{"report_id":"ee9deebc-6dd8-4d36-815e-63bde88e0056","version":0,"status":"done","tags":[],"date":"2026-09-29T01:50:22Z","url":{"schema":"https","addr":"ow4821.craftum.io/","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":0,"asn":9123,"as":"Jsc timeweb","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"ow4821.craftum.io/","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"title":"ow4821.craftum.io/","dom":{"size":10582,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5294)","md5":"4ab8be734aea4aba597fbc226b274764","sha1":"ca97348be0bed8c6823619a8006c26a6d8e18846","sha256":"04013720718c8e098094eda27c70c6f511cd52b9c4b5d1409841726f5bb05383","sha512":"820bc85d19a69b4d6a25fbe03c5cb25a1b0bdb5c5eafa0bd0e4d9876c9e94663aa05402d564595ebab7c13dc3283c86a4f3111a5a7d986a60af5fab2f0d40137","ssdeep":"192:tztUFENZTc489s+Wm2P4olcSXO8gO8MO8SO8/KBBVbsbM/2Ko:tzaFq1V+mZVX9g9M9S9SBBVbfo","tlshash":"8022611279757491231f8afeb9a52c089547e26bc5444cc8b12e0ef86fd4b78acc379e","dom_hash":"domhash7903563d14f8a850bc8f06afb413f08b","first_seen":"2026-09-29T01:50:26.398257Z","last_seen":"2026-09-29T01:50:26.398257Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ow4821.craftum.io/","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":0,"asn":9123,"as":"Jsc timeweb","country":"Russia","country_code":"RU"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-03T01:50:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"274418.selcdn.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"ow4821.craftum.io","ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"domain_registered":"2021-04-07","domain_rank":0,"first_seen":"2026-09-29T01:50:23.369698Z","last_seen":"2026-09-29T01:50:23.369699Z","alert_count":40,"request_count":10,"received_data":809429,"sent_data":4741,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Google PageSpeed:1.13.35.2-0","description":"Google PageSpeed is a family of tools designed to help websites performance optimisations.","website":"https://developers.google.com/speed/pagespeed/mod","common_platform_enumeration":"","icon":"Google PageSpeed.svg","categories":["Caching","Web server extensions","Performance"]},{"name":"Craftum","description":"Craftum is an Russian website builder.","website":"https://craftum.com","common_platform_enumeration":"","icon":"Craftum.svg","categories":["Page builders"]}]},{"fqdn":"static.craftum.com","ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"domain_registered":"2007-05-16","domain_rank":0,"first_seen":"2024-08-05T14:49:03Z","last_seen":"2026-09-25T12:52:48.943024Z","alert_count":0,"request_count":1,"received_data":49694,"sent_data":716,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"274418.selcdn.ru","ip":{"addr":"92.53.68.16","port":443,"asn":49505,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"domain_registered":"2012-03-06","domain_rank":0,"first_seen":"2023-02-21T18:55:58Z","last_seen":"2026-09-19T06:50:08.30049Z","alert_count":1,"request_count":1,"received_data":9658,"sent_data":629,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ow4821.craftum.io/","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"d4a256d81d0807a94c91729c412fa879","sha1":"83ee8b83089128e3f5106571f90d700a55664eaf","sha256":"e92d685dfd5f4d91f4fd06d881eb830dab5738fcf54e868d6e4839e7e4bc1692","sha512":"b4e44912ff921aed62d65ddcb692de88beda8f6f1cbfe5482746ac6c227d22d58fe101cb144fc6a86ccca29a3a5fe4237d41e1d87e55da40794da7e5ec967f84","ssdeep":"","tlshash":"1a70000c0028030088208200228223a02000a8028a20000200080ce0a8a082320002c0","size":21,"data":"","first_seen":"2026-06-13T12:47:17.306373Z","last_seen":"2026-09-29T01:50:26.419563Z","times_seen":55,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/static/common.js","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"02718242933e1cfceb3fff24687fb223","sha1":"b0fb1952b4fdea1e352fcc885b03dbf87df6ffd4","sha256":"b833911975bc6834a61f9ea938bd10463b02762f7ad172dc5d7f95f183f81455","sha512":"4fcc3673746bac7dd65d6eb2c9f140cd1cf4a7264d84f1e719e06edbda258c87d0db62df8ad4c34e07f946d5f7c41171a100d9d1692c71fe9a63b5bf94fd2021","ssdeep":"6144:ziWyl+m5sQXxpqoK5hMPHbjfZcTuFHqoMSL3GZq1270jEVCSk/hZ1a0R:zimQhp7Kze4IMSDoK271kl","tlshash":"53b429c83251f07243e321a681bf4106f33a5915784e8418b169e8da7c7dd9e53bbfba","size":513050,"data":"","first_seen":"2025-09-03T23:52:02.951946Z","last_seen":"2026-09-29T01:50:26.402256Z","times_seen":108,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ow4821.craftum.io/static/a-common-styles.css","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:52.931Z","timestamp":1790646592931,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/a-common-styles.css HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 27 Sep 2026 11:20:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab8fbed-ffce\"\r\nexpires: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65486,"size_decoded":10608,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65473)","md5":"fea45e4c927bd9032878af6b385bce6a","sha1":"f9633e62e2777454433cbb25bf9aa1478a84d5a2","sha256":"83f517dc2a2b83d9d4f26cf2ff47cd5edebf2a6f7c30f5b49d8b409e48bf0675","sha512":"89be77f84a3c5eeb3c46508a5a3dca17c2ef4d60c073148013b4c741010e6aec820037a3b098f2afe6b7c4f1f5319ab2f74ace88302a7bdd71e4e95265837000","ssdeep":"768:H2Kxq6vmEN8lK02vqJ8+97qpgF3evxvGqxqBxdGSdFxjs5SrABg:fa","tlshash":"cb535b9d34002a38a32f5813d3daa85bb1061d02ed2751d2f7a11199d5f9ffaf2b9b0d","first_seen":"2025-09-03T23:52:02.966104Z","last_seen":"2026-09-29T01:50:26.401395Z","times_seen":108,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/static/common.js","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:52.941Z","timestamp":1790646592941,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/common.js HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 27 Sep 2026 11:20:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab8fbee-7d41a\"\r\nexpires: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":513050,"size_decoded":189196,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65436)","md5":"02718242933e1cfceb3fff24687fb223","sha1":"b0fb1952b4fdea1e352fcc885b03dbf87df6ffd4","sha256":"b833911975bc6834a61f9ea938bd10463b02762f7ad172dc5d7f95f183f81455","sha512":"4fcc3673746bac7dd65d6eb2c9f140cd1cf4a7264d84f1e719e06edbda258c87d0db62df8ad4c34e07f946d5f7c41171a100d9d1692c71fe9a63b5bf94fd2021","ssdeep":"6144:ziWyl+m5sQXxpqoK5hMPHbjfZcTuFHqoMSL3GZq1270jEVCSk/hZ1a0R:zimQhp7Kze4IMSDoK271kl","tlshash":"53b429c83251f07243e321a681bf4106f33a5915784e8418b169e8da7c7dd9e53bbfba","first_seen":"2025-09-03T23:52:02.951946Z","last_seen":"2026-09-29T01:50:26.402256Z","times_seen":108,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.craftum.com/cnx1iJCd-Iz0yeEFqWz96S-KnYM=/1707x0/filters:no_upscale()/https://274418.selcdn.ru/cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/uploads/804199/df72d176-6e76-4d4a-b484-0bb131c8deae.png","fqdn":"static.craftum.com","domain":"craftum.com","tld":"com"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:53.208Z","timestamp":1790646593208,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 04 May 2026 10:56:07 GMT","end":"Thu, 19 Nov 2026 10:56:07 GMT"},"fingerprint":{"sha1":"E4:82:D3:4C:91:37:99:57:21:B8:19:AA:38:13:95:DE:00:BD:70:EE","sha256":"31:48:7E:E8:7B:B5:AD:1B:86:0E:57:8A:EC:C3:B4:19:F7:FB:85:07:DD:F2:7B:6D:7D:78:81:25:94:38:8D:CA"}}},"request":{"raw":"GET /cnx1iJCd-Iz0yeEFqWz96S-KnYM=/1707x0/filters:no_upscale()/https://274418.selcdn.ru/cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/uploads/804199/df72d176-6e76-4d4a-b484-0bb131c8deae.png HTTP/1.1\r\nHost: static.craftum.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:53 GMT\r\ncontent-type: image/webp\r\ncontent-length: 49414\r\ncache-control: max-age=31536000,public\r\nexpires: Mon, 27 Sep 2027 14:21:53 GMT\r\nvary: Accept\r\netag: \"fbe533fdfaa0dbea61ff0be77eb6dfdd72dddd75\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49414,"size_decoded":49694,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1707x785, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"05a3228e600c4c8d3c2e8075c1951e89","sha1":"fbe533fdfaa0dbea61ff0be77eb6dfdd72dddd75","sha256":"b11b71e193193dc406e76658d357f512f096a9cbcee14b0ddde2b4ded4b6decf","sha512":"ce485c0a234a59bf916fd1b98add62ac4d774b1118b06cedb7ca5f176e99116b3f31cc2db870645a86e12ff4ea0ea56e2565a1bdab2f0810947084c4a66b97d6","ssdeep":"1536:AnU+5b4IDo6mFY2K26KBBQVkjaAY4xec74wx6I:x+hs6mFtoKBB5ja1Aj6","tlshash":"3c23f1c52a207417d2ce95f343fda26377ea125b498a30dd89a2881b74fc772d9d4c87","first_seen":"2026-09-29T01:50:26.406144Z","last_seen":"2026-09-29T01:50:26.406144Z","times_seen":1,"resource_available":false,"data":null}},"time_used":307,"timings":{"blocked":-1,"dns":105,"connect":40,"send":0,"wait":78,"receive":40,"ssl":44},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"274418.selcdn.ru/cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/uploads/804199/9d8c0422-7f2e-40e1-beb3-502d70e4b46c.png","fqdn":"274418.selcdn.ru","domain":"selcdn.ru","tld":"ru"},"ip":{"addr":"92.53.68.16","port":443,"asn":49505,"as":"JSC Selectel","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:53.396Z","timestamp":1790646593396,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.selcdn.ru","organization":""},"issuer":{"commonName":"GlobalSign GCC R6 AlphaSSL CA 2025","organization":"GlobalSign nv-sa"},"validity":{"start":"Fri, 12 Dec 2025 10:44:38 GMT","end":"Wed, 13 Jan 2027 10:44:37 GMT"},"fingerprint":{"sha1":"52:52:29:C1:CD:D4:2F:22:A5:11:72:21:58:09:B7:F8:5D:DB:C7:B6","sha256":"0A:C5:C3:9A:69:FE:A8:D6:CD:A8:E7:BE:34:7C:75:33:72:FA:86:80:B7:F6:22:2F:76:F8:29:04:61:A0:5B:80"}}},"request":{"raw":"GET /cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/uploads/804199/9d8c0422-7f2e-40e1-beb3-502d70e4b46c.png HTTP/1.1\r\nHost: 274418.selcdn.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges\r\ncontent-length: 9033\r\ncontent-type: image/png\r\netag: \"388be15ad42862d3d2077201204343fa\"\r\nlast-modified: Sun, 27 Sep 2026 11:19:21 GMT\r\nx-container-storage-policy-index: 1\r\nx-container-storage-policy-name: cold\r\nx-timestamp: 1790507960.32298\r\nx-trans-id: e820a406-4d21-4bb2-9628-4ad649a128d4\r\ndate: Tue, 29 Sep 2026 00:07:45 GMT\r\nage: 6128\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9033,"size_decoded":9658,"mime_type":"image/png","magic":"PNG image data, 167 x 160, 8-bit/color RGBA, non-interlaced","md5":"388be15ad42862d3d2077201204343fa","sha1":"b0bd280843768b35d92a706cbc67e2003b07a3b7","sha256":"a1b84b38217e5616a51460f44a9f981caf14673e0a7a143acdc6740068464027","sha512":"92ab2f630d4e1e4bc3809ab273c3d16eea5a05c28e067f5e7ab1543989942f4b6019692a0706aa8c21d0693d6339a6bab4ddf15e744909363a982be4dbadc5fb","ssdeep":"192:OukJVz5vTLS6dvX3Eu0ESbEMFaEJRNs2WSGScSz3yoYsswrkGb:O9h5bLS4/Z0ELMFBJs2xGgby7sJF","tlshash":"94129fa07f9add1bc864321181b68f3cee903d6a5835c063e5718ecda1f2855f741ca5","first_seen":"2026-09-29T01:50:26.408096Z","last_seen":"2026-09-29T01:50:26.408096Z","times_seen":1,"resource_available":false,"data":null}},"time_used":230,"timings":{"blocked":0,"dns":47,"connect":55,"send":0,"wait":63,"receive":0,"ssl":66},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"274418.selcdn.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-29T01:49:52.629Z","timestamp":1790646592629,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\nx-page-speed: 1.13.35.2-0\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Google PageSpeed:1.13.35.2-0","description":"Google PageSpeed is a family of tools designed to help websites performance optimisations.","website":"https://developers.google.com/speed/pagespeed/mod","common_platform_enumeration":"","icon":"Google PageSpeed.svg","categories":["Caching","Web server extensions","Performance"]},{"name":"Craftum","description":"Craftum is an Russian website builder.","website":"https://craftum.com","common_platform_enumeration":"","icon":"Craftum.svg","categories":["Page builders"]}],"data":{"size":11040,"size_decoded":3255,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5734)","md5":"d634247191cf89670576b1f6bafbc28f","sha1":"4d6824fc03f5cabfef14a973d0162cccd0d99250","sha256":"e898fb34387c18d5cdeba56ecfbec6c92266ff30b68fc737de75a70b549abd59","sha512":"2b5078251c7f3f4a03551e3edc1cd0cb84348d91314357d2b13bd018dec35d7f06a0ccab430108615f7fbd1cb5cab79bfec9b7c856ea93e040cc5d4db84ee3a9","ssdeep":"192:tSXUQJNZTlvo3M9EiWWmym4oHcCqlXO8gO8MO8SO8/KBBjbsbM/2Knu:tSEQZW3ZiWiyRqlX9g9M9S9SBBjbfnu","tlshash":"3332735279757491231f86feb9a52809a407e2a7c1444cc8712e0ef8afd5b38bcc379e","first_seen":"2026-09-29T01:50:26.409507Z","last_seen":"2026-09-29T01:50:26.409507Z","times_seen":1,"resource_available":true,"data":null}},"time_used":132,"timings":{"blocked":-1,"dns":42,"connect":27,"send":0,"wait":28,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/static/b-themes-styles.css","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:52.932Z","timestamp":1790646592932,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/b-themes-styles.css HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 27 Sep 2026 11:20:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab8fbed-1df\"\r\nexpires: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":748,"mime_type":"text/css","magic":"ASCII text, with very long lines (478)","md5":"91e35e43581feb386570896502ee03b6","sha1":"16d2b7231e3b59ae3157db32c949a13fc57e98fc","sha256":"1bc2ec9a99289bde9c8a36437f35a2c194daaf0ddc061828c22416bc5b1a26db","sha512":"ccf316de76e635e0e18733d5ce3ace66117f09fabbd90c43ddd96d8754b27b55f9395ac039395360127c57bb5f49cfeff553ced8bb89f6a8ebb10421da134713","ssdeep":"","tlshash":"05f0fe4bdb3c9b3311af4c2c803cac2d12d4ddd85fe49b07b028425b6d69552e5e2a70","first_seen":"2025-06-16T10:16:03.570464Z","last_seen":"2026-09-29T01:50:26.411232Z","times_seen":138,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/static/c-animation-styles.css","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:52.933Z","timestamp":1790646592933,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/c-animation-styles.css HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 27 Sep 2026 11:20:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab8fbed-312a\"\r\nexpires: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12586,"size_decoded":2050,"mime_type":"text/css","magic":"ASCII text, with very long lines (11671)","md5":"dd99176b1a4ba362fdd0fa1cd35e98d2","sha1":"e2bc6995c858d9f62aceb085f850f249b8ea8b79","sha256":"ffd61699a43a8425b1f6508d30acb3cab0d6700188f8497c297a8f5b10d5d633","sha512":"cf31f3e9843feb46720a6b957e47eef482b263e67cfd41898610a3b8c4eaca0b89d041649f04ef34339542f33052aba23b7929a3ee246f1dbd79eee9278d047a","ssdeep":"192:uW6uNQ3fdPwwanleMf72yMHdMTQEQaLQ0:f6uNQ3fdPwwanleMf72yMHdIQEQaLQ0","tlshash":"91426cda50c1560d86574bb283cfde044a3c8ca1652168f972a5694e8f47fd8e3bf13b","first_seen":"2024-12-26T05:41:43.339442Z","last_seen":"2026-09-29T01:50:26.412085Z","times_seen":140,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/static/d-simple-styles.css","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:52.935Z","timestamp":1790646592935,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/d-simple-styles.css HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 27 Sep 2026 11:20:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab8fbed-939b\"\r\nexpires: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37787,"size_decoded":7648,"mime_type":"text/css","magic":"ASCII text, with very long lines (37786)","md5":"46e65c08cb220ab39cb30b93a108c1a1","sha1":"0361df7694002c7cc8d177d97179f59ffb0fb4d3","sha256":"c8a28435efa8f24cac4b8ce52c81095b6b1308a31900ed0b8bf43023dd5bd245","sha512":"16f489642893f1f0834544bb5d5539409b21714e2fffc9cc0310f8e76e45bb2ecdbf5760a4de1c8cb7b2726e5a78a8dfa9913d123ebff15dd3b355704403f25f","ssdeep":"384:27mJU20ZjFfWAbnBulukvQelGxXr4GDyK+UVSj7D0k:hATBulE63R","tlshash":"eb0360679171123d340f98757758aaafa309d00bde3613e6fa819535a3c6af708327ce","first_seen":"2025-08-03T21:09:00.891659Z","last_seen":"2026-09-29T01:50:26.41273Z","times_seen":116,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/static/e-complex-styles.css","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:52.936Z","timestamp":1790646592936,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/e-complex-styles.css HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 27 Sep 2026 11:20:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab8fbed-1c0cd\"\r\nexpires: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":114893,"size_decoded":18281,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"61923fb93151b054d41002aa5c040fe5","sha1":"405947d8aa729ebb6e3b50c6e44f545b9f64785e","sha256":"ce0513574fa11d0a0c9d978e43b865630af9381a9b7a068b0ccf063c6e2f906f","sha512":"1e3b6ccfbb77155aef5ec785d8e9460f95cdb19f866419b469bc574b336d50bb3811e68cfb2b54ad61d176308e1d98978f63efcf06b15aba0a4839d231298fa0","ssdeep":"384:4D+JvUy2vqpmkfGMGGC/LaqKLhiwbmnnBWb54OCzeX990y7ljq79Z1G95QhgEwhU:aCpYMALchgBG5gw0SlWkeeOq9g4RLFFe","tlshash":"c7b3852671703739652bcd259b94d99bb310d112c63722fbfc90d91cdbcab9241a3b8e","first_seen":"2025-09-03T23:52:03.088938Z","last_seen":"2026-09-29T01:50:26.413415Z","times_seen":108,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/static/f-blocks-styles.css","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:52.937Z","timestamp":1790646592937,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/f-blocks-styles.css HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 27 Sep 2026 11:20:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab8fbed-5c7b\"\r\nexpires: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23675,"size_decoded":5102,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (23644)","md5":"aa8d73f1b473ead827350783f5d1c314","sha1":"8d646fbb70c5364c01bd8f9eaca5f2548aba0a42","sha256":"9ddf34f38517b545cd688276cd7c2c22dcf3a0f315a816754ac7092a3d14a49b","sha512":"c75fa25873e24f03d49e58c2ec615703d177605fa43cbd6c8ccbe40d4c888253da4268792fe773e6d6bd14eda5f103a8ee91979dd3129c5c32c9d5f232bc48bc","ssdeep":"192:AxCQjdXWtD75VWAkEA1ShsHcouDcfupeb9njwcBGzh+S5:AkiXWtD7zArmsHcouDXebk","tlshash":"82b2ff4820660238b21f8aa56fd3d07f36545839d7faa9f6fd128818d7cc7c58472bad","first_seen":"2025-09-03T23:52:02.980162Z","last_seen":"2026-09-29T01:50:26.414138Z","times_seen":108,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/static/g-libraries-styles.css","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:52.938Z","timestamp":1790646592938,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/g-libraries-styles.css HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 27 Sep 2026 11:20:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab8fbed-5056\"\r\nexpires: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20566,"size_decoded":6357,"mime_type":"text/css","magic":"ASCII text, with very long lines (2240)","md5":"a74472ad7619e0ea94ac1adb81ba9a23","sha1":"56f2efe06f86c35cefa7e68e4a1b72c93c5fa135","sha256":"fd5c89c5619ff294e7889a72ceee798404e8c4a2b9b09516438848dd47006ad2","sha512":"ba236641cc822a1ae908f1969298255980a5893522242dc0cb32276902b24ac737d469c44c206ee595430236525fcf3ea122c8d7391ffe10ab7dbeecc01a79cc","ssdeep":"192:6L1mUJbiKneQhSewe4atkti0iBE4bcGbwM1FpqWUzzR+pvdaaYYVweCdhW4APnqF:6cUbek3tLqi0iBE4bzpTU+KCCy4Kmf","tlshash":"d192f39453b01c27172f4e6a1a624779f6a454c10a4bcc7993d0ac48ffb59fc331faa5","first_seen":"2025-03-20T08:48:33.72298Z","last_seen":"2026-09-29T01:50:26.414876Z","times_seen":139,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ow4821.craftum.io/static/6ccefdaf-9d8b-49de-afb3-f5253fe8025d.css","fqdn":"ow4821.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ow4821.craftum.io/","date":"2026-09-29T01:49:52.940Z","timestamp":1790646592940,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/6ccefdaf-9d8b-49de-afb3-f5253fe8025d.css HTTP/1.1\r\nHost: ow4821.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ow4821.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 29 Sep 2026 01:49:52 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 27 Sep 2026 11:20:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab8fbee-11dc\"\r\nexpires: Tue, 29 Sep 2026 01:49:52 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4572,"size_decoded":1415,"mime_type":"text/css","magic":"ASCII text, with very long lines (4572), with no line terminators","md5":"37f6586cbb075ac1b20dd1b6ea6cc511","sha1":"862a1297dd0403e3648ae2993cf762ce4f81212f","sha256":"b6079756fff3d3b79e4b36b3823f5d43af81d2015c2ba4f3a80f1550fa3f9384","sha512":"6f70b020b56e116caf715df551502087a47b6147b97081cbfc98657e9959a648f097b1e5bfffa8ba3b51f88b4c8529df01772bcc63c3111fba8e5afb71a8a9d8","ssdeep":"96:yddRaG+P1AfF6xaGQEQofGdqtx2CE8fGdqtnTRaG5gYefFdqngdvRaGgewBaGszu:ia9UF6xaHY9e293aIDcqMaPLBaxt3I","tlshash":"8091e0513f57b22efca9b096dc53509ea24c241f7bcb16eecc5222b2dd687841935b8c","first_seen":"2026-09-29T01:50:26.417217Z","last_seen":"2026-09-29T01:50:26.417217Z","times_seen":1,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"ow4821.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}