate.css\u0026l=78689\u0026fd=577 HTTP/1.1\r\nHost: kettledroopingcontinuation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:32 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: kettledroopingcontinuation.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":660,"timings":{"blocked":283,"dns":1,"connect":93,"send":0,"wait":94,"receive":0,"ssl":187},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto:300,400,700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.925Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 30 Mar 2026 08:36:54 GMT","end":"Mon, 22 Jun 2026 08:36:53 GMT"},"fingerprint":{"sha1":"89:9D:A0:A4:A4:3B:62:A3:D0:B3:63:4B:5B:C3:1D:9B:09:43:3C:91","sha256":"DB:10:40:08:19:EF:D7:9C:5F:11:BC:78:DC:9F:81:F3:9E:A7:30:2F:1F:06:C8:C4:A4:DD:BC:C3:27:6F:2A:AA"}}},"request":{"raw":"GET /css?family=Roboto:300,400,700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 15 Apr 2026 12:40:29 GMT\r\ndate: Wed, 15 Apr 2026 12:40:29 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16755,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"1936a90eef3ebd4c6b40eb59d72e164d","sha1":"4c698f8dc97e2e6186d46215e209aca1b1194a5d","sha256":"412d98c2f4410a048131a7d9362fb38456ce2ff67cd4731ea411708a7996a021","sha512":"07ad2431175e5566ae435738d94d4da3e96e4856a1fe1d5917c52474cab28808cd940fec0e8f75eb2f3d573e6fe8497fc12636ef4738d1b67e9144725192b580","ssdeep":"384:p9f59g9P9r9yU9/qY4+949Y9p9fM919W969yh9/qY4X9N9t949fd9k9D939yQ9/O:pDS99YURRuWDyjooYhREHPWP2ZZYQRVs","tlshash":"48721091041704009b834ce223cebf35fe1f52117142d0b5abfd9b6b9ddbca6526939d","first_seen":"2026-02-19T22:28:01.752187Z","last_seen":"2026-08-08T07:35:47.156415Z","times_seen":10431,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":140,"dns":1,"connect":29,"send":0,"wait":46,"receive":0,"ssl":108},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/watch.841799266977.js?key=6dd5e3d7ac37d33b5abc87810f6ac7f3\u0026kw=%5B%22roblox%22%2C%22water%22%2C%22splash%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /watch.841799266977.js?key=6dd5e3d7ac37d33b5abc87810f6ac7f3\u0026kw=%5B%22roblox%22%2C%22water%22%2C%22splash%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1 HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 307 Temporary Redirect\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Type: text/html\r\nContent-Length: 0\r\nConnection: keep-alive\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://robloxwatersplash.pages.dev\r\naccess-control-allow-credentials: true\r\nlocation: https://sourshaped.com/watch.841799266977.js?key=6dd5e3d7ac37d33b5abc87810f6ac7f3\u0026kw=%5B%22roblox%22%2C%22water%22%2C%22splash%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1\u0026shu=ba0a4aafb84a844479d5313879b03dad667590a4215946686d9a31b962bf971858c55e76c7d4140a6acad3c4216a0336549486225c79e3ec0d0f7456f0cb90924cea4c0928c787bf209121800daf86a55b4c645cdca46095c212d9\u0026pst=1776256889\u0026rmtc=t\u0026shv=1\u0026sht=_WRSSSZgdS9ml-a1iLAfAKrfuZ6SyZpF3m8dGjZvCxQ\u0026fstu=019d9128-4838-735f-8919-0518069a9785\u0026st1=6db5af016499e2e6181b09e474b2bc18\u0026ps1=1776256829\r\nset-cookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; expires=Wed, 22 Apr 2026 12:40:29 GMT; path=/; secure; SameSite=None\nain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyNjU4MjQ0MywiayI6IjZkZDVlM2Q3YWMzN2QzM2I1YWJjODc4MTBmNmFjN2YzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo0OTQxMzUzLCJwaWQiOjIwMDA2MTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJtZWVtNXlqOGUiLCJjcGtzIjp7IjI4IjoiZDA4OWVhMDQ5ZjBmN2IxZWFjZmEyYjViYjk5ZDNiZGMiLCIyOSI6ImFmMjVkYTgzODFlMGJkMDQ5NGJhNDAxOGM3Njg5OGEyIn0sInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJjdCI6eyJpZCI6MzE0MzI0NCwibiI6Ik9zbG8ifSwicmciOnsiaWQiOjE4NDQsIm4iOiJPc2xvIENvdW50eSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsIml3ZiI6dHJ1ZSwidXAiOnRydWUsInIiOiJodHRwczovL3JvYmxveHdhdGVyc3BsYXNoLnBhZ2VzLmRldi8iLCJ0eiI6MiwiaWR1YyI6MCwiYXIiOltdfX0.MUU_bnpmvZY7xaW4qUE31hcoeEbwUQkxU36aM_PI_5c; expires=Wed, 15 Apr 2026 12:41:29 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 2\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 07ca6c10121fef65023ab2429e4ced28\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4341,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":659,"timings":{"blocked":282,"dns":1,"connect":91,"send":0,"wait":95,"receive":0,"ssl":186},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kettledroopingcontinuation.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.show-sb.com%2Fsb%2Fau%2F0c%2Fc8%2Fe1%2F0cc8e13ba9d5dbc867b982993e805a9d%2F1632728593.html\u0026l=1325\u0026fd=549","fqdn":"kettledroopingcontinuation.com","domain":"kettledroopingcontinuation.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.122Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kettledroopingcontinuation.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 21:44:44 GMT","end":"Sun, 24 May 2026 21:44:43 GMT"},"fingerprint":{"sha1":"4C:9B:DC:71:4E:6F:7E:04:5A:F2:21:54:DA:06:E8:A0:34:82:CB:86","sha256":"23:FF:1C:4C:C9:81:C7:C0:A0:EB:2B:81:77:68:85:F3:47:33:36:DE:71:C4:DB:B4:66:77:5F:24:24:B9:A7:89"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.show-sb.com%2Fsb%2Fau%2F0c%2Fc8%2Fe1%2F0cc8e13ba9d5dbc867b982993e805a9d%2F1632728593.html\u0026l=1325\u0026fd=549 HTTP/1.1\r\nHost: kettledroopingcontinuation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:31 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: kettledroopingcontinuation.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":803,"timings":{"blocked":353,"dns":27,"connect":92,"send":0,"wait":96,"receive":0,"ssl":231},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.storageimagedisplay.com/si/e7/1b/13/e71b13312082539e211f40b180b929f1/1680663431.png","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.238Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.storageimagedisplay.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 07 Mar 2026 02:33:25 GMT","end":"Fri, 05 Jun 2026 02:33:24 GMT"},"fingerprint":{"sha1":"4A:66:11:51:1F:1F:F3:84:B6:E4:4F:81:C1:03:83:9F:01:17:7E:82","sha256":"DA:55:E3:02:D5:3C:4E:3A:51:ED:21:0D:F4:32:52:C2:C5:31:87:50:DC:AB:13:D9:93:4A:15:0C:D9:8C:D6:4F"}}},"request":{"raw":"GET /si/e7/1b/13/e71b13312082539e211f40b180b929f1/1680663431.png HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 70608\r\nserver: nginx/1.21.6\r\nlast-modified: Wed, 05 Apr 2023 02:57:19 GMT\r\netag: \"642ce38f-113d0\"\r\nexpires: Fri, 17 Apr 2026 12:40:31 GMT\r\ncache-control: max-age=172800\r\nx-cdn-host-id: AH0543\r\nx-proxy-cache: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":70608,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"61b6bebe0cb42acfc8731bdca04aa71a","sha1":"d396876682997f10b3bf721df1204677e3b5b0be","sha256":"3bebac68fde7ea059ec5422cb3162c3765ff43c7263e9be6e6b324b73ad0e6f2","sha512":"6883904fb678ea57cbedbd3753c93f5e8f73a79b8abf79fefed3ca2ea0d3eb635c9843419cfda66a561addaed6c68d67151ed51270d31ed3e597e67215173e5a","ssdeep":"1536:xK57wBBmhOG4aC7NV3fwtbCj9Q4tsd8aB0oqaoPHmqrfTwHMX:xK1wBgNZaNV34Cj9Q4Sd5aosPd/wsX","tlshash":"0c63010ed38967b86ec02b9fb3097f408b2473acc719c0d768b059b7a346c1961b7d5a","first_seen":"2023-06-24T15:48:47Z","last_seen":"2026-08-07T20:11:26.231258Z","times_seen":1279,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbs?c=1","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbs?c=1 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=2; pdhtkv29=true; uncs29=2; u_pl26582471=1; u_pl28216845=1; slecaf25da8381e0bd0494ba4018c76898a2=[4323737]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:32 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/1b/50/e5/1b50e57a5911fd0a5b46962ab48ca22b.js","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.169Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /1b/50/e5/1b50e57a5911fd0a5b46962ab48ca22b.js HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyNjU4MjQ0MywiayI6IjZkZDVlM2Q3YWMzN2QzM2I1YWJjODc4MTBmNmFjN2YzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo0OTQxMzUzLCJwaWQiOjIwMDA2MTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJtZWVtNXlqOGUiLCJjcGtzIjp7IjI4IjoiZDA4OWVhMDQ5ZjBmN2IxZWFjZmEyYjViYjk5ZDNiZGMiLCIyOSI6ImFmMjVkYTgzODFlMGJkMDQ5NGJhNDAxOGM3Njg5OGEyIn0sInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJjdCI6eyJpZCI6MzE0MzI0NCwibiI6Ik9zbG8ifSwicmciOnsiaWQiOjE4NDQsIm4iOiJPc2xvIENvdW50eSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsIml3ZiI6dHJ1ZSwidXAiOnRydWUsInIiOiJodHRwczovL3JvYmxveHdhdGVyc3BsYXNoLnBhZ2VzLmRldi8iLCJ0eiI6MiwiaWR1YyI6MCwiYXIiOltdfX0.MUU_bnpmvZY7xaW4qUE31hcoeEbwUQkxU36aM_PI_5c; pdhtkv=true; uncs=1; pdhtkv5=true; uncs5=1; u_pl26582443=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:32 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 2572\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 2\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 6df8c94b0de0956c37379e9d22887b7b\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":5119,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5119), with no line terminators","md5":"2f7f534aa475f2ab416f5768f5eb1abf","sha1":"0e264d3826ec4cea33eb1d05bc113200a9ca55b1","sha256":"18821fa5e86c1240947fc976e78c43d849789cda4360578383adcfbd873d133a","sha512":"c24f6cff97cb6e0cf363714e9073f5f0533cfd228d16665aa6be8fc2527f88f5f3fa156e6dff75bcd4f581a1a3e8f7e0e7242ce4eb3d98d5af950a497b98ee7d","ssdeep":"96:JPczm1siDwcWu0HAGMUJhSENesmRmTj8pdkZ:Bc0DwBLAGtvArmjZ","tlshash":"c2b1b79c3f40b0a017a2a0776f6f2429f1396c10ab6be894d527a1dc3f29d29c2b2755","first_seen":"2026-03-12T08:34:48.0486Z","last_seen":"2026-04-30T07:10:40.662541Z","times_seen":2445,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/impr.gif?sid=H4sIAAAAAAAC_1RTPYwbRRveve_0FVAgCKJELlIQhH3zu7tDGhTxUwAJkKAUCKH5vQy33t3s7NoXF5AQCBJVKJCgAK1f-3JNhKChROiODgkprnCRo6CiREipkS-WDqZ4f55nNHqf0fPemrZH0QBauXzj9XLi81xu8QHqPXPZF6Ych975Sz2MBuhs77IvEna2t7sK9eh5TNkAnem9YvVOuUUQRggj3HvZ19aVu1vHLPjqrsADgQaMDDBnsFv_tw_tBgQZgxkdRU-AN4vH_nDvgNcHUAy_e9GGnaasnntp2OayKWsYmf23i52iHBcwPCldHYMr9te3oQyLKPpyA8pif60AytF8pQCUX0QbT90HVeyvxwQ12ns4qcrBFqDMozAeHYDND8HLA9DlTfDmXgSgDZy_AMXwzvmyHstrD1m5YhfR5oO_wY8X0eb9J6EYfnsu97u9i2XeNr4sAuy6DvzuAfjtA6jaQ2gmG-DHh6Cbj8CbX6OtB69BMZxfCHkJ3ixPEyOM1sb0pVC0z2jK-xmisq-EU1hphbGkx1_k3QHIsAFtiKH1MbQuhraKYWiWPYYyprGkiRNGp4hJxoxVSGQEISl0Cq2-Ad7cBl1_cqcyV5qd0bypWztvCx2meP8hxI-xvRXGp_hu-16Vk4RnhDE6xVDV12HHf36PTyBcWf7ADaJYaZ7YlGuKHUKcJooQKx3myFAntGWWO6SoITh1iWZWayIU5dhlCeYoNYxRpbUlaaIS6RBNkyQRhhKMuLAEq5QLRBNrUi4tTzLiZGoFEU5rKRkX3GjMDEq5EpIIinjqlMEuoyIzmmnMkkwlFBMhpeAWYZZqCGYTQrOI4jc_hJHp9kweSOjumDy0Cq8zWWfazcpmeyr3ymbbFhHI-jbUppv76mq4Cbr532zigpmVqyBV082kMt3MmyaC-uryNMLCCEyyPqcs6aeZQf0MSd1HiiMjmKOImml1FD2-clX8xddz2LHLHieOYKK0FJymVFqTWmkooSLDjBqVQvAd-LABMsQw8YvoVXcGKr-Inr71Jyh5CCE_BO1jkG0P5HhGCQJ5BTiCSXHX-cKMvLYDXQ7BlB1UzSY01-JpfhSdmr116dxPxw5_97cPwOpfovUBXXdQ1R2873-OYDu_8f2FqvFDP5Ery19sZGP_D9Ivokf--gy0X0SnfvzqePv4s9-Arq5DqE7eCmUEqoog9xHk9gSXqoPwr16d1NPwMWzXMag8nqm8juYqr_PbEPyy56glGqEsTTDNnMWUGe14xoRJJKLUQhMW_vdPX_gnAAD__96YBj_2BAAA","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /impr.gif?sid=H4sIAAAAAAAC_1RTPYwbRRveve_0FVAgCKJELlIQhH3zu7tDGhTxUwAJkKAUCKH5vQy33t3s7NoXF5AQCBJVKJCgAK1f-3JNhKChROiODgkprnCRo6CiREipkS-WDqZ4f55nNHqf0fPemrZH0QBauXzj9XLi81xu8QHqPXPZF6Ych975Sz2MBuhs77IvEna2t7sK9eh5TNkAnem9YvVOuUUQRggj3HvZ19aVu1vHLPjqrsADgQaMDDBnsFv_tw_tBgQZgxkdRU-AN4vH_nDvgNcHUAy_e9GGnaasnntp2OayKWsYmf23i52iHBcwPCldHYMr9te3oQyLKPpyA8pif60AytF8pQCUX0QbT90HVeyvxwQ12ns4qcrBFqDMozAeHYDND8HLA9DlTfDmXgSgDZy_AMXwzvmyHstrD1m5YhfR5oO_wY8X0eb9J6EYfnsu97u9i2XeNr4sAuy6DvzuAfjtA6jaQ2gmG-DHh6Cbj8CbX6OtB69BMZxfCHkJ3ixPEyOM1sb0pVC0z2jK-xmisq-EU1hphbGkx1_k3QHIsAFtiKH1MbQuhraKYWiWPYYyprGkiRNGp4hJxoxVSGQEISl0Cq2-Ad7cBl1_cqcyV5qd0bypWztvCx2meP8hxI-xvRXGp_hu-16Vk4RnhDE6xVDV12HHf36PTyBcWf7ADaJYaZ7YlGuKHUKcJooQKx3myFAntGWWO6SoITh1iWZWayIU5dhlCeYoNYxRpbUlaaIS6RBNkyQRhhKMuLAEq5QLRBNrUi4tTzLiZGoFEU5rKRkX3GjMDEq5EpIIinjqlMEuoyIzmmnMkkwlFBMhpeAWYZZqCGYTQrOI4jc_hJHp9kweSOjumDy0Cq8zWWfazcpmeyr3ymbbFhHI-jbUppv76mq4Cbr532zigpmVqyBV082kMt3MmyaC-uryNMLCCEyyPqcs6aeZQf0MSd1HiiMjmKOImml1FD2-clX8xddz2LHLHieOYKK0FJymVFqTWmkooSLDjBqVQvAd-LABMsQw8YvoVXcGKr-Inr71Jyh5CCE_BO1jkG0P5HhGCQJ5BTiCSXHX-cKMvLYDXQ7BlB1UzSY01-JpfhSdmr116dxPxw5_97cPwOpfovUBXXdQ1R2873-OYDu_8f2FqvFDP5Ery19sZGP_D9Ivokf--gy0X0SnfvzqePv4s9-Arq5DqE7eCmUEqoog9xHk9gSXqoPwr16d1NPwMWzXMag8nqm8juYqr_PbEPyy56glGqEsTTDNnMWUGe14xoRJJKLUQhMW_vdPX_gnAAD__96YBj_2BAAA HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyNjU4MjQzNiwiayI6IjUyZjIxMmJjYTk1MzczYWVkN2VhZDMyMzk4MTQzZGI3Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo0OTQxMzUzLCJwaWQiOjIwMDA2MTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MSwiYWlkIjozMiwicHQiOjQsInBrIjoienZlNHhhcmlwciIsInQiOjF9LCJ1Ijp7InUiOjIsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJjdCI6eyJpZCI6MzE0MzI0NCwibiI6Ik9zbG8ifSwicmciOnsiaWQiOjE4NDQsIm4iOiJPc2xvIENvdW50eSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsIml3ZiI6dHJ1ZSwidXAiOnRydWUsInIiOiJodHRwczovL3JvYmxveHdhdGVyc3BsYXNoLnBhZ2VzLmRldi8iLCJ0eiI6MiwiaWR1YyI6MCwiYXIiOltdfX0._1j0wHRp9g_zV2AXC4EDonaO37A32l2nvmJKFh42GZ8; pdhtkv=true; uncs=2; pdhtkv5=true; uncs5=1; u_pl26582443=1; pdhtkv32=true; uncs32=1; u_pl26582436=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:32 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 7\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 4bd7803092399eae494c23dba51134eb\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/impr.gif?sid=H4sIAAAAAAAC_1RSzYscRRytXhcvHsQo3pQGczDgzFZ_zEx34in4cVB3xUSCeKqP7snP6enqdHXPTOa0MRKv60EQQeh5s5u9BNH_QGYFD4qQuc0hK-jJs5CzzO7Aah1-H_WK4v3e-z2Y1aesjVqsPvzATCnLxE6nzd3Xb1Guzdi6uzddj7f5NfcW5d3wmjtZh3J01QvCNr_ivpuogdnxuce5xz33HSqT1Ex2zlBQ8Sj22jFvh37b64SYlP_vbe3ACgd6dMougfTy-b_ST0FqgXz4w1uJHVSmeOPtYZ2JypQY6eOP80FuxjmGF2VaOkjz481rGLtk7JstmPx4MwHM6HA9ASQt2dbLTyDz4w1NyNHROVOZIckh9XMYjxZIsgVILKDMfZB-zAClsbuHfPhw15RjcfccFWt0ybaf_gMaL9n2k5eQD7-_ntHEvWGyuiKTW0zSBjRZgPoLFPUJqukWaHwCVX0O0r-znafvIx8e7tnMgPTqsq9jrZTWLRHLoBUGvU4r4oFoyTiVnlTS80RwJhGlCwi7hdo6qMlBnTqoCwdDvXJDHoXKE0E3jbXq8VCEoU4kjyOfcxGrHmp1D6QPoMp9FOU-BnQAe7uB1Q5sxTDSzZHOrG-bhzqztfQ22d_koJmbqj8TR6bqJzmDKA9Q6uaQijv2PlT1zHyaWj036yBk1cyF1M2cdMVQ3lld5l6sY8-PWqGfeq0ej3hLdBOvJUMddaLETwI_mBWn7IW1wM7X3_2CQbJylc97iYpC5Yedrkh97inV6QZKaBV0VdiFpQZktyCsgykt2XvpFRS0ZK8--BtSnMBmJ1DkQNSvQIwbiNsNpvmjlHI9IpW0lRlCmwZFtY3qrjPLTtmL849uXv_pzOdP_nSQqF_Z5kCVDYqywWf0M0M_u_fjXlHRkKZibfyNSlTJsxD0-DUfipbs0rfJ2Qb6v12FKvZhi4ufrGGQhYOMGLLk4l7IBvY_vbyoZ_YL9EsHMnPmMiudQ5mV2VfnJC2t3DRIfMV51Ot6QZQmXhBqlXaiMNZdwYMgQWWX9MeXb_4bAAD__2ZmDev_AwAA","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.822Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /impr.gif?sid=H4sIAAAAAAAC_1RSzYscRRytXhcvHsQo3pQGczDgzFZ_zEx34in4cVB3xUSCeKqP7snP6enqdHXPTOa0MRKv60EQQeh5s5u9BNH_QGYFD4qQuc0hK-jJs5CzzO7Aah1-H_WK4v3e-z2Y1aesjVqsPvzATCnLxE6nzd3Xb1Guzdi6uzddj7f5NfcW5d3wmjtZh3J01QvCNr_ivpuogdnxuce5xz33HSqT1Ex2zlBQ8Sj22jFvh37b64SYlP_vbe3ACgd6dMougfTy-b_ST0FqgXz4w1uJHVSmeOPtYZ2JypQY6eOP80FuxjmGF2VaOkjz481rGLtk7JstmPx4MwHM6HA9ASQt2dbLTyDz4w1NyNHROVOZIckh9XMYjxZIsgVILKDMfZB-zAClsbuHfPhw15RjcfccFWt0ybaf_gMaL9n2k5eQD7-_ntHEvWGyuiKTW0zSBjRZgPoLFPUJqukWaHwCVX0O0r-znafvIx8e7tnMgPTqsq9jrZTWLRHLoBUGvU4r4oFoyTiVnlTS80RwJhGlCwi7hdo6qMlBnTqoCwdDvXJDHoXKE0E3jbXq8VCEoU4kjyOfcxGrHmp1D6QPoMp9FOU-BnQAe7uB1Q5sxTDSzZHOrG-bhzqztfQ22d_koJmbqj8TR6bqJzmDKA9Q6uaQijv2PlT1zHyaWj036yBk1cyF1M2cdMVQ3lld5l6sY8-PWqGfeq0ej3hLdBOvJUMddaLETwI_mBWn7IW1wM7X3_2CQbJylc97iYpC5Yedrkh97inV6QZKaBV0VdiFpQZktyCsgykt2XvpFRS0ZK8--BtSnMBmJ1DkQNSvQIwbiNsNpvmjlHI9IpW0lRlCmwZFtY3qrjPLTtmL849uXv_pzOdP_nSQqF_Z5kCVDYqywWf0M0M_u_fjXlHRkKZibfyNSlTJsxD0-DUfipbs0rfJ2Qb6v12FKvZhi4ufrGGQhYOMGLLk4l7IBvY_vbyoZ_YL9EsHMnPmMiudQ5mV2VfnJC2t3DRIfMV51Ot6QZQmXhBqlXaiMNZdwYMgQWWX9MeXb_4bAAD__2ZmDev_AwAA HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl26582471=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 2\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: a2cd10bdc2e0df0a9426e11ecb9c4082\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"robloxwatersplash.pages.dev/assets/css/stylesheet.a482bf00fa5c046040ef7973ad5fdf5657890cacb596c93f1382f664ca542074.css","fqdn":"robloxwatersplash.pages.dev","domain":"robloxwatersplash.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.45.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.345Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"robloxwatersplash.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Apr 2026 08:43:13 GMT","end":"Tue, 14 Jul 2026 09:41:01 GMT"},"fingerprint":{"sha1":"6F:C9:03:56:21:27:05:BF:C0:6F:19:75:6A:0D:95:4B:AE:E3:5F:A1","sha256":"8E:AA:DC:34:9A:45:35:5B:98:DF:2B:D6:78:EE:95:A5:07:38:AB:51:E6:89:3B:FA:74:BF:93:F8:56:BA:6E:38"}}},"request":{"raw":"GET /assets/css/stylesheet.a482bf00fa5c046040ef7973ad5fdf5657890cacb596c93f1382f664ca542074.css HTTP/1.1\r\nHost: robloxwatersplash.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:26 GMT\r\ncontent-type: text/css; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=2,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Aop2OdMMEM%2B6BKO0mlpKUWhBQfUv6rEHoWVQyjSgvK%2B3DFo%2FK0XMVrjz9RWxV4LlT5fVtMxl%2BVsme9x0OPv%2FbWcWHB4L9sUo3u3XkHyjyZgPGOjEbhL6MhmmTN1rtlTSpYRokVBQ9oc3%2BZ7eXoI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"53e05fd175c1632d3f6826cdf1c8006d\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ecb04cca972c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17668,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (17469), with CRLF line terminators","md5":"189fdafdfba1b07922505146944ac218","sha1":"e593713c0ec16032efdad79024e07b769cf999d7","sha256":"a482bf00fa5c046040ef7973ad5fdf5657890cacb596c93f1382f664ca542074","sha512":"78e5dfa85fe07a10600f8e1f0060db0b5aff6482bcd25850bdae13ff5579b248d15119e5fa200b836f5f0abc2fe0b9cb5bff43ee26bca7e40a9d96494bdf6a82","ssdeep":"192:pgLxsLb4X3I1fG2pmOTq7zSeyf5rTZFsGR57Vpvj82p7Y97F+QNBARfWiVWo6yyT:KyLb4eEbzSDBP9R5lKmRD723FRdZ","tlshash":"7e82757e9220263cfb33cc026689755d3614f963da5247f9fa99a3a885c2ff71171a0c","first_seen":"2025-10-29T04:02:15.901982Z","last_seen":"2026-08-05T18:54:41.266536Z","times_seen":407,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"adxpy.pages.dev/adx-mainstream.json","fqdn":"adxpy.pages.dev","domain":"adxpy.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"adxpy.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 05 Apr 2026 00:44:54 GMT","end":"Sat, 04 Jul 2026 01:43:34 GMT"},"fingerprint":{"sha1":"B9:0E:27:18:36:32:2C:B8:F2:E5:2F:50:96:88:4F:CF:54:4C:10:3C","sha256":"ED:9F:40:13:F5:DC:3F:FE:75:A2:AF:61:F4:2D:D7:17:14:E2:C8:D4:C5:19:DB:9E:88:D1:73:59:BF:13:F7:D1"}}},"request":{"raw":"GET /adx-mainstream.json HTTP/1.1\r\nHost: adxpy.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:26 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BAQfbnvYzRuldqefZ%2FxICJADQCwhQJPLNP8NG5o0Ae5d0oTEliBFk9c21VjDpS9AQe%2Fsw%2F1JYYGNxSYcWx1NGgFZZYxE%2FTdohjQ5R%2Ft2bBfFAvC%2BRTmIU%2Fj5DkIcYXLWa70%3D\"}]}\r\netag: W/\"7b49849f40013f93e7f062a5ea9f812c\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9ecb04d01b00b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1453,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"6ffbb69834723feb9c7113271b1c2ea2","sha1":"8bfa604b64d94fad6bbeaf5c580175e4001d4dc5","sha256":"46498f749be8fd2b102eb3563d490c7890b94ed1d0b5b133e2cc3c444ed048c2","sha512":"7b15f328c00533c83fa7c65fff45e5fff27b012955d49affd579a7c7eb14a66839822b50b7947d609d53e08419128bef2773fcb5bc6f95b77731662acf7cb001","ssdeep":"","tlshash":"f9319e999f1cf29410b24ad23c33e0bef598be063908dc9551dc9c6ac2a43e04d57666","first_seen":"2026-01-30T08:57:52.033645Z","last_seen":"2026-08-05T18:54:41.283035Z","times_seen":294,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":27,"dns":5,"connect":1,"send":0,"wait":25,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=1767\u0026rd=1767\u0026fd=529\u0026bv=26.3.5226\u0026tmpl=70","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:27.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=1767\u0026rd=1767\u0026fd=529\u0026bv=26.3.5226\u0026tmpl=70 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:27 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":668,"timings":{"blocked":285,"dns":1,"connect":92,"send":0,"wait":94,"receive":0,"ssl":193},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/sbar.json?key=c207ec84c2456af201cc563cadc36c46\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.099Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /sbar.json?key=c207ec84c2456af201cc563cadc36c46\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:28 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 3171\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://robloxwatersplash.pages.dev\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\nset-cookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; expires=Wed, 22 Apr 2026 12:40:28 GMT; path=/; secure; SameSite=None\npdhtkv=true; expires=Thu, 16 Apr 2026 12:40:28 GMT; path=/; secure; SameSite=None\nuncs=1; expires=Thu, 16 Apr 2026 12:40:28 GMT; path=/; secure; SameSite=None\npdhtkv29=true; expires=Thu, 16 Apr 2026 12:40:28 GMT; path=/; secure; SameSite=None\nuncs29=1; expires=Thu, 16 Apr 2026 12:40:28 GMT; path=/; secure; SameSite=None\nu_pl26582471=1; expires=Thu, 16 Apr 2026 12:40:28 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 19\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: f4a133f10cc5e75b1f621a96d3d721ba\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5175,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"JSON text data","md5":"9b34fca18b7c398a5151aa5c3ffb3d5d","sha1":"e06702f9c9085bad448e2ea78c4a6a51b34c992a","sha256":"b2afa8bf5c614d2785fee1777b897f732e32f63b0f00c75c8debf78612f66866","sha512":"f978967f5ac1b424a8ad9ba1fcc52b02a40b1925269bd6dfe9ef3126f2be41479633e788cdcc5e50900e133fa97de240750157703ab990b012229877a3de0a01","ssdeep":"96:9q2pOu3ttXQ4ROxxpOu3ttXQ4ROeUbpiEQn6i/8ufge4apCcHPykW6JU7fwN7Qm:9vOm3lEx/Om3lEBtBO6i0e4BoZaK","tlshash":"fbb15b3d2be4104569d38a6e092a8e7cdcab7d1b43582e05cdd9ebae06038c57ddf2d1","first_seen":"2026-04-15T12:40:55.076515Z","last_seen":"2026-04-15T12:40:55.076515Z","times_seen":1,"resource_available":false,"data":null}},"time_used":115,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":114,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kettledroopingcontinuation.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fjs%2Fscript.js\u0026l=962\u0026fd=464","fqdn":"kettledroopingcontinuation.com","domain":"kettledroopingcontinuation.com","tld":"com"},"ip":{"addr":"172.240.127.242","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kettledroopingcontinuation.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 21:44:44 GMT","end":"Sun, 24 May 2026 21:44:43 GMT"},"fingerprint":{"sha1":"4C:9B:DC:71:4E:6F:7E:04:5A:F2:21:54:DA:06:E8:A0:34:82:CB:86","sha256":"23:FF:1C:4C:C9:81:C7:C0:A0:EB:2B:81:77:68:85:F3:47:33:36:DE:71:C4:DB:B4:66:77:5F:24:24:B9:A7:89"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fjs%2Fscript.js\u0026l=962\u0026fd=464 HTTP/1.1\r\nHost: kettledroopingcontinuation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:32 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: kettledroopingcontinuation.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":662,"timings":{"blocked":283,"dns":1,"connect":93,"send":0,"wait":95,"receive":0,"ssl":187},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"links.mtevor.com/api.php","fqdn":"links.mtevor.com","domain":"mtevor.com","tld":"com"},"ip":{"addr":"172.67.199.161","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.547Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mtevor.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 27 Mar 2026 16:10:55 GMT","end":"Thu, 25 Jun 2026 17:08:44 GMT"},"fingerprint":{"sha1":"1D:90:33:9C:3D:4D:50:02:77:2C:32:67:1E:87:33:CC:BD:89:04:6D","sha256":"72:55:21:53:6A:A2:E9:F9:08:9D:13:A1:4F:FC:E2:CD:E9:5C:53:05:B8:B0:36:72:24:AB:FD:DA:7A:F9:7C:C4"}}},"request":{"raw":"GET /api.php HTTP/1.1\r\nHost: links.mtevor.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:26 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EjjgZFWXj8ZQKgu2CPyxha2YdHsOd%2Fj6C7XwBTDG72IpGSBztoASgnMhuxdu3bFvO6xbV2ATqjHHfmCW6Bcpc%2FfedAYJdZZKK3iIXxGg0wOUblpszSPlubowtpFfFkh6%2B5Sq\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9ecb04ce1d565693-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":130,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"461998897e9c2231eca77463e5cc6bae","sha1":"3be86b46e03a1cdb1810601986801983536ad507","sha256":"40f09c3ccff871ce64b9b2467e1cc8de58eca37bba1665f1889af384ad7c6331","sha512":"e8b618c96190f44eef4d07152be02d69e3973c5efaff02b0df5e1cb130e35e8e17d888cca47aab8a568a0689e5deb9750e3ac91379666720c3dfc3dfb0a11da9","ssdeep":"","tlshash":"97c02b43c04d802ed2ad34c0183d786d8603229a36430031211f40fd162a0b2827fa22","first_seen":"2026-04-15T12:40:55.078438Z","last_seen":"2026-04-15T12:40:55.078438Z","times_seen":1,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":23,"dns":4,"connect":1,"send":0,"wait":288,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preferencenail.com/sfp.js","fqdn":"preferencenail.com","domain":"preferencenail.com","tld":"com"},"ip":{"addr":"185.196.197.71","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:27.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"preferencenail.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 01:24:35 GMT","end":"Thu, 28 May 2026 01:24:34 GMT"},"fingerprint":{"sha1":"66:45:2B:BB:A2:6D:D3:A2:B6:16:36:65:94:BA:4A:C6:5E:05:66:09","sha256":"A4:2E:A7:56:DB:44:FF:55:9A:FA:4D:EC:2A:78:CB:C5:02:CD:CF:B2:FB:A7:A7:75:77:EC:01:DB:19:71:C0:77"}}},"request":{"raw":"GET /sfp.js HTTP/1.1\r\nHost: preferencenail.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:27 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 32181\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nP3P: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\nAccess-Control-Allow-Origin: *\r\nVary: Accept-Encoding\r\nHost: preferencenail.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 877e1f787f06684b53878e67387bff24\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85379,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators","md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-08-08T07:35:47.192337Z","times_seen":26038,"resource_available":true,"data":null}},"time_used":164,"timings":{"blocked":58,"dns":1,"connect":17,"send":0,"wait":24,"receive":18,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"preferencenail.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/css/animate.css","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.837Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/css/animate.css HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:29 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Thu, 15 May 2025 09:23:30 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"6825b292-1358d\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=560yTVY79PLp8HK9UqxWfxwrrX%2BUterqJSPt3UluOzyoyRl%2FyMoMDSZynp36GdIlvAjh4BXCxX7YVb4vAsbESOt8EDoLYr9aWDcpyJs0kMWZcobbPly%2BYNY%2B9y5WgV9skPS%2FBGxNi68%3D\"}]}\r\ncf-ray: 9ecb04dc6de50daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79245,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"80047eaa13ebd50c50e8a9753621e430","sha1":"9c503e07d130572a0eaf51f7c02cbd4cf6213fe3","sha256":"3f831a59615f8d5d40b4340b2836f91438c876f8dbce75f78e38360d6fe0f429","sha512":"79e76248a0afa1c1b4ee00dbe3cb6958d332ea2bc6247f9f15348c2d137cddc82d1b4aa1ff16b945d200b393ac25a75925ba5bb376b54157870e228b0ab77922","ssdeep":"384:ZFu8uVWgnu5uplFlH/O/Qu7u/sjzbg/jxXlIPfL4jKgZQMkL0Vvaj7Z:ZFu8uEgnu5uru7uhKgZQMkL0Vvaj7Z","tlshash":"12731fad2991148452638a1d83df8e68673ce573181a9cef73c2488bcf8bf9c67c9147","first_seen":"2023-04-05T09:22:06Z","last_seen":"2026-07-22T02:48:25.242857Z","times_seen":4296,"resource_available":false,"data":null}},"time_used":513,"timings":{"blocked":29,"dns":4,"connect":3,"send":0,"wait":453,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2FProgamer%2Fflip_icon%2Foct2024%2F3%2Fcss%2Fanimate.css\u0026l=79245\u0026fd=510","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2FProgamer%2Fflip_icon%2Foct2024%2F3%2Fcss%2Fanimate.css\u0026l=79245\u0026fd=510 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl26582471=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":91,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"immigrationacre.com/c2/07/ec/c207ec84c2456af201cc563cadc36c46.js","fqdn":"immigrationacre.com","domain":"immigrationacre.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:27.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"immigrationacre.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 22 Mar 2026 22:44:59 GMT","end":"Sat, 20 Jun 2026 22:44:58 GMT"},"fingerprint":{"sha1":"C5:C0:F1:09:DF:66:79:21:CE:6B:25:C3:DC:5A:3B:4E:6C:24:00:FD","sha256":"14:5E:A4:DE:46:F2:FF:8F:7D:14:D8:7C:E6:33:BC:41:57:AD:BF:24:AC:C4:3C:0F:A7:EE:34:BE:D3:48:56:5B"}}},"request":{"raw":"GET /c2/07/ec/c207ec84c2456af201cc563cadc36c46.js HTTP/1.1\r\nHost: immigrationacre.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:27 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 34687\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 3\r\nHost: immigrationacre.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 5f537e3c8ce487e6d8567be0971bee69\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":91777,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"6395d3d6def70922fe1c4bf8b5d93cec","sha1":"9898560eeaa010c2fa7318fbb42142eec89fee01","sha256":"210f291df3a952ab95a27f4aed5d4c0e139c547ebb77f592470d7c96f8573d5e","sha512":"8836f3bf2e8e8c5dfeed4ee45e1e52202c5dc708039446a08b05d61d6286b187be4bd64eac8ac6e5f67ed909f72843ff7e648b659279ff087e650495a488bb05","ssdeep":"1536:1sgv0NC4Y5Tll1apjTHlxn0WuXvon8USxNKo4hRl+GdLALWEf7J:agvA25lIpZxn0WuXvon8pCTLs7J","tlshash":"7793e8887fb272ed439a307b362fb006f22a5d512498f4f4d586b8e52e7876da437704","first_seen":"2026-04-15T12:40:55.081204Z","last_seen":"2026-04-28T22:10:41.12071Z","times_seen":6,"resource_available":true,"data":null}},"time_used":862,"timings":{"blocked":335,"dns":51,"connect":93,"send":0,"wait":98,"receive":94,"ssl":188},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"immigrationacre.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.show-creative1.com/sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/index.html","fqdn":"cdn.show-creative1.com","domain":"show-creative1.com","tld":"com"},"ip":{"addr":"104.21.15.229","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"show-creative1.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 03 Apr 2026 01:42:43 GMT","end":"Thu, 02 Jul 2026 02:41:28 GMT"},"fingerprint":{"sha1":"E5:DE:57:6E:2B:86:96:31:27:7E:74:48:4B:76:32:AA:86:9A:48:06","sha256":"9A:F1:DF:30:DB:8E:88:16:44:D7:78:1A:9B:36:AB:CD:11:72:FF:FC:89:21:83:88:2D:A7:D7:CF:92:F1:49:CB"}}},"request":{"raw":"GET /sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/index.html HTTP/1.1\r\nHost: cdn.show-creative1.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Thu, 05 Jun 2025 16:29:02 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k04VMwpNpZ3AKtuUzQWxweSpnlVterdvBZq3x5A8dMdw4pBShYWwiQOZhzRiVDVXlni9elY%2F8uhOGINENcOqaOwrnREEZooOrhx%2BzlMgSh3cBodUZjUXSG51T5Z4%2Fk8%2BpNKByVHqPRoL\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9ecb04d89edb4e4c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1711,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"ff393717030c83258188be56d47bb367","sha1":"d5a6a58ba15a35e986f8508b91388653a155ba4a","sha256":"eb38157ffd457dd5bf0d01310f6514cfbfe3e1fafa98a4fda80c9ed7791a508c","sha512":"184886e529b52030296b0ee0f989ac81d4d242811c01842291ccecf1ee2f85f7579f0a75c005d14f4d9ea4a7f00e16ab4e84836834005009ea27819628ead3ee","ssdeep":"","tlshash":"d331588a3ae8e47102d24697bf317f1add83e44b9d0a201073ed4a59afd5e90ca1330b","first_seen":"2025-06-13T16:42:44.076375Z","last_seen":"2026-07-06T14:19:55.87085Z","times_seen":153,"resource_available":false,"data":null}},"time_used":563,"timings":{"blocked":21,"dns":3,"connect":1,"send":0,"wait":519,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-creative1.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-creative1.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.show-sb.com/sb/au/0c/c8/e1/0cc8e13ba9d5dbc867b982993e805a9d/1632728593.html","fqdn":"cdn.show-sb.com","domain":"show-sb.com","tld":"com"},"ip":{"addr":"104.21.95.140","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:30.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"show-sb.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 04 Apr 2026 00:48:28 GMT","end":"Fri, 03 Jul 2026 01:44:30 GMT"},"fingerprint":{"sha1":"21:8F:F6:2A:0C:60:8F:CF:6C:90:BD:69:DB:F8:82:BF:D5:02:9E:2A","sha256":"20:0D:6D:8F:30:A5:C6:F8:45:FA:9B:D0:D8:76:12:30:CC:08:8F:44:47:0D:A2:CA:80:14:E3:AA:E1:AF:EA:5F"}}},"request":{"raw":"GET /sb/au/0c/c8/e1/0cc8e13ba9d5dbc867b982993e805a9d/1632728593.html HTTP/1.1\r\nHost: cdn.show-sb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:31 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Mon, 27 Sep 2021 07:43:24 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hdu84CeN84r8KTPZg9McLjDfnGpPNHY4MeRDx7RbW%2BurYy8XJk6C2JZrKrDjL7kKN5eXVxvW%2Far4DT3CA8x72ig9w%2FmjlAbpIFxcPcH33jWt6eonfpJKlwxF8LB9Uv4amCE%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9ecb04e6f8041525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":1325,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"f6990569c7ffeac1f4a3f6d9eee5da44","sha1":"e7d5e37acf89a8faee252c36fc2c9d6615501d76","sha256":"cc2a9756c81bd570fff8b32e48a413687c33f8abe9c934e743a0769178b4f690","sha512":"be3ebced9d65b29fef8caab46e95f54f1ca645ea5942331c84c964ec033fb7c78506d14eda131948b7f664f1635deaa8d82a63169f9214f72035b087ea104bda","ssdeep":"","tlshash":"a52105692df9c97311e750947b352f1bed92ea87c80a6e0173bc9d684f9ad84cd23407","first_seen":"2023-06-26T22:59:31Z","last_seen":"2026-08-08T04:08:50.855521Z","times_seen":3712,"resource_available":false,"data":null}},"time_used":569,"timings":{"blocked":25,"dns":6,"connect":1,"send":0,"wait":518,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"cdn.show-sb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kettledroopingcontinuation.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fstyle.css\u0026l=3355\u0026fd=475","fqdn":"kettledroopingcontinuation.com","domain":"kettledroopingcontinuation.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.604Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"kettledroopingcontinuation.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 23 Feb 2026 21:44:44 GMT","end":"Sun, 24 May 2026 21:44:43 GMT"},"fingerprint":{"sha1":"4C:9B:DC:71:4E:6F:7E:04:5A:F2:21:54:DA:06:E8:A0:34:82:CB:86","sha256":"23:FF:1C:4C:C9:81:C7:C0:A0:EB:2B:81:77:68:85:F3:47:33:36:DE:71:C4:DB:B4:66:77:5F:24:24:B9:A7:89"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.nightdestruct.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fstyle.css\u0026l=3355\u0026fd=475 HTTP/1.1\r\nHost: kettledroopingcontinuation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:31 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: kettledroopingcontinuation.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":423,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"kettledroopingcontinuation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"protrafficinspector.com/stats","fqdn":"protrafficinspector.com","domain":"protrafficinspector.com","tld":"com"},"ip":{"addr":"3.72.196.114","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:27.604Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"statistics.it.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Tue, 14 Apr 2026 00:00:00 GMT","end":"Wed, 28 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"8F:66:77:D7:9E:99:80:D4:C4:22:4B:79:2F:16:2B:49:2C:08:07:99","sha256":"54:26:39:E0:45:11:B3:20:EE:6C:3E:B3:C0:57:5D:F2:28:8C:E0:E1:C4:F0:BD:56:E7:8C:91:6B:40:CC:0E:0D"}}},"request":{"raw":"GET /stats HTTP/1.1\r\nHost: protrafficinspector.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 40\r\nserver: fasthttp\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://robloxwatersplash.pages.dev\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\nset-cookie: uid_id2=1c186b02-61aa-47ab-8cf5-4a85cf7330db:1:1; expires=Sat, 12 Apr 2036 12:40:27 GMT; secure; SameSite=None\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"9e2197022cfbfd05960af21af13ec03b","sha1":"ffc157de2e7210079257f0be1ed87af00fc7a7a7","sha256":"f5c81043da24ea1dcc1696150519d416ab942fb676c45496ae00e7818b96efd3","sha512":"be1935d7bcaf79c8923869bc69b5bec747b50d9485210d519d3861f300d4057441c8d41840eff317777e843bc6c3a198d8d2e846098e27efe196ead61028fe7a","ssdeep":"","tlshash":"df90045f10c5050fc4140550140504c34070d015001100547cc4c401dc3d0d175d4ccf","first_seen":"2026-04-15T12:40:55.084231Z","last_seen":"2026-04-15T12:40:55.084231Z","times_seen":1,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":108,"dns":10,"connect":21,"send":0,"wait":21,"receive":0,"ssl":82},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.show-creative1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2FProgamer%2Fflip_icon%2Foct2024%2F3%2Findex.html\u0026l=1711\u0026fd=554","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.127.243","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /pixel/sbls?bv=\u0026tmpl=482\u0026u=https%3A%2F%2Fcdn.show-creative1.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2FProgamer%2Fflip_icon%2Foct2024%2F3%2Findex.html\u0026l=1711\u0026fd=554 HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; u_pl26582471=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:28 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccept-Ch: Device-Stock-UA, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-PlatformUser-Agent, User-Agent, X-Device-User-Agent, X-OperaMini-Phone-UA, X-UCBrowser-Device-UA\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/js/script.js","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/js/script.js HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:29 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Thu, 15 May 2025 09:23:34 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bU8GhmY7FU4a9bp8WZROh8Wwryn1V0LGrRpbuS50pgz%2FWx0fnpQQ6AU4MWGhTnaJZWOi%2Bi7W6gDFVbug2UfZWynSVAh9MLUxcXm2E6Y31fqeTKga0cb7h9Ja6eSbYG0FvTnmWw2M%2FNk%3D\"}]}\r\ncf-cache-status: MISS\r\netag: W/\"6825b296-1bd\"\r\ncontent-encoding: br\r\ncf-ray: 9ecb04dc6ddc0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":445,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"aaea974c4b82bbc952ae3de1d6302425","sha1":"8fe1d7928b3b0d234e22d1f7a83c2fa611ceab77","sha256":"0652d9a42ce8605bbf9e3e88d0f533cefc3e74f90448f9e00d960bd26a52cdce","sha512":"8f5c6c0155645a8a091c064e68ade1af77c59f7f8561eea80185c44434b844787b3eca6b6368e8009c283d861a0290b9758a0d6411027662f598151230e351b1","ssdeep":"","tlshash":"43f02714d16d513486bb52a3739b07ef29b102aed40a809e311c874f18b1da226c196f","first_seen":"2023-12-22T12:44:21Z","last_seen":"2026-07-22T02:48:25.189561Z","times_seen":665,"resource_available":false,"data":null}},"time_used":654,"timings":{"blocked":26,"dns":4,"connect":3,"send":0,"wait":599,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/img/close.svg","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:28.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/notifications/utility/default/us/blog/Progamer/flip_icon/oct2024/3/img/close.svg HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:28 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Thu, 15 May 2025 09:23:32 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E%2BDmplTgyKa%2BDBKNrMW2on92NPXnD9Jf0zMRWNPNsXjoYHoR1ID7DzMH5Dw0R56p73DofWBeVGPECpzS1jVb5BlESmDrndxRDVbNWRLQKYmXpGVRFJAV0cbX%2Fk5azu9Ld%2Bqz61rWglw%3D\"}]}\r\nage: 1361433\r\ncf-cache-status: HIT\r\netag: W/\"6825b294-415\"\r\ncontent-encoding: br\r\ncf-ray: 9ecb04dccf050daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1045,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"26dd89033221449321cb8c527a691faf","sha1":"983f7411316deafd84c8cd91fae81b54b583771a","sha256":"f753b8837c88daa22f91f3fa6d73148ec95ae850b821e0d21c86dcbe30be6733","sha512":"35e67782deb6b4c8d55e26035f7dbbcc7285503b72816475010b48f7c85eeb5ecc6f8d344e1ffe93b80784265febe939199571a9f2edae2cac332e7b7949b05c","ssdeep":"","tlshash":"b311cccc416f061e29713e28deeb808297a882f5e0bc87f4f905c86ebd0bf8518d1664","first_seen":"2023-12-07T20:21:44Z","last_seen":"2026-07-22T02:48:25.240926Z","times_seen":678,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/ssp/vpn/classic-push/small/css/animate.css","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.127Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/ssp/vpn/classic-push/small/css/animate.css HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:31 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Fri, 19 Jan 2024 14:19:42 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"65aa84fe-13361\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qzJjye4GIcchR4n2EKDJ99D0bf07%2BRXm6fw%2Fk%2Bdq3XHywMGq%2F5TVQ8NvFDx16Hsm8f0UuGaLQ29qhRRP1MkHJ5l4SJcmZOcZfr5xcp9gR1FjYdKG9nnVCVmpDR3IAR6%2F78zeSnAHlZ8%3D\"}]}\r\ncf-ray: 9ecb04ea8dee0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":78689,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"3d4123dbfb33d27a5cfdfcfa91df6783","sha1":"e7d0eeeec54b848f0bc3da8685fa3bc88429d660","sha256":"cb7d1393b65701b2f97d8da244c2c6023e9cbc3463ecb0136b915cfc775c6887","sha512":"75c8a48dc207595e201b50b87ff68782112a21aded9f15f14185c07d40f0151d6afe74a2b278aa575caf12ac422e8166316296ed7b6573ea24e667cca4af51dd","ssdeep":"384:jvuAuF81dghu3ublZlX/m/Gu7uNUtrL4VrbZJgBhLYNKwZiMUL6Vpaj7F:jvuAu21dghu3uLu7uNKwZiMUL6Vpaj7F","tlshash":"22731bad399115845263861d83df9e68273ce5731826acef73c2488bcf8bf9867c9147","first_seen":"2024-01-20T06:37:31Z","last_seen":"2026-08-08T06:32:20.295649Z","times_seen":13205,"resource_available":false,"data":null}},"time_used":566,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":566,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wayfarerorthodox.com/impr.gif?sid=H4sIAAAAAAAC_1RSvY_bZBx-nXYDhPgQG8jDDVQiufe1ncSmEhUVBfF1B7SoAwN6P-y7lzi269dO0jDQUigDEjo2yuQ8yd0xnCr4D1CO7QQS3jL0GJiYkSqxoeQiFZ7h9-HnGZ6f3-fupDwlLZR88d676VjHMd9st6j94nWdqHRo7K1rNqMtetG-rpOOd9EeLUs-eJm5XotesN8IZS_ddCijlFFmv67zMEpHmysWOjsKWCugLc9psbaHUf7_3ZQNGN6AGpySp6FV_eSf0UfQco6k_-NroekVafbSlX4Z8yLNMVCHHya9JB0m6D8ao9xClByu1UhNTch3DaTJ4foCpIPZ8gIIXZPGcw8gksO1TYjB_plTESNMINRjGA7mCOM5NJ9Dpneg1e8EkApb20j6B1tpPuQ3z1i-ZGty_uHf0MOanH_wLJL-_cuxHtlX07gsdJoYjKIKejSH3pkjK49RjBvQw2PI4nNo9RvZfPgOkv5s28QptFpsOCpQUirV5IFwm57bbTd96vKmCCLBhBSMcXf1i3Q0BzcNlMZCqS2UkYUys9BXC9ujvicZdztRoGSXetzzVCho4DuU8kB2Ucrb0GoPMv9yVibSTNgPmdotegMnmBV5GR4sPzrBhB2VH2ex02n7jtdlE3ZwplppkOW30NN7MLsVjDoHU9TEev8zDFS1r2LjmOpAxaYUbN2ddXeraVrsTPh-WuyECQHP95CraqazG-YOZHFuOo6MmqbLwkVRTblQ1VSrgiC_sdigLFABc_ymJ1in2ZUubYquYE3a5a4XBVG7y9kkOyVPLV_Huv_NE-iFC5tHTltx3_VZSIWiXuAJ7lHmy27HD3zuwOgK2jTAjYWxrsnb0QVkuiYv3P0Lgh_DxMeQ2gIvnwcfVuC7FcbJUaQTNdAybMm0D5VWyIrzKG5ak_iUPDP94Nrln1chefWfewjlyaXFvSW-h8wrZHmFT_QvBDvx7Z-2s0L39ZgvU3O14EV4DlzXxPr0V0hdk8ffurIK8MabX0Nmt2Cyk0vH7gowKYHILMSaIA5PyBrgooL5zy4ezRPzBXZyCyK2piLOrZmI8_jbM5tGL-zIDR1Jqd_tMNePQuZ6SkZt3wtUh1PXDVGYWv_x1Sv_BgAA__8S_dIiPgQAAA==","fqdn":"wayfarerorthodox.com","domain":"wayfarerorthodox.com","tld":"com"},"ip":{"addr":"172.240.108.76","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.129Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"wayfarerorthodox.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:35:17 GMT","end":"Thu, 28 May 2026 00:35:16 GMT"},"fingerprint":{"sha1":"17:4A:E8:7A:8D:4C:22:69:70:30:C3:3D:6A:72:7A:68:E9:D2:3C:83","sha256":"0D:06:FA:1C:4D:9B:7A:47:4C:58:29:3B:40:85:C2:D1:F6:2B:AE:C5:66:2E:53:32:27:48:B1:F2:5C:2C:A7:A1"}}},"request":{"raw":"GET /impr.gif?sid=H4sIAAAAAAAC_1RSvY_bZBx-nXYDhPgQG8jDDVQiufe1ncSmEhUVBfF1B7SoAwN6P-y7lzi269dO0jDQUigDEjo2yuQ8yd0xnCr4D1CO7QQS3jL0GJiYkSqxoeQiFZ7h9-HnGZ6f3-fupDwlLZR88d676VjHMd9st6j94nWdqHRo7K1rNqMtetG-rpOOd9EeLUs-eJm5XotesN8IZS_ddCijlFFmv67zMEpHmysWOjsKWCugLc9psbaHUf7_3ZQNGN6AGpySp6FV_eSf0UfQco6k_-NroekVafbSlX4Z8yLNMVCHHya9JB0m6D8ao9xClByu1UhNTch3DaTJ4foCpIPZ8gIIXZPGcw8gksO1TYjB_plTESNMINRjGA7mCOM5NJ9Dpneg1e8EkApb20j6B1tpPuQ3z1i-ZGty_uHf0MOanH_wLJL-_cuxHtlX07gsdJoYjKIKejSH3pkjK49RjBvQw2PI4nNo9RvZfPgOkv5s28QptFpsOCpQUirV5IFwm57bbTd96vKmCCLBhBSMcXf1i3Q0BzcNlMZCqS2UkYUys9BXC9ujvicZdztRoGSXetzzVCho4DuU8kB2Ucrb0GoPMv9yVibSTNgPmdotegMnmBV5GR4sPzrBhB2VH2ex02n7jtdlE3ZwplppkOW30NN7MLsVjDoHU9TEev8zDFS1r2LjmOpAxaYUbN2ddXeraVrsTPh-WuyECQHP95CraqazG-YOZHFuOo6MmqbLwkVRTblQ1VSrgiC_sdigLFABc_ymJ1in2ZUubYquYE3a5a4XBVG7y9kkOyVPLV_Huv_NE-iFC5tHTltx3_VZSIWiXuAJ7lHmy27HD3zuwOgK2jTAjYWxrsnb0QVkuiYv3P0Lgh_DxMeQ2gIvnwcfVuC7FcbJUaQTNdAybMm0D5VWyIrzKG5ak_iUPDP94Nrln1chefWfewjlyaXFvSW-h8wrZHmFT_QvBDvx7Z-2s0L39ZgvU3O14EV4DlzXxPr0V0hdk8ffurIK8MabX0Nmt2Cyk0vH7gowKYHILMSaIA5PyBrgooL5zy4ezRPzBXZyCyK2piLOrZmI8_jbM5tGL-zIDR1Jqd_tMNePQuZ6SkZt3wtUh1PXDVGYWv_x1Sv_BgAA__8S_dIiPgQAAA== HTTP/1.1\r\nHost: wayfarerorthodox.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; pdhtkv=true; uncs=2; pdhtkv29=true; uncs29=2; u_pl26582471=1; u_pl28216845=1; slecaf25da8381e0bd0494ba4018c76898a2=[4323737]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:32 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nvary: Origin\r\naccess-control-allow-credentials: true\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nset-cookie: iprc_l+1d3b0058ee218c18b0d653686c5d381b=4323737; expires=Thu, 16 Apr 2026 12:40:32 GMT; path=/; secure; SameSite=None\niprc_l:4323737=1; expires=Thu, 16 Apr 2026 12:40:32 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 3\r\nHost: wayfarerorthodox.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: b8afe59b5f34b434ad4ea5d3024d48b0\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T08:24:30.782847Z","times_seen":17775817,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"wayfarerorthodox.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tse1.mm.bing.net/th?q=roblox%20water%20splash\u0026w=720\u0026h=405\u0026c=5\u0026rs=1\u0026p=0","fqdn":"tse1.mm.bing.net","domain":"bing.net","tld":"net"},"ip":{"addr":"150.171.27.10","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:26.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.mm.bing.net","organization":"Microsoft Corporation"},"issuer":{"commonName":"Microsoft Azure RSA TLS Issuing CA 08","organization":"Microsoft Corporation"},"validity":{"start":"Fri, 16 Jan 2026 20:53:59 GMT","end":"Wed, 15 Jul 2026 20:53:59 GMT"},"fingerprint":{"sha1":"43:D4:A4:95:21:DC:0D:A3:06:7E:03:A8:B5:A1:A3:CB:B6:7E:0E:E2","sha256":"D8:DF:DA:05:F7:F0:D9:76:56:FE:7F:5C:2C:B4:67:32:65:D8:35:54:65:58:31:A8:57:CF:6C:81:84:D2:C5:BF"}}},"request":{"raw":"GET /th?q=roblox%20water%20splash\u0026w=720\u0026h=405\u0026c=5\u0026rs=1\u0026p=0 HTTP/1.1\r\nHost: tse1.mm.bing.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: public, max-age=5184000\r\ncontent-length: 42743\r\ncontent-type: image/jpeg\r\nx-cache: TCP_MISS\r\nhttpcacheability: 4\r\nx-resolved-thumbnail-id: OIP.q1-jO3oF8obHRTn84WIrqwAAAA\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\ntiming-allow-origin: *\r\nreport-to: {\"group\":\"network-errors\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://aefd.nelreports.net/api/report?cat=bingth\u0026ndcParam=nadatio\"}]}\r\nnel: {\"report_to\":\"network-errors\",\"max_age\":604800,\"success_fraction\":0.001,\"failure_fraction\":1.0}\r\nx-powered-by: ASP.NET\r\naccept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version\r\nx-msedge-ref: Ref A: 6DE2F0DC0F734792A236C88677D1D7D7 Ref B: OSL231050214054 Ref C: 2026-04-15T12:40:26Z\r\ndate: Wed, 15 Apr 2026 12:40:25 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":42743,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 717x405, components 3","md5":"83e1230c5291ee0b164a5b858e63df30","sha1":"1a33b068bc864cb2111000be9d12589e5714738b","sha256":"05050e98477269e5df27bb1594a111764cb251d18e9bd6701165e9e32d7d2c05","sha512":"2f350aea49af3157765ef676a6794c85eeb9078861661389b001ae5fb7fae7d4844c170d03df920db077f49f528cea3eb91b45cc7134f858bbb384fea545fc7c","ssdeep":"768:wpC1SqWw5UcsDfpU0O/p8V4Bli0gy5MsKElSrGuk:wuSqJfUBU0I8V4BLgwMsKZaH","tlshash":"c213f1321a559b49e1b510d15cef83a3b59643e82f11731efe8ece133b522c198f6c99","first_seen":"2026-04-15T12:40:55.087634Z","last_seen":"2026-04-15T12:40:55.087634Z","times_seen":1,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":12,"dns":3,"connect":1,"send":0,"wait":42,"receive":2,"ssl":8},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.nightdestruct.com/sb/ssp/vpn/classic-push/small/css/style.css","fqdn":"cdn.nightdestruct.com","domain":"nightdestruct.com","tld":"com"},"ip":{"addr":"104.21.49.67","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:31.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nightdestruct.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 30 Mar 2026 16:21:26 GMT","end":"Sun, 28 Jun 2026 16:21:25 GMT"},"fingerprint":{"sha1":"77:BA:39:E3:87:1C:89:74:C5:36:C2:0F:E9:4C:0E:35:C4:92:A6:BA","sha256":"5F:17:E6:F7:42:E9:5F:B9:9E:03:47:36:9F:79:03:3B:E2:C2:66:ED:E9:3D:14:AB:29:B0:52:4A:62:57:C4:91"}}},"request":{"raw":"GET /sb/ssp/vpn/classic-push/small/css/style.css HTTP/1.1\r\nHost: cdn.nightdestruct.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nOrigin: https://robloxwatersplash.pages.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 15 Apr 2026 12:40:31 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Fri, 19 Jan 2024 14:19:42 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"65aa84fe-d1b\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: public, max-age=315360000\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Date\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FUk36e0oNAam4MoKFQamM2Ljcqg0YemLstZaWEPbtjrnoQFFT%2FvMS%2FRGLjgVLRelrZioPlpY0LBfXCWvFMWDN75VcEe4ibhJn3FehQWbdUsWRrSJ8et0VIoEm1qwBF7nStMXfSuET6M%3D\"}]}\r\ncf-ray: 9ecb04ea9dff0daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3355,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"039a6734d79ed9aa51cf81c52479c5fe","sha1":"9cf29c4ea1a3880681d50c7228374f8073b7778b","sha256":"a15bad73fc8907795285b78a4a1a1bf5e7f68b4d39988b9bb165444819cf9eb1","sha512":"879f067d02f582c2ff8f9c0308cbb44b24964136c4d8074f1a1b200169b520bb49fdd2b290772dfbc3ca432fba2ce9d5b1a398eb14746613cc942dd7567fa1d9","ssdeep":"","tlshash":"3a61ba966b670a04b51ad0ab3f667b4723084007995fed757fc8620ccfc92a8d6d378e","first_seen":"2024-02-12T03:25:01Z","last_seen":"2026-08-08T04:08:50.849317Z","times_seen":3459,"resource_available":false,"data":null}},"time_used":460,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":459,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/watch.124076308138.js?key=52f212bca95373aed7ead32398143db7\u0026kw=%5B%221%22%2C%22new%22%2C%22message%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1\u0026shu=5d031bc56e75c31f00536b22eaf150d3f9ce4e5f0b3d217f6c4ecc29b351f861507d443bcce276b6af0376669d321059e21b759036ed75ae5682fa7e929fccaa4595dc14d075b9a293057fbd1f8398dc4c1468b63129aa95e0147c\u0026pst=1776256892\u0026rmtc=t\u0026shv=1\u0026sht=QIuIyqGDkieOTPWAjoUw7tU-pJ_5aNCvJAuFi7RNpd4\u0026fstu=019d9128-52df-77d5-a78e-dc11c124b89e\u0026st1=3f010d8c8315716cc0b1567e5c539c37\u0026ps1=1776256832","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:32.279Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /watch.124076308138.js?key=52f212bca95373aed7ead32398143db7\u0026kw=%5B%221%22%2C%22new%22%2C%22message%22%5D\u0026refer=https%3A%2F%2Frobloxwatersplash.pages.dev%2F\u0026tz=0\u0026dev=e\u0026res=14.3095\u0026rb=\u0026uuid=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3%3A2%3A1\u0026shu=5d031bc56e75c31f00536b22eaf150d3f9ce4e5f0b3d217f6c4ecc29b351f861507d443bcce276b6af0376669d321059e21b759036ed75ae5682fa7e929fccaa4595dc14d075b9a293057fbd1f8398dc4c1468b63129aa95e0147c\u0026pst=1776256892\u0026rmtc=t\u0026shv=1\u0026sht=QIuIyqGDkieOTPWAjoUw7tU-pJ_5aNCvJAuFi7RNpd4\u0026fstu=019d9128-52df-77d5-a78e-dc11c124b89e\u0026st1=3f010d8c8315716cc0b1567e5c539c37\u0026ps1=1776256832 HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://robloxwatersplash.pages.dev\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoyNjU4MjQzNiwiayI6IjUyZjIxMmJjYTk1MzczYWVkN2VhZDMyMzk4MTQzZGI3Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjo0OTQxMzUzLCJwaWQiOjIwMDA2MTcsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MSwiYWlkIjozMiwicHQiOjQsInBrIjoienZlNHhhcmlwciIsInQiOjF9LCJ1Ijp7InUiOjIsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJjdCI6eyJpZCI6MzE0MzI0NCwibiI6Ik9zbG8ifSwicmciOnsiaWQiOjE4NDQsIm4iOiJPc2xvIENvdW50eSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsIml3ZiI6dHJ1ZSwidXAiOnRydWUsInIiOiJodHRwczovL3JvYmxveHdhdGVyc3BsYXNoLnBhZ2VzLmRldi8iLCJ0eiI6MiwiaWR1YyI6MCwiYXIiOltdfX0._1j0wHRp9g_zV2AXC4EDonaO37A32l2nvmJKFh42GZ8; pdhtkv=true; uncs=1; pdhtkv5=true; uncs5=1; u_pl26582443=1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:32 GMT\r\nContent-Type: text/html\r\nContent-Length: 2923\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\naccess-control-allow-origin: https://robloxwatersplash.pages.dev\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\nset-cookie: uid_id2=2d9dccdd-a9b3-4375-803a-b9fb1bcb11a3:2:1; expires=Wed, 22 Apr 2026 12:40:32 GMT; path=/; secure; SameSite=None\nuncs=2; expires=Thu, 16 Apr 2026 12:40:32 GMT; path=/; secure; SameSite=None\npdhtkv32=true; expires=Thu, 16 Apr 2026 12:40:32 GMT; path=/; secure; SameSite=None\nuncs32=1; expires=Thu, 16 Apr 2026 12:40:32 GMT; path=/; secure; SameSite=None\nu_pl26582436=1; expires=Thu, 16 Apr 2026 12:40:32 GMT; path=/; secure; SameSite=None\r\nx-envoy-upstream-service-time: 20\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: e763d47ac66f9a01fa4a5095ccf6dd3d\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":4422,"size_decoded":0,"mime_type":"text/html","magic":"JavaScript source, ASCII text, with very long lines (3546)","md5":"824b9ef0cf735cc05228256a5647605c","sha1":"b047624c27ec33d277eb702a046166e982014cea","sha256":"202c5ac80bf0259b6764b5609ace9860572cf9d0974fb92e7a8328198c6519cd","sha512":"a6967b2891194d3b17d0412cda5a3d17fe7e6cb1123bb7a52995ab24423f025bd35371a8f20879fdf0086fcfaf9b28b7768f7a4ba1033486f2ab6c42de279043","ssdeep":"96:QPoz03BCHHhcfxs3Djx4439qHk/wTzQzLG/cwENK+3vfBMru1ZDSV3VCfMEDaH:QQzCIhx3DaKgHkEoG/cXKm9VSV3VCkCM","tlshash":"4d913b7d9da908a874bb30bf246a65597c52a117b050c983f98cd6819b31bb00efadc6","first_seen":"2026-04-15T12:40:55.089586Z","last_seen":"2026-04-15T12:40:55.089586Z","times_seen":1,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":117,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sourshaped.com/af/25/da/af25da8381e0bd0494ba4018c76898a2.js","fqdn":"sourshaped.com","domain":"sourshaped.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://robloxwatersplash.pages.dev/","date":"2026-04-15T12:40:29.169Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sourshaped.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 00:01:03 GMT","end":"Thu, 28 May 2026 00:01:02 GMT"},"fingerprint":{"sha1":"F1:AF:5D:36:35:F4:F3:93:55:9A:8D:70:8F:C7:F5:6B:E2:26:FB:8E","sha256":"D3:58:1D:7D:AD:70:61:0C:FF:96:A1:79:6D:1D:A0:CF:58:59:D3:71:56:63:92:64:9D:FF:B5:46:E7:65:17:11"}}},"request":{"raw":"GET /af/25/da/af25da8381e0bd0494ba4018c76898a2.js HTTP/1.1\r\nHost: sourshaped.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://robloxwatersplash.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.21.6\r\nDate: Wed, 15 Apr 2026 12:40:29 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 34684\r\nConnection: keep-alive\r\ncontent-encoding: gzip\r\np3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"\r\naccess-control-allow-origin: *\r\naccept-ch: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA\r\nx-envoy-upstream-service-time: 8\r\nHost: sourshaped.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 334c7e8e2834695b6891b03b9327dfbc\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91790,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"93c1ee2a8aadd74b43857527c887bef5","sha1":"536409db2542c14ba56b08b342181fab7dcdfc7c","sha256":"ee6d2ba375d70ddc885e23d42cd9c36e0d9872a85c2b23acd48a0abd1c82fb37","sha512":"8c4f118ff850a9fe147164a8f4487128506c4824ce59137a092234a3fd14731c9d4fbdf9fff4ef55437321d6a4187de044d1d27bef72e5497dfa4c4b8a5f0b0c","ssdeep":"1536:1sgv0NC4Y5Tll1apjTHlxn0WuXvon8USxNKo4hRl+GdM9LyEf76:agvA25lIpZxn0WuXvon8pCTM976","tlshash":"5293e8887fb272ed439a307b362fb006f22a9d512498f4f4d586b4e52e7876da437704","first_seen":"2026-04-01T14:54:57.545551Z","last_seen":"2026-04-15T12:40:55.091294Z","times_seen":2,"resource_available":true,"data":null}},"time_used":767,"timings":{"blocked":280,"dns":0,"connect":92,"send":0,"wait":104,"receive":96,"ssl":191},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-15","alert":"Sinkholed","trigger":"sourshaped.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}