{"report_id":"e24203e3-2fe0-4798-8743-04af4e42c91e","version":6,"status":"done","tags":[],"date":"2026-02-13T21:55:17Z","url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"104.21.14.249","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"title":"Bloom Sniper","dom":{"size":133151,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (27307)","md5":"ed1786df7482ba362b3ba63d5c5f2f8a","sha1":"a9fb7346f21e2594de9487a7df4a0937f12d5600","sha256":"2e6da13d1f2373b9df1b5ee13887af4a97fb25055038d759b506dd90aedf5c44","sha512":"54bde8b91d393e760203f7f5fe52cc0c73dbc7b143f6e7566a6eaf696080aacff450416e2c23139edeb8a85b60ce41c37d6d683b512e6ded3b3dbe707936be4e","ssdeep":"1536:cthMhwtxq3frHWKReGWGuWWW2LTzn6I/h95bFZs0YC:cthMhwjh95b4C","tlshash":"0ed30859657320009a5b88f6afeb3b163658a183d50bcdf83bec85489fcaed585d370c","dom_hash":"domhash1e1b893b5d0df74dbf11ab3e45a23729","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"104.21.14.249","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-20T21:55:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"bloom-bot.click","ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-01-28","domain_rank":0,"first_seen":"2026-02-13T13:42:58.722191Z","last_seen":"2026-02-13T13:42:58.722191Z","alert_count":11,"request_count":11,"received_data":1030025,"sent_data":5197,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"gethyperdash.xyz","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-12-09","domain_rank":0,"first_seen":"2026-02-13T13:42:58.720419Z","last_seen":"2026-02-13T13:42:58.720419Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":420,"comment":"","tags":null,"fingerprints":null},{"fqdn":"i.postimg.cc","ip":{"addr":"46.105.222.81","port":443,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"domain_registered":"2016-06-11","domain_rank":103883,"first_seen":"2018-04-11T10:01:12Z","last_seen":"2026-02-11T20:40:39.324952Z","alert_count":0,"request_count":1,"received_data":68892,"sent_data":453,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a3bf0c44b7216aa187cf865bcbc43989","sha1":"41285b7ce387f256559882f1d1fc6ebe614f777d","sha256":"76254b571f224fd51e964be188112b3dbbb73e490c45eb7e3d8fc66950230e88","sha512":"ff37b4be802d02e9801fcc427392bca49d8a71b49556127984cd570e821f5af273c167edfb26276c13d8475dfbd1aad3b879e60c8281e4455d70fd411d67a40c","ssdeep":"192:hjJmhsXNNOE5RIb+YKyjkyY/fyBthKO7keCmAySr:hjJLHO68+bTfBO7keCmAD","tlshash":"4ee187e197979c9406d5e085fd3736119232b1ab301eb088b78d78df7829e8d9227f74","size":7369,"data":"","first_seen":"2025-08-25T15:23:52.701786Z","last_seen":"2026-03-28T00:21:55.258512Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f489e0afda5275a7d9ab46da5be71231","sha1":"013bc7c1cbf3b7a560b908448727f027412963e5","sha256":"a2f2d8f8bce5b98e9d7f03155f07f8eae0da896d13ebb39c6d72cf004c6c8949","sha512":"a85a13fe1e3e384340b5d8aead509394b97f61573c679e42f5e4c212b34559a49cdc2e15a660cad1258c3a7b4d3be90ad472f0684606a93b2fc0050d9637aded","ssdeep":"","tlshash":"e63162c83682cdec1653d585a93f750d7913196832b96150f31e8dcf07a8943a671ff2","size":1855,"data":"","first_seen":"2025-08-25T15:23:52.705154Z","last_seen":"2026-03-28T00:21:55.260239Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"83f9c63887dd101a6c61802aaf5c64ed","sha1":"3b2a144f27b8656f9dc4049c7ce35e639a76001b","sha256":"12ef0d505509d6c32cb9edd6258d6addf6ae16562f388aa87e1d53191a2fc692","sha512":"ed612b78a20549ddd57580ee4a7fdb60c33403716e581f9d13ec264ef7fa785b00b13e93bc62623a7f311306e895beb561fdd1857a1ba7543701041f6b00c896","ssdeep":"96:+BKELPhKSKIh+owenpkupoxpH89hbL0frXOoYCORsBewPGow+gKx/DGUevOvm7:+BKCF3poxpc9V0frPYry79gKtM2m7","tlshash":"76a1b7c5bd0bce7c8342c6d7e815d201b20329957712c0a6bbad0dcd898ed8ab4e9732","size":4869,"data":"","first_seen":"2025-08-25T15:23:52.707982Z","last_seen":"2026-03-28T00:21:55.260916Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/3.4.17.js","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","size":407279,"data":"","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-07-25T16:44:57.965264Z","times_seen":46278,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2118c5fe58c08303fea285829321dc61","sha1":"72ebd38250de47c00cf47ee76c064c87e9dd124b","sha256":"0a4ef1b1b5dff568df179a69e6cb41f58f2d3590f9ed7082d48418ac1ee5c2ed","sha512":"9211ee382fd316ce2af1f8bf225088f9ee4ef8fe9dec0259af5446d1b4c3b39975a3338c2f1859c7f69bf3f43e63fe1fdd1b94db6ab423ce55694a735a9d3cd3","ssdeep":"","tlshash":"a84142b77e5664d64ff660b0dc7fb20aa1171a9db40250a9d0982fd23867e4f3422f19","size":2102,"data":"","first_seen":"2025-08-25T15:23:52.711565Z","last_seen":"2026-03-28T00:21:55.261561Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"948464eb6a46eeaa5bf90473ec727d9c","sha1":"fcb9273d0e4560ba9b03091b3432ddbf251ede24","sha256":"c5162b550000261a3ae01bd83c16d076b18eac1c4f77ea771b694e9a5eeb9352","sha512":"5a33f3bda9896d8adc1114f5523a1405099e54d23af856d4dab608d0a98dc25e844af99b6bc14cf5bf1411cff3c628a1768ed0038f9b9d776abda1188b6ad06a","ssdeep":"","tlshash":"e1a0220ec03ac30303203b3200a0c2c208fec830cf033fca002b0280008e0ac2303a08","size":67,"data":"","first_seen":"2025-09-22T16:06:11.342381Z","last_seen":"2026-03-28T00:21:55.262269Z","times_seen":48,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d539b0250580e43b7b4c867ae6ea6eaa","sha1":"1289b538703e08bd544671341967a2f149068cee","sha256":"c5b7898e40224f38664bd6ccfe90966694b581db1f3593cb40db1bd9449c7493","sha512":"0aa3beac0b7fca786a6ec807be41dfd436d9be71b15d10bc2104ab2987e2bf34d755cf552db1558796c355a65edde32d43b7bd450e4e00473c40fda94f42866c","ssdeep":"","tlshash":"e2618a2e6af7347942b7723a639f97453a3210432045ce183e7c8b895f50bb49cb2add","size":3359,"data":"","first_seen":"2026-02-13T07:27:33.696362Z","last_seen":"2026-03-09T08:48:31.018394Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"32f7eee2581c72a5561c21df3013a89a","sha1":"b38bed0f0e9601a07358ec72777da31f91720f2a","sha256":"bb69fc1cad24c2d6a80bd8d6a50ae43eba927a2922dceca5365fd07db8220d19","sha512":"c9d50bde320eee008849d9224a4336eb02c8956bf5efe8c7ed9f6bfc525fce2fe7c56b0e7d86e67f7d22705653042b9a21a60eb7a012aa8c6069b5db8b7758bd","ssdeep":"","tlshash":"2d30000000000330000000000000030000000000000000300000000000000000000000","size":4,"data":"","first_seen":"2025-08-25T15:23:52.713783Z","last_seen":"2026-03-28T00:21:55.267207Z","times_seen":56,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"bloom-bot.click/","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-13T21:54:54.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 13 Feb 2026 21:54:54 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9Ir3PLUHSlZg29krwDUQxe5mtmVDEHXpfWcw3kXSOcoDxkbOadHhBbW84eyRSXgxIDYttJPFKUiB62BRhJNC829u7SUnCh8NEUIbyXAbJA%3D%3D\"}]}\r\nage: 197991\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9cd791234e133e6a-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":127296,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (21455)","md5":"8e3c5e01ba29b18308cf565c395b4ca0","sha1":"2fc1e42c0cf3962ef6af71b23bd150c10e6546cd","sha256":"2e377bb045694bb1c728ac28de804efd10216cbb0f164d8fb960f1f1cdad1f1d","sha512":"5c2d486aa26b60a214a3356b50624ae6ebf9947ff8b64f43bc7645cb88d04bc9d723e8b98ecf30c9a4995d65ff2d318c1014773884fcd3df430a0cec6d5cbad8","ssdeep":"1536:wthwtxq3frHWKReGWGuWWW2LTzn6I/h9KbFfs0YC:wthwjh9KbWC","tlshash":"17c30959657321009a5b84f2afeb3f163668a143d40bcde83bec85489fcaed589d371c","first_seen":"2026-02-13T13:43:01.826827Z","last_seen":"2026-02-13T21:55:18.347918Z","times_seen":2,"resource_available":false,"data":null}},"time_used":246,"timings":{"blocked":110,"dns":78,"connect":8,"send":0,"wait":23,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/loader.js","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:54.782Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /loader.js HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:54 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\nage: 35401\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hNautVRt1qsJ0WJYq9CydxyJdN4YpPXBEauDBJAqbTAS9Hplonb0yw0uF3WkRSyBW64y%2BndE204LHENQ4DzaKFp2FTfxAnqrV2VQGscZdw%3D%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9cd791246d206e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T17:42:21.256573Z","times_seen":17532132,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gethyperdash.xyz/axiom/loader.js","fqdn":"gethyperdash.xyz","domain":"gethyperdash.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:54.784Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /axiom/loader.js HTTP/1.1\r\nHost: gethyperdash.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T17:42:21.256573Z","times_seen":17532132,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/3.4.17.js","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:54.785Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /3.4.17.js HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:54 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\netag: W/\"697a698c-636ef\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 35401\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8JaorNuUFpfEz6KXQsYgsjThpswVwArE6Wfdglk1FUEztHh4jGCPZnuAYUfEAGW68znIiLA3yVcps9cfww2ahG2FiDJVohNxiNKDjD5iDg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9cd791246d216e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":407279,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (52853)","md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-07-25T16:44:57.965264Z","times_seen":46278,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/bloom-background-1.jpg","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:55.227Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /bloom-background-1.jpg HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:55 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 68528\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\netag: \"697a698c-10bb0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 35400\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qvy33Jn1BuAg4H%2BFN1dZNahCYj8mgCurn%2BoQtPX8MPNH%2FfpyDF0GS5%2FJ6EklOdJYgAcocsnm%2BOSVY%2B6zvOWxBoSKbctJeS%2F3myCl4Vx4mg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cd791273dc86e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":68528,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], progressive, precision 8, 1280x720, components 3","md5":"2b8e1f2169b6f3d6bd1446efc59a58c9","sha1":"43ff146145bd2e239197c1b1d10a54cf0ec69b6a","sha256":"edd8bcbf52a0703456fd19d4e1f48fdf4697208f51fb85db386fe47cc0953acf","sha512":"c66394e2969fe8f0e5260bba0d362ab4374dbebec81cb91c4ae1bef3e7c6b17316c38f8182476e108d1b9d3f28cb392b36644c89323cff199ad744f198be6038","ssdeep":"1536:qGCTYJ1kpHvJnvhkRhxQq/4t0Yr6Cl/HJlvl3quHppVUaOc:q7skjnaRPhQtKON3BHpwe","tlshash":"6b6301b5e44a88eef86cedb6258907b40ed55dc1a29a391e82e519b0fcdc71c1f147c2","first_seen":"2025-08-25T15:23:52.698368Z","last_seen":"2026-07-09T07:18:20.813383Z","times_seen":36,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:55.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2 HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:55 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 48256\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\netag: \"697a698c-bc80\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 29538\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UvfxDZsyLg4vmfdQUGb%2FXxmNyriYcDpN1yfEfL51ER3lPq53ImUorkWIWzmMeCavnM%2F6tz5m7FTte15%2F4EXuojz2KZDBvbp19HsQtsBKxA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cd791273dcb6e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48256,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 48256, version 1.0","md5":"260c81a4759baf163c025001c4f27872","sha1":"f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298","sha256":"3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62","sha512":"9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9","ssdeep":"768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw","tlshash":"be2302df9e4d72d29271267045338383798e2d8a50aae7a1061c0fe6de05b69d31fb9c","first_seen":"2025-05-30T10:47:22.433446Z","last_seen":"2026-07-25T15:31:28.166807Z","times_seen":24480,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":14,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:55.318Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2 HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:55 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 48256\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\netag: \"697a698c-bc80\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 29538\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V79SF%2Bbm%2FJ8wPhrFmKzzUAmQuX7MtYyU4DnLrV%2FYWF1B1xJgx66KfPWeO5QikJOMYXCd18RRZE1oamRmy%2Bb1Am6IBzB0qyszkqbAeFlhTg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cd79127cdfc6e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48256,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 48256, version 1.0","md5":"260c81a4759baf163c025001c4f27872","sha1":"f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298","sha256":"3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62","sha512":"9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9","ssdeep":"768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw","tlshash":"be2302df9e4d72d29271267045338383798e2d8a50aae7a1061c0fe6de05b69d31fb9c","first_seen":"2025-05-30T10:47:22.433446Z","last_seen":"2026-07-25T15:31:28.166807Z","times_seen":24480,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:55.315Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2 HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:55 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 48256\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\netag: \"697a698c-bc80\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 29538\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ISd%2FnK8gr0%2FvQrgbdNNgVnrgmrf3uuvKGjcWpUCdqblhMUaIdUp50LqfXP9K7SLC3a3MsggKY9TzcPWFqvTYFo5pysgysIFBmL8XyVMfUw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cd79127cdf36e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48256,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 48256, version 1.0","md5":"260c81a4759baf163c025001c4f27872","sha1":"f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298","sha256":"3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62","sha512":"9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9","ssdeep":"768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw","tlshash":"be2302df9e4d72d29271267045338383798e2d8a50aae7a1061c0fe6de05b69d31fb9c","first_seen":"2025-05-30T10:47:22.433446Z","last_seen":"2026-07-25T15:31:28.166807Z","times_seen":24480,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:55.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2 HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:55 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 48256\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\netag: \"697a698c-bc80\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 29538\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AWsqFzEd%2FtX5btv4Z8s57IkEv9WlfxGEYxlxBcceYBdqVZcxg1vn7Y3GfO2ZXU5Yb1Dqtl4o9qe8Tvweh925gUs%2Fd1ocHGjTlDjJaVXP6A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cd791275dd26e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48256,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 48256, version 1.0","md5":"260c81a4759baf163c025001c4f27872","sha1":"f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298","sha256":"3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62","sha512":"9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9","ssdeep":"768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw","tlshash":"be2302df9e4d72d29271267045338383798e2d8a50aae7a1061c0fe6de05b69d31fb9c","first_seen":"2025-05-30T10:47:22.433446Z","last_seen":"2026-07-25T15:31:28.166807Z","times_seen":24480,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:55.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2 HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:55 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 48256\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\netag: \"697a698c-bc80\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 29538\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LfY2j%2BqD5FZXSuuLuk7N2EAWzpHA99lS%2BbM9TUgcmIYOMUOI1eaAjCebuW8ufbgh6zAKMj%2BDA5W3P5e8quB2GJ0uJj2CtiGTcirndvfojg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cd791275dd46e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48256,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 48256, version 1.0","md5":"260c81a4759baf163c025001c4f27872","sha1":"f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298","sha256":"3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62","sha512":"9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9","ssdeep":"768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw","tlshash":"be2302df9e4d72d29271267045338383798e2d8a50aae7a1061c0fe6de05b69d31fb9c","first_seen":"2025-05-30T10:47:22.433446Z","last_seen":"2026-07-25T15:31:28.166807Z","times_seen":24480,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:55.342Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298.woff2 HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:55 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 48256\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\netag: \"697a698c-bc80\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 29538\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZLDbEwjxhh8SD3V1z8BDPjQyAa9z90zf1ll52jJS9Pc9RHGHkj%2Fg7cZpJz6xiwsOl3x4k8wyFILZ2DBcfCpEoz9PtTVMwysOUk76skImVA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9cd79127edff6e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48256,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 48256, version 1.0","md5":"260c81a4759baf163c025001c4f27872","sha1":"f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298","sha256":"3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62","sha512":"9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9","ssdeep":"768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw","tlshash":"be2302df9e4d72d29271267045338383798e2d8a50aae7a1061c0fe6de05b69d31fb9c","first_seen":"2025-05-30T10:47:22.433446Z","last_seen":"2026-07-25T15:31:28.166807Z","times_seen":24480,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":13,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.postimg.cc/QxNRx7Hf/bloom-background-1.jpg","fqdn":"i.postimg.cc","domain":"postimg.cc","tld":"cc"},"ip":{"addr":"46.105.222.81","port":443,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:55.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postimg.cc","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Fri, 13 Feb 2026 07:05:38 GMT","end":"Thu, 14 May 2026 07:05:37 GMT"},"fingerprint":{"sha1":"0C:60:FC:7F:49:9C:E4:F1:E8:28:6F:D1:45:F4:24:E1:7A:D7:FE:79","sha256":"9C:DF:9E:CA:39:40:61:D1:0E:A6:F4:42:3F:FB:A1:4B:BF:82:59:98:C4:CA:4D:56:1F:BD:99:B9:9F:EA:19:D0"}}},"request":{"raw":"GET /QxNRx7Hf/bloom-background-1.jpg HTTP/1.1\r\nHost: i.postimg.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 13 Feb 2026 21:54:55 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 68528\r\nlast-modified: Wed, 09 Jul 2025 10:11:53 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":68528,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], progressive, precision 8, 1280x720, components 3","md5":"2b8e1f2169b6f3d6bd1446efc59a58c9","sha1":"43ff146145bd2e239197c1b1d10a54cf0ec69b6a","sha256":"edd8bcbf52a0703456fd19d4e1f48fdf4697208f51fb85db386fe47cc0953acf","sha512":"c66394e2969fe8f0e5260bba0d362ab4374dbebec81cb91c4ae1bef3e7c6b17316c38f8182476e108d1b9d3f28cb392b36644c89323cff199ad744f198be6038","ssdeep":"1536:qGCTYJ1kpHvJnvhkRhxQq/4t0Yr6Cl/HJlvl3quHppVUaOc:q7skjnaRPhQtKON3BHpwe","tlshash":"6b6301b5e44a88eef86cedb6258907b40ed55dc1a29a391e82e519b0fcdc71c1f147c2","first_seen":"2025-08-25T15:23:52.698368Z","last_seen":"2026-07-09T07:18:20.813383Z","times_seen":36,"resource_available":false,"data":null}},"time_used":575,"timings":{"blocked":251,"dns":189,"connect":22,"send":0,"wait":22,"receive":50,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bloom-bot.click/favicon.ico","fqdn":"bloom-bot.click","domain":"bloom-bot.click","tld":"click"},"ip":{"addr":"172.67.160.211","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bloom-bot.click/","date":"2026-02-13T21:54:55.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bloom-bot.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 19:07:19 GMT","end":"Tue, 28 Apr 2026 20:02:17 GMT"},"fingerprint":{"sha1":"8B:58:85:D7:55:2E:17:F1:92:5D:DD:85:45:21:70:42:08:4E:D9:9D","sha256":"3D:3B:49:1C:CC:22:9F:BE:A2:29:C2:CD:2C:9D:2F:24:99:0F:ED:10:E3:6C:EE:8D:33:7C:3E:DA:BE:AA:A3:5B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: bloom-bot.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bloom-bot.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 13 Feb 2026 21:54:55 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Wed, 28 Jan 2026 19:54:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nvary: accept-encoding\r\nage: 29538\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5%2BW3a7CWk3kxySN8EgnL9jLYb6JwWB58ST7tcxJoHpuU58Gkqb9RoJVlk3ViIXaIr91%2FeHtQSOZnHKxvA9xwvTyiBTq7wQAol3LN4eRiGQ%3D%3D\"}]}\r\npriority: u=6,i=?0\r\ncf-ray: 9cd79128ee1f6e70-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":127296,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (21455)","md5":"8e3c5e01ba29b18308cf565c395b4ca0","sha1":"2fc1e42c0cf3962ef6af71b23bd150c10e6546cd","sha256":"2e377bb045694bb1c728ac28de804efd10216cbb0f164d8fb960f1f1cdad1f1d","sha512":"5c2d486aa26b60a214a3356b50624ae6ebf9947ff8b64f43bc7645cb88d04bc9d723e8b98ecf30c9a4995d65ff2d318c1014773884fcd3df430a0cec6d5cbad8","ssdeep":"1536:wthwtxq3frHWKReGWGuWWW2LTzn6I/h9KbFfs0YC:wthwjh9KbWC","tlshash":"17c30959657321009a5b84f2afeb3f163668a143d40bcde83bec85489fcaed589d371c","first_seen":"2026-02-13T13:43:01.826827Z","last_seen":"2026-02-13T21:55:18.347918Z","times_seen":2,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-13","alert":"Sinkholed","trigger":"bloom-bot.click","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}