{"report_id":"e256f9b2-a645-4571-a55c-3a2fc7935ed8","version":0,"status":"done","tags":[],"date":"2026-10-10T22:31:50Z","url":{"schema":"http","addr":"grueslayers.eu/","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":0,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"final":{"url":{"schema":"http","addr":"grueslayers.eu/","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"title":"grueslayers - stormscale | eu","dom":{"size":11384,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (461)","md5":"377c563df8ed922c3f21218d258f0645","sha1":"b02db0611cfea303d1e68b6ef2af0f2b2cbe4226","sha256":"6bf89876cc2cc1061b9cf43ce0abea8ecff3f54e109f46216414d7ee1d10c359","sha512":"9dd839c4a30181bc8a4b37efdef8b606a55aeef1042dc5be107c36dc611831a6696257a8c7580340c189e59e2e68aad960f196afa08ff58093b2be141b7bd35c","ssdeep":"192:hSPJs4eJsmNUuvxFyS6bL2llJcISPIRH6bG56I+6bHCI4FacC8XPDsH:hSPC4eCmveS6ballJcISPId6bG56I+6l","tlshash":"55326251298d2d3f0237328ba99d7268b1ef5c70d224198132ff836c9bc5f05adb7869","dom_hash":"domhashcb4145ff2516237baa16bd2fa3c58d6f","first_seen":"2026-10-10T22:32:02.471241Z","last_seen":"2026-10-10T22:32:02.471241Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"grueslayers.eu/","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":0,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-14T22:31:50Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-10-04T22:47:33.985443Z","alert_count":0,"request_count":1,"received_data":368665,"sent_data":478,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"wow.zamimg.com","ip":{"addr":"3.164.230.24","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2011-08-11","domain_rank":438622,"first_seen":"2012-07-15T17:58:05Z","last_seen":"2026-10-03T08:40:04.328059Z","alert_count":0,"request_count":2,"received_data":1013551,"sent_data":966,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}]},{"fqdn":"www.gstatic.com","ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":146047,"first_seen":"2012-05-29T15:36:17Z","last_seen":"2026-10-04T23:37:19.691773Z","alert_count":0,"request_count":1,"received_data":851452,"sent_data":500,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-10-04T22:46:21.559025Z","alert_count":0,"request_count":2,"received_data":48246,"sent_data":1094,"comment":"","tags":null,"fingerprints":null},{"fqdn":"grueslayers.eu","ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-07-20T08:00:51.611278Z","last_seen":"2025-07-20T08:00:51.611278Z","alert_count":34,"request_count":17,"received_data":118950,"sent_data":7283,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"reCAPTCHA","description":"reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.","website":"https://www.google.com/recaptcha/","common_platform_enumeration":"","icon":"reCAPTCHA.svg","categories":["Security"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-10-04T22:47:16.540786Z","alert_count":0,"request_count":1,"received_data":3977,"sent_data":541,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.65.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-10-05T02:54:34.076069Z","alert_count":0,"request_count":1,"received_data":90117,"sent_data":474,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.google.com","ip":{"addr":"142.251.150.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-10-04T23:05:21.462671Z","alert_count":0,"request_count":1,"received_data":1654,"sent_data":459,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.gstatic.com/recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"880723b04901ef902341d03409d07439","sha1":"92d597679deb157915cd08eb6dcd4d42bf274d23","sha256":"a2d9c6b17c85d85e1330c5b09c7fb1aea3fe457897ce6ac69e361dc6a72a57b1","sha512":"c700abc85dccb19b7617fd6e8e3dd813eed2dbb86228dc9c23744fd0ddeb2b71b2d387c474e764671745e659ff19ff07bf699039a43772bfdef6cf9b8738c197","ssdeep":"12288:3bWvqmePeW7L91BmS+ELcUAZoaI/aONG0wjXUpJvHnkb+:rZph1ZrIbMNGNwrfkb+","tlshash":"c8053bec35063eb56222b5fa10a76048933e942adc4c0b6db19798f13ef484d6177eb7","size":850545,"data":"","first_seen":"2026-10-07T03:06:23.101046Z","last_seen":"2026-10-13T19:41:49.186824Z","times_seen":6936,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.5.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.65.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89476,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-10-13T19:30:57.591067Z","times_seen":277724,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/js/main.js","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"ad6d07420675d96457fa02f953919500","sha1":"9abe1624a1365036eecf0b464570dfb362acfb6f","sha256":"347c6dd0bfd1d6132fff9fc396f8cf20cc96352a69c3230b057add6315a25954","sha512":"9fdc58c4c399aa68e4af1cd8ab4db9d00f9d57d20be699a97101bfd4e5b660262bd05ec719b5faa4947fc4e0b477d26c0aeda863b99e67a477231144addc9771","ssdeep":"","tlshash":"a531d30b71f2279aa03f6131db7629447a3d21cbd68f5a46f87c4a471f9015cb682d1e","size":1626,"data":"","first_seen":"2025-09-28T08:06:00.708733Z","last_seen":"2026-10-10T22:32:02.474126Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/recaptcha/api.js","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.150.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f388f4eee28f0ebf2f44d1c23334b11e","sha1":"4c55fadec42da2d9747022cb73a01dd13201916b","sha256":"5fc08e0a2853b51a4fe97f3fdfc3ae15d5a5663a34e4e62fc203f86a3b76cc83","sha512":"ec9dafbb690624838ff9e52116adaeaa1d2542852d6b2da26bcba1a602dce3f9c667139aa54256e14bedb983eef89fccadcaa2345ad13b4c529c78ba456301b5","ssdeep":"","tlshash":"d311edb31a14e03a4f7209e1e1fedbb5e452741cf16848e8a915de882f6accbce15985","size":976,"data":"","first_seen":"2026-10-07T17:46:45.101836Z","last_seen":"2026-10-13T19:30:57.52186Z","times_seen":1163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google-analytics.com/analytics.js","fqdn":"www.google-analytics.com","domain":"google-analytics.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"d39a8679ed70005ee063ea62886141a2","sha1":"52b556cb7bdbe59b9b1ab9415ff905b561b8399e","sha256":"b33ed8fd08f8cf0138f219167d4bb5817f1b09c1d9ac7431e833899ecfff40f1","sha512":"c65e2fe579412ea8ef38d29185f47dec1f4fb871ec28767c104821f1c3368793c4ff577ed58971d27a9bbac97fee734093766954f7e9d2fc0ff1cb687a0ab977","ssdeep":"96:A1VdZYqhPnjpsx4/eTe8qSMbqaQd6VL2Jyt9LdJoyayCVPVD5wdBf2PfCHiUr3:AXdZYqNjpm4yPqSMbqaQGL2QfdDayCZa","tlshash":"3ca1ca9929fb50210233b1bd1bafa918b63895236208dd61bd8c9264af94437d7f1bc9","size":4693,"data":"","first_seen":"2026-05-25T14:46:35.360433Z","last_seen":"2026-10-13T19:42:09.753317Z","times_seen":120690,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":true,"md5":"ec63ea1deed19c0c3779aeb68aa544ab","sha1":"b3ea963ee7427f0cef5d3fb45e5f7ec8b5231ef4","sha256":"f68424f0e1dee7b7bb778f8d2f22dba15a7f774d2e99b4b7e7c80785c02c2bd3","sha512":"dbbadd1429fcb9ed1b351274d3f2bcca7ce3fc21e9938201d8ea59713413fc3912f9b9eeacac3b09ec667ee52a69c54e8001456f48407521063581825a89a0fb","ssdeep":"","tlshash":"e0a002f3ed0530b207319754c1957e54f845026669210e703fd79db066d775f2931c44","size":77,"data":"","first_seen":"2025-06-19T16:03:13.909495Z","last_seen":"2026-10-13T18:11:24.795013Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":true,"md5":"6dabe0bb3fd4b6a0742be46ba95383dd","sha1":"cb5cc91db602776b5723b4d4ca3a958db1f41a31","sha256":"407e1dd1f2bdba86a5aaa6b5e52bba540d8f82eda7d3ed3869f83384dc30c2d8","sha512":"413f249f78ac09014d51902c334a9a90d0fffa10594025128c59b1fdab37c678716b27524dbe52386888d7dae1906ecfda3996c1d8b68ff7a8816f07e3a0ee75","ssdeep":"","tlshash":"97c08c88251b0c7285a62b050b6fe200b4062202a8d05922580a22045f11e03ab48844","size":157,"data":"","first_seen":"2026-10-10T22:32:02.527884Z","last_seen":"2026-10-10T22:32:02.527884Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wow.zamimg.com/widgets/power.js","fqdn":"wow.zamimg.com","domain":"zamimg.com","tld":"com"},"ip":{"addr":"3.164.230.24","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9a82d403c4590ebc1d17fb9135afc5f6","sha1":"0bea491a32843690fd073fcc40ee9d02ff7487ae","sha256":"795187f61ae6710045d09590fffd9ff8609e59b086a102d08ffaaf2d47334854","sha512":"e523f5d1913b1cbafe5c52374d60b194904420849617a9e77aaeb50e7808af603a648f2a29ce0c566526d020324f44267c12a77c3cdccae89c2f2de7a2937755","ssdeep":"6144:viKC8ef9LSTqXnnyXv7xs+8Z6Mh8aV7Cai4:viATq3nM7aXTV7C4","tlshash":"94144bba3247306743eb31b5146f1102b17458aaf88949bcf184d8ba697de4b31e7f78","size":201882,"data":"","first_seen":"2026-10-04T12:58:39.39785Z","last_seen":"2026-10-13T18:11:24.721432Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=UA-177915672-1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc18935c6fe5b1b9d71b4f3b10bc4c6e","sha1":"21f8ca2871abd75e57208eb5b2a457e5956cdb89","sha256":"be3db8094efadea7e7f0d689838b0c9bde6794cb6b8a1e156ceef1ddddab65a5","sha512":"5582b871f333a2377c40f5e914fb2e6dcc6f9d1b240e2739248b1847b3c383637b5ba6473b160b936f4f7650fdbf44133f593f4633f37429e98ae917a002fa8d","ssdeep":"6144:KsfCyDnGI9amdFcfIb/EfD3ceVijGupYp:tR9NjGu8","tlshash":"707408ccb3d6b42683a2b574503f018bb27a69d2b84cd889f146ece42d3469a5177f7c","size":368061,"data":"","first_seen":"2026-10-10T22:32:02.513617Z","last_seen":"2026-10-10T22:32:02.513617Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"Google Analytics and Tag Manager is being shimmed by Firefox. See https://bugzilla.mozilla.org/show_bug.cgi?id=1713687 for details.","filename":"sandbox eval code","line_number":1,"column_number":9}]},"http":[{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/rogue.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.664Z","timestamp":1791671469664,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/rogue.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3442\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:27 GMT\r\nETag: \"d72-5b4cd074992f0\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3442,"size_decoded":3707,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"be9695237555d75c4ed08e82eeb0ddb5","sha1":"04b31cac806d7a5dc574a5dfd6eae87f851cf38e","sha256":"db09b533cc86b7fdc01fd579bb0e249b27e4d3d30ed6cf4d009c5b6ef6ef31aa","sha512":"d954434a4dcddda4dbdb26a76bc207454a30b0caebb814489047cc721c27c3bc2c7cf0f133bef1350a27c8c63d005824b384d3e64a6747fe179bfd893d0de611","ssdeep":"","tlshash":"1c611bb8468389ccf4f8e41d03078aa296d29e3cd95410d61f27b52697f9d518aece2b","first_seen":"2025-09-28T08:06:00.664668Z","last_seen":"2026-10-10T22:32:02.472719Z","times_seen":2,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":45,"dns":0,"connect":15,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/js/main.js","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.630Z","timestamp":1791671469630,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/js/main.js HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nVary: Accept-Encoding\r\nLast-Modified: Mon, 24 Apr 2023 08:21:43 GMT\r\nETag: W/\"65a-5fa10b26ef9ab\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1626,"size_decoded":908,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"ad6d07420675d96457fa02f953919500","sha1":"9abe1624a1365036eecf0b464570dfb362acfb6f","sha256":"347c6dd0bfd1d6132fff9fc396f8cf20cc96352a69c3230b057add6315a25954","sha512":"9fdc58c4c399aa68e4af1cd8ab4db9d00f9d57d20be699a97101bfd4e5b660262bd05ec719b5faa4947fc4e0b477d26c0aeda863b99e67a477231144addc9771","ssdeep":"","tlshash":"a531d30b71f2279aa03f6131db7629447a3d21cbd68f5a46f87c4a471f9015cb682d1e","first_seen":"2025-09-28T08:06:00.708733Z","last_seen":"2026-10-10T22:32:02.474126Z","times_seen":2,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/death-knight.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.647Z","timestamp":1791671469647,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/death-knight.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 4103\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:26 GMT\r\nETag: \"1007-5b4cd0740de57\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4103,"size_decoded":4369,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"1481f0400498338e3f71c5b56abf4525","sha1":"73944f144f90ac5e031ed5b8d5baa3f6c7affb37","sha256":"748ec80ad4bce854b1006fe3c5a8f15d0ff7131de977ceefa21d94c665071a70","sha512":"b25659cc24ce36dc9df941baf2ff5bc0da7939ee0754fff8d21040d39ffd2403ae6a2beed2a928de9d9a11d3114b38b02ba208bc84a5ce4269f7776bd5cb646d","ssdeep":"96:xxOrvukU7+9cANX08PJT7sU7MO8zyo9/8Oy6lkIrqhk/eAUl6Q:eM7+9jNzBoOJCWeXEk/PQ","tlshash":"8f81c634df356dace4bd52a6dd584b6bfb208c33089c7c8d909dba2017f1021f629729","first_seen":"2025-09-28T08:06:00.6862Z","last_seen":"2026-10-10T22:32:02.476404Z","times_seen":2,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":83,"dns":0,"connect":0,"send":0,"wait":35,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/druid.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.652Z","timestamp":1791671469652,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/druid.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3846\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:26 GMT\r\nETag: \"f06-5b4cd07430220\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":3846,"size_decoded":4111,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"7e16a7b5cfed806b18a93dce15a34a7a","sha1":"2aca96c8638e060a6b259833aa9e31661931a65b","sha256":"58ec5772806a64fa94bfa5363fc3fa53b3b3eb8c9c665f9865fb6261222426c2","sha512":"ca094666108bd3bde29c9fcf40364680bcd45461f0542830a356841fcbaea38f8d6077c107d19b515b346905135851b56cba6c8f3e8c461028679af15347e58d","ssdeep":"","tlshash":"ab815cf88f606da244816003c5a4a59bde65446807b7fcd3a206dfbfdc3ed0428b9ce9","first_seen":"2025-09-28T08:06:00.737021Z","last_seen":"2026-10-10T22:32:02.478238Z","times_seen":2,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":95,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/shaman.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.665Z","timestamp":1791671469665,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/shaman.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 4677\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:27 GMT\r\nETag: \"1245-5b4cd074abf8c\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":4677,"size_decoded":4943,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"53c5817a7b8f4adc4c2799341bc8d14f","sha1":"b0d8f27f7e39f7ef7545d8d601b9a73e8e895c42","sha256":"a412f34ac915e9ae2ce7a18ca38d1cb733d7a7e0f41bcc4ea8233e860ba3a66f","sha512":"4562ed87126f3630540c7d43fa7f1741573f4d99d742ac8b2153b535ff8079f7cbe2fec3c5553aa036eb8366b83ca85a37811744e86ff851eb5f4e2f17a3b194","ssdeep":"96:unNUO/D1bOlp1mY471yZyw5YuRh1lDdZw2+e9C1Az:unNUR1471yZywyuD1lpZk9Az","tlshash":"e4a108c8563560276de2cdfcbc284bd3a9cf0416d1beb24951c8fca35c9ee01da56361","first_seen":"2025-09-28T08:06:00.66893Z","last_seen":"2026-10-10T22:32:02.479922Z","times_seen":2,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":45,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/warrior.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.668Z","timestamp":1791671469668,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/warrior.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3342\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:27 GMT\r\nETag: \"d0e-5b4cd074ce1ca\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3342,"size_decoded":3607,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"4fd8de94e78ecbdecb3137f892e65308","sha1":"cf075fc9dd0140eba1fc2eb29a4f63d500ce2436","sha256":"971d93a8b9c1f9e12815f3561d7b7f4f11564675d1706aed9b5ce3bead522941","sha512":"f4f14e15c4a2c8759846b218cbc83fd25078cc852ddd2dc78151ada12d12bb156f990da67b7d2d1b3152d5ccbba998483952ad4ddbd43197bd5719464cf7370f","ssdeep":"","tlshash":"3d61089626d2a18190ecac14c8e702b6035a4e1e411795b4b8f07d3b3c7e2808f97a3e","first_seen":"2025-09-28T08:06:00.729658Z","last_seen":"2026-10-10T22:32:02.485061Z","times_seen":2,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":45,"dns":0,"connect":15,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wow.zamimg.com/css/universal.css?19","fqdn":"wow.zamimg.com","domain":"zamimg.com","tld":"com"},"ip":{"addr":"3.164.230.24","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:10.044Z","timestamp":1791671470044,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zamimg.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Sat, 20 Jun 2026 00:00:00 GMT","end":"Sun, 03 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D4:60:78:DE:2E:E5:62:9A:52:EC:46:31:73:B7:7C:AD:7B:01:5F:59","sha256":"1F:17:F4:B2:18:5A:F9:2A:4D:36:B1:48:B0:26:E2:C0:E8:8A:FC:E2:7B:B4:AD:AF:92:38:DB:F2:8E:8F:9E:39"}}},"request":{"raw":"GET /css/universal.css?19 HTTP/1.1\r\nHost: wow.zamimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css\r\ndate: Sat, 10 Oct 2026 19:39:46 GMT\r\ncache-control: max-age=10800\r\ncontent-encoding: gzip\r\nserver: nginx\r\nlast-modified: Sat, 10 Oct 2026 02:25:53 GMT\r\netag: W/\"6ac9a231-c5e98\"\r\nexpires: Sat, 10 Oct 2026 22:39:46 GMT\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 5dbb5d54ce8d1d6f8480679ed6115d1c.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P1\r\nx-amz-cf-id: P24uMuHpNrjmGYFJ4BWMszxSGv3QK9Lk9yxYColv0PPISuZjs7ifuQ==\r\nage: 10284\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":810648,"size_decoded":53359,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"ef48187f87ea1ae40d318b4d3ce4697c","sha1":"d9699c7a1e30b2256cafd5db96b66d4886a27731","sha256":"805ea7eaedcad16c55874310cb62805f83f32bb8a5a0293b69ef87b8904ef7d2","sha512":"7f45bdeb4b06a3277b6e996bf270e5568af14d26356aa246e8ab67614ed68b1f4da9d55361c3e5e379a595a31a9c0779d87ad512ffb70249fd8806f744a5663e","ssdeep":"6144:67PDGtdsLsdsisTsCsXs8s5sMssFqJWL4XjoO5t/sKr:6XGtdsLsdsisTsCsXs8s5sMsbsKr","tlshash":"5005240978ef99d97a739e291a28752a450370acd84f0660b96393e4d2ff883313d7dd","first_seen":"2026-08-24T00:50:22.418372Z","last_seen":"2026-10-13T18:11:24.73078Z","times_seen":7,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:10.051Z","timestamp":1791671470051,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: http://grueslayers.eu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"recaptcha-scs\"\r\nreport-to: {\"group\":\"recaptcha-scs\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/recaptcha-scs\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 354590\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 09 Oct 2026 17:27:02 GMT\r\nexpires: Sat, 09 Oct 2027 17:27:02 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 05 Oct 2026 00:06:40 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nage: 104648\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":850545,"size_decoded":355497,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (602)","md5":"880723b04901ef902341d03409d07439","sha1":"92d597679deb157915cd08eb6dcd4d42bf274d23","sha256":"a2d9c6b17c85d85e1330c5b09c7fb1aea3fe457897ce6ac69e361dc6a72a57b1","sha512":"c700abc85dccb19b7617fd6e8e3dd813eed2dbb86228dc9c23744fd0ddeb2b71b2d387c474e764671745e659ff19ff07bf699039a43772bfdef6cf9b8738c197","ssdeep":"12288:3bWvqmePeW7L91BmS+ELcUAZoaI/aONG0wjXUpJvHnkb+:rZph1ZrIbMNGNwrfkb+","tlshash":"c8053bec35063eb56222b5fa10a76048933e942adc4c0b6db19798f13ef484d6177eb7","first_seen":"2026-10-07T03:06:23.101046Z","last_seen":"2026-10-13T19:41:49.186824Z","times_seen":6936,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":5,"connect":16,"send":0,"wait":17,"receive":66,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/lato/v25/S6u9w4BMUTPHh6UVSwiPGQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:10.052Z","timestamp":1791671470052,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/lato/v25/S6u9w4BMUTPHh6UVSwiPGQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://grueslayers.eu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 23040\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:52:31 GMT\r\nexpires: Tue, 05 Oct 2027 15:52:31 GMT\r\ncache-control: public, max-age=31536000\r\nage: 455919\r\nlast-modified: Mon, 15 Sep 2025 17:11:31 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":23040,"size_decoded":23853,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23040, version 1.0","md5":"de69cf9e514df447d1b0bb16f49d2457","sha1":"2ac78601179c3a63ba3f3f3081556b12ddcaf655","sha256":"c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49","sha512":"4aebb7e54d88827d4a02808f04901c0d09b756c518202b056a6c0f664948f5585221d16967f546e064187c6545acef15d59b68d0a7a59897bd899d3e9dda37b1","ssdeep":"384:adpABC4a0HkBpR1HWtGu06B6lsoAKiwY0HcLKglV6Z+DVb35PJZDdiZeJ1vqYg:0AHa0Ezf2tZn6lsoABwTKK46ZQb3V7wD","tlshash":"fca2e1c05cc1e2d4ae02daf7fda5a4eab4e2f01123a8f65f8f114b75d505993640fe01","first_seen":"2023-04-05T13:28:45Z","last_seen":"2026-10-13T19:34:20.732877Z","times_seen":198419,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":6,"connect":37,"send":0,"wait":29,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;0,900;1,400\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.620Z","timestamp":1791671469620,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:49 GMT","end":"Fri, 11 Dec 2026 20:01:48 GMT"},"fingerprint":{"sha1":"E3:3D:17:9C:78:F1:DE:68:C7:E6:BB:8F:08:DC:78:F3:9D:DF:F2:43","sha256":"EB:D6:1D:9A:76:0B:5A:3C:08:74:83:6D:AA:A7:F4:B3:0D:17:8F:4F:3E:6B:9C:91:6C:5B:9E:F7:08:1F:00:62"}}},"request":{"raw":"GET /css2?family=Lato:ital,wght@0,400;0,700;0,900;1,400\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 10 Oct 2026 22:31:09 GMT\r\ndate: Sat, 10 Oct 2026 22:31:09 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3293,"size_decoded":1151,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"0b53484e6c07cadce6c6e6a18d9d1d89","sha1":"73591fdb2ed2e480a0dc335c97233c7081ff488b","sha256":"a3dcc1f644fd0f6e0c50c6d7637147fa9e89032fa0fa481c2303e09361ecb5c0","sha512":"5c6c138e7c3d475e7f02713d5456f4f374b7793fdde06ccaca50e23abd9c26c52ab5e98c243149a2397fdbc21028ed965a0543b2a4769c4f6c5696b286e48e61","ssdeep":"","tlshash":"9361d09104aba508db870dc212ce7e36ff0f625064559935afff14c8bc9bc6a9361b0d","first_seen":"2026-10-10T22:32:02.491328Z","last_seen":"2026-10-11T21:49:29.122141Z","times_seen":2,"resource_available":true,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":3,"connect":19,"send":0,"wait":39,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wow.zamimg.com/widgets/power.js","fqdn":"wow.zamimg.com","domain":"zamimg.com","tld":"com"},"ip":{"addr":"3.164.230.24","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.625Z","timestamp":1791671469625,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zamimg.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Sat, 20 Jun 2026 00:00:00 GMT","end":"Sun, 03 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D4:60:78:DE:2E:E5:62:9A:52:EC:46:31:73:B7:7C:AD:7B:01:5F:59","sha256":"1F:17:F4:B2:18:5A:F9:2A:4D:36:B1:48:B0:26:E2:C0:E8:8A:FC:E2:7B:B4:AD:AF:92:38:DB:F2:8E:8F:9E:39"}}},"request":{"raw":"GET /widgets/power.js HTTP/1.1\r\nHost: wow.zamimg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/javascript\r\ndate: Sat, 10 Oct 2026 21:32:35 GMT\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nserver: nginx\r\nlast-modified: Sat, 10 Oct 2026 02:25:42 GMT\r\nexpires: Sat, 10 Oct 2026 22:32:35 GMT\r\netag: W/\"6ac9a226-3149a\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 5dbb5d54ce8d1d6f8480679ed6115d1c.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P1\r\nx-amz-cf-id: 2FWCQDpP9oZpHlN1Whab9pEtEkgmXL70XihVQZ8cUnS6qPt784gi9w==\r\nage: 3514\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":201882,"size_decoded":64126,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"9a82d403c4590ebc1d17fb9135afc5f6","sha1":"0bea491a32843690fd073fcc40ee9d02ff7487ae","sha256":"795187f61ae6710045d09590fffd9ff8609e59b086a102d08ffaaf2d47334854","sha512":"e523f5d1913b1cbafe5c52374d60b194904420849617a9e77aaeb50e7808af603a648f2a29ce0c566526d020324f44267c12a77c3cdccae89c2f2de7a2937755","ssdeep":"6144:viKC8ef9LSTqXnnyXv7xs+8Z6Mh8aV7Cai4:viATq3nM7aXTV7C4","tlshash":"94144bba3247306743eb31b5146f1102b17458aaf88949bcf184d8ba697de4b31e7f78","first_seen":"2026-10-04T12:58:39.39785Z","last_seen":"2026-10-13T18:11:24.721432Z","times_seen":3,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":5,"connect":11,"send":0,"wait":12,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/demon-hunter.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.649Z","timestamp":1791671469649,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/demon-hunter.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3956\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:26 GMT\r\nETag: \"f74-5b4cd0741f7b6\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3956,"size_decoded":4221,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"e5105825d6cefb2748bfecebbb9f3ee2","sha1":"52ec0d6907cbcfff78c12c08f03145425d0a1320","sha256":"5beac2175e0efdbda4a55cd858a96f22104e3f65132ac5f9d561e2be10f484de","sha512":"31963f03aa34d38a2d33e69b97c2716974c7c99c5ba0c2648e4f25f74d12db077d0005335a49bcadedbe56c82ac423ae3d017c73185b0c6c4eec151d993eef03","ssdeep":"","tlshash":"5c81b6d611bb74c1f47d31b99d1261f9eaf04fa1ccf2aad5ce77045125ca08bc1b8a85","first_seen":"2025-09-28T08:06:00.683425Z","last_seen":"2026-10-10T22:32:02.495157Z","times_seen":2,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":98,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/monk.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.659Z","timestamp":1791671469659,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/monk.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3264\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:26 GMT\r\nETag: \"cc0-5b4cd074649e2\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3264,"size_decoded":3529,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"01a36cd42808d9dbea437b424a2de29c","sha1":"327e63be728a0d1173c6362ed101e374a84905d0","sha256":"32914bb3f63dac6e52c3b79af9aef322e6fdc8c1e53c17b2f8643e91915e7aa1","sha512":"88d7b8f936d5170b2935ee7271e74de3816bca92a07cf69d658cb8b3b27152a771ddff1ed6582556ff0279faadf684809b0c33672b820a1fe0b0ed19c63a06c5","ssdeep":"","tlshash":"6d61e6ed29f19e293ecdc9bc89b77b4fd8d24eb49af55816c01a8705500f4a2c57c312","first_seen":"2025-09-28T08:06:00.739568Z","last_seen":"2026-10-10T22:32:02.497169Z","times_seen":2,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":102,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"grueslayers.eu/","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-10T22:31:08.563Z","timestamp":1791671468563,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-13T19:42:32.320362Z","times_seen":19089415,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-10T22:31:08.926Z","timestamp":1791671468926,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nVary: Accept-Encoding\r\nLast-Modified: Mon, 24 Apr 2023 08:21:43 GMT\r\nETag: W/\"2a8c-5fa10b26f95ee\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"reCAPTCHA","description":"reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.","website":"https://www.google.com/recaptcha/","common_platform_enumeration":"","icon":"reCAPTCHA.svg","categories":["Security"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":10892,"size_decoded":2862,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"35bef25e650fc3e675c77d22ed94cd65","sha1":"be5403ec64d46f0e7d86f4e6dec73c2a957b3a10","sha256":"94298e8ddeb35682b154519e3da166293b9dbe5cfc92cb153e792da52f3cf748","sha512":"f18fd3bec82d453c7771cee54bebc91c0653520e4731f6d65b01465353083bdb74334be8d15e80f771b67c588269872783d9d8f2a1e25a1c167b34767e1f7bad","ssdeep":"192:BSDJsCJpztpnF+36bL2llJcISPIRs6bG56IT6bHZINF7cHqR2Dsdu:BSDCCHbg36ballJcISPIa6bG56IT6bHP","tlshash":"cf224151298d2d3f0237328aa99d7378b1ef5c30d328194132ff926d8bd5f05a9b7869","first_seen":"2025-09-28T08:06:00.705921Z","last_seen":"2026-10-10T22:32:02.499351Z","times_seen":2,"resource_available":true,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":8,"connect":15,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/paladin.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.660Z","timestamp":1791671469660,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/paladin.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3569\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:26 GMT\r\nETag: \"df1-5b4cd07475809\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3569,"size_decoded":3834,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"9da2fdb82c0c6e9727329559f34ef3e9","sha1":"25c9cd4e34552ccb685ce6427dacd4974068163d","sha256":"c6165b6bf4d907de9ccc0eabc71a1eadb9eceb48922daa074a483ea7e8a828df","sha512":"18984ee2d654eab4b9fce1851b5bee510dd17185494136a7728cc650caee7c829f8e1f12e3029bbc6873d53450c3b4f8db31a576ef4e17aea759d96977f30dfe","ssdeep":"","tlshash":"d871e9c411d62fa2e4d260f2e305da2ede83bd3642691ea5907685c5908dd37b9bc8c5","first_seen":"2025-09-28T08:06:00.696638Z","last_seen":"2026-10-10T22:32:02.500636Z","times_seen":2,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":50,"dns":0,"connect":16,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/warlock.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.666Z","timestamp":1791671469666,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/warlock.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3959\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:27 GMT\r\nETag: \"f77-5b4cd074bddb5\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":3959,"size_decoded":4224,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"047342898ab02d9d2c1903fe89caf9e5","sha1":"c2465e391b02cb6a5c4645a6225a1814071ca8b1","sha256":"28eb4aecffaef63fe0b68311fc4e1ff315fe2820f3036bea4b9eb940e686c7ed","sha512":"49eb9bad2b0c540dc901c7118e5d1bf5c24538a306b3af3a98a692cb8552a2886ec84f43b7a221c3402e3ee8c86d0751a8c1656271600ed5bf8ebfcd89011cc1","ssdeep":"","tlshash":"3f813c36a430fae8d59c4dd1a5f728fb4e528c391908391f95738f13169d8f68b86d90","first_seen":"2025-09-28T08:06:00.718187Z","last_seen":"2026-10-10T22:32:02.502231Z","times_seen":2,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":44,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/lato/v25/S6uyw4BMUTPHjx4wXg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:10.055Z","timestamp":1791671470055,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/lato/v25/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://grueslayers.eu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 23580\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:52:31 GMT\r\nexpires: Tue, 05 Oct 2027 15:52:31 GMT\r\ncache-control: public, max-age=31536000\r\nage: 455919\r\nlast-modified: Mon, 15 Sep 2025 17:09:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":23580,"size_decoded":24393,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23580, version 1.0","md5":"e1b3b5908c9cf23dfb2b9c52b9a023ab","sha1":"fcd4136085f2a03481d9958cc6793a5ed98e714c","sha256":"918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537","sha512":"b2da7ef768385707afed62ca1f178efc6aa14519762e3f270129b3afee4d3782cb991e6fa66b3b08a2f81ff7caba0b4c34c726d952198b2ac4a784b36eb2a828","ssdeep":"384:dRkIAJ8pVwWTW5VVjdVn8+2yvAMdriCEOY0kfW9GkAPqpPHi2vUuUSzB8:dKIAJ8pVHTZ+riY9oCpPHiodUeK","tlshash":"91b2e1ce5d546e3a8028213785c17b488273572e9edf42c6dd83a6263a7092cfd3d96e","first_seen":"2023-04-05T13:28:45Z","last_seen":"2026-10-13T19:38:15.323509Z","times_seen":277025,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":2,"connect":0,"send":0,"wait":20,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/favicon-16x16.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:10.173Z","timestamp":1791671470173,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 527\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:28 GMT\r\nETag: \"20f-5b4cd076292e2\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":527,"size_decoded":791,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"44162532472c703664ad6706bb196bcf","sha1":"b2a1ebf3dea74e0d3bef044dbb517b6206a8a7d1","sha256":"11e7190d9211ffcaccf8a2882d7ef71b2bed2e3d93a4014bc266efdfd02812b5","sha512":"04ddb2e7cd6176dbd3705f10a7d11551108da50e025e97c3cd28c764707cf05dea9e246f08ac7ba85320310aeeb7b96aefe4dc1073d519c6c8b8fe43a5ff0bca","ssdeep":"","tlshash":"e2f005c33b276a22d2b023735f015b44dd14f64a05d577cd14864034cdc73856b9cf58","first_seen":"2025-09-28T08:06:00.672784Z","last_seen":"2026-10-10T22:32:02.506186Z","times_seen":2,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/css/main.css","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.616Z","timestamp":1791671469616,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/css/main.css HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nVary: Accept-Encoding\r\nLast-Modified: Mon, 24 Apr 2023 08:21:43 GMT\r\nETag: W/\"df73-5fa10b26f18eb\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":57203,"size_decoded":10756,"mime_type":"text/css","magic":"ASCII text, with very long lines (2129)","md5":"8d400ce03363cb6a0660d51f434f3beb","sha1":"d82831fff4fbffcec7f9f569dbc41efe488467ee","sha256":"e421a396db996b651d65385ba7f24cf9291cd088a8331751ed4269b23af46689","sha512":"3191242e6477433e6efd38973878b3f1c4f4f479988488f3af1733b3ce6a9135a3208862ae599729793694f74fa8024f5226444dabe65a2e9d7aded78b5405e9","ssdeep":"1536:9aetpBbPkwkPYarhKCSldFR9SxEeNNTEnJv+o6kJrZd67FHxTdo+MILOL0O6ECts:TldUTEnJvSVxPX11Wf","tlshash":"2943d69b1741231893b7a09efec3d7ae63345140e10b52fca8e69d08c18e295f6b6fd5","first_seen":"2025-09-28T08:06:00.680629Z","last_seen":"2026-10-10T22:32:02.508385Z","times_seen":2,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.5.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.65.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.627Z","timestamp":1791671469627,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 20 May 2026 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:F8:0F:C4:8F:BC:F5:01:B1:66:91:CC:15:DC:D8:6E:5D:2F:45:4E","sha256":"05:8E:2E:14:85:E2:41:28:F5:18:A4:37:49:31:2B:0E:24:53:64:3F:02:15:BE:63:EF:F4:B8:53:5A:8B:6D:29"}}},"request":{"raw":"GET /jquery-3.5.1.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: http://grueslayers.eu\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-15d84\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Sat, 10 Oct 2026 22:31:09 GMT\r\nage: 1995632\r\nx-served-by: cache-lga21981-LGA, cache-bma-essb1270073-BMA\r\nx-cache: HIT, HIT\r\nx-cache-hits: 63597, 94648\r\nx-timer: S1791671470.682789,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30879\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89476,"size_decoded":31520,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-10-13T19:30:57.591067Z","times_seen":277724,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":4,"connect":14,"send":0,"wait":11,"receive":4,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/recaptcha/api.js","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.150.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.632Z","timestamp":1791671469632,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:00:11 GMT","end":"Fri, 11 Dec 2026 20:00:10 GMT"},"fingerprint":{"sha1":"81:58:83:A3:C8:EB:81:F3:A5:FE:6C:6B:D8:F7:B3:E8:49:83:32:0F","sha256":"30:B5:2C:EA:47:6E:0A:AB:5B:94:50:CC:FC:33:CB:F9:57:B2:4B:F1:B4:5D:3D:7D:BB:10:A6:02:81:8E:54:F5"}}},"request":{"raw":"GET /recaptcha/api.js HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript; charset=utf-8\r\nexpires: Sat, 10 Oct 2026 22:31:09 GMT\r\ndate: Sat, 10 Oct 2026 22:31:09 GMT\r\ncache-control: private, max-age=300\r\ncross-origin-resource-policy: cross-origin\r\nreport-to: {\"group\":\"coop_38fac9d5b82543fc4729580d18ff2d3d\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d\"}]}\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"coop_38fac9d5b82543fc4729580d18ff2d3d\"\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":976,"size_decoded":1287,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (976), with no line terminators","md5":"f388f4eee28f0ebf2f44d1c23334b11e","sha1":"4c55fadec42da2d9747022cb73a01dd13201916b","sha256":"5fc08e0a2853b51a4fe97f3fdfc3ae15d5a5663a34e4e62fc203f86a3b76cc83","sha512":"ec9dafbb690624838ff9e52116adaeaa1d2542852d6b2da26bcba1a602dce3f9c667139aa54256e14bedb983eef89fccadcaa2345ad13b4c529c78ba456301b5","ssdeep":"","tlshash":"d311edb31a14e03a4f7209e1e1fedbb5e452741cf16848e8a915de882f6accbce15985","first_seen":"2026-10-07T17:46:45.101836Z","last_seen":"2026-10-13T19:30:57.52186Z","times_seen":1163,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":5,"connect":33,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=UA-177915672-1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.634Z","timestamp":1791671469634,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:00:18 GMT","end":"Fri, 11 Dec 2026 20:00:17 GMT"},"fingerprint":{"sha1":"28:B6:EA:A0:82:D0:48:3A:13:C3:DC:38:88:85:51:9B:B3:CB:89:B4","sha256":"80:50:66:22:4E:D0:C3:BC:40:94:CA:B1:AA:D1:DB:13:A9:E5:74:53:AA:EB:19:DE:D1:A8:AC:C9:B7:18:01:EF"}}},"request":{"raw":"GET /gtag/js?id=UA-177915672-1 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ndate: Sat, 10 Oct 2026 22:31:09 GMT\r\nexpires: Sat, 10 Oct 2026 22:31:09 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 128909\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":368061,"size_decoded":129513,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (5453)","md5":"dc18935c6fe5b1b9d71b4f3b10bc4c6e","sha1":"21f8ca2871abd75e57208eb5b2a457e5956cdb89","sha256":"be3db8094efadea7e7f0d689838b0c9bde6794cb6b8a1e156ceef1ddddab65a5","sha512":"5582b871f333a2377c40f5e914fb2e6dcc6f9d1b240e2739248b1847b3c383637b5ba6473b160b936f4f7650fdbf44133f593f4633f37429e98ae917a002fa8d","ssdeep":"6144:KsfCyDnGI9amdFcfIb/EfD3ceVijGupYp:tR9NjGu8","tlshash":"707408ccb3d6b42683a2b574503f018bb27a69d2b84cd889f146ece42d3469a5177f7c","first_seen":"2026-10-10T22:32:02.513617Z","last_seen":"2026-10-10T22:32:02.513617Z","times_seen":1,"resource_available":true,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":6,"connect":22,"send":0,"wait":46,"receive":46,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/hunter.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.655Z","timestamp":1791671469655,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/hunter.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3188\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:26 GMT\r\nETag: \"c74-5b4cd07440a17\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3188,"size_decoded":3453,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"9e2f09aae09bd50a1ccf50a954fce4b6","sha1":"065b3aa7a20d068f7634bca914014c14a9a6e842","sha256":"f438cd571c7c4d5b9fe6ef0a262c67e5f856b3efe418e8e74e0d0d7feabd93f7","sha512":"796871862af0c25b1ef19c2fc30c68895237b72c5b7e07001223febbdcea4ea4a96ff8bbf9f595c4b2ae60e41445d3eb812f78a73274433c743dadecb6731fc5","ssdeep":"","tlshash":"66610771c0692cb97e76226b96067ca8a87c1e075700d45ea0dffe3d9836c664f00347","first_seen":"2025-09-28T08:06:00.691089Z","last_seen":"2026-10-10T22:32:02.516544Z","times_seen":2,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":88,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/mage.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.657Z","timestamp":1791671469657,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/mage.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3665\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:26 GMT\r\nETag: \"e51-5b4cd07452d74\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":3665,"size_decoded":3930,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"d458fe0afdbb834e53cd761d665e21fe","sha1":"7d72625ffe03e5528abfbcfce043111db7817591","sha256":"ab46388df4233480a4f3312dbd52225ae378d883deb5aed8724e695b90f08616","sha512":"ab22c85350f80ff61ca5d091c16e06ee0aef39e21e3dfb896944bcd9c58343f7ca8818e9ceadfeb50853085c36477d625ad0b135752f13a083a0986227130e87","ssdeep":"","tlshash":"12713be0af08b636839480fa12745ff685c35a26a2c336c9e0cad8d4b31479c247a08d","first_seen":"2025-09-28T08:06:00.694007Z","last_seen":"2026-10-10T22:32:02.518997Z","times_seen":2,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":102,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"grueslayers.eu/assets/images/class/priest.png","fqdn":"grueslayers.eu","domain":"grueslayers.eu","tld":"eu"},"ip":{"addr":"109.235.174.3","port":80,"asn":41528,"as":"Loopia AB","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://grueslayers.eu/","date":"2026-10-10T22:31:09.662Z","timestamp":1791671469662,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/images/class/priest.png HTTP/1.1\r\nHost: grueslayers.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://grueslayers.eu/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 10 Oct 2026 22:31:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3337\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Mon, 23 Nov 2020 21:39:27 GMT\r\nETag: \"d09-5b4cd07486be4\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":3337,"size_decoded":3602,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"b5232245c352471b1a5f3ae03ebfacc4","sha1":"e965ae2b03fd695fdb96aaadccc05ee09d0a8ed0","sha256":"d66d6933acfb66d8eaf62b903db1af140f38430ebdc05cff67e1bbb0fafc86b7","sha512":"c3bc6d408955a1c30d0fceb14db56adc42cbceaf7ccd3f4b72d217c80a42a88725e44088238df11631c149b2616c8ddceb1fcbc4622b6585489960292d1d6f4c","ssdeep":"","tlshash":"a86150270bc12818b066fb3063dd9dd1946e7f0b23a92e030466328a04fa4df861dbf6","first_seen":"2025-09-28T08:06:00.715508Z","last_seen":"2026-10-10T22:32:02.520613Z","times_seen":2,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":48,"dns":0,"connect":15,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"grueslayers.eu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}