{"report_id":"f6218fba-4511-4bc9-9812-870aeb9d3c24","version":6,"status":"done","tags":[],"date":"2025-10-14T03:44:59Z","url":{"schema":"http","addr":"qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":0,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"final":{"url":{"schema":"https","addr":"qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"title":"My Blog is under construction"},"submit":{"url":{"schema":"http","addr":"qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":0,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-18T03:44:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"qrtabeli.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.bunny.net","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"1999-11-22","domain_rank":56787,"first_seen":"2022-03-21T07:38:02Z","last_seen":"2025-10-12T22:44:18.919102Z","alert_count":0,"request_count":2,"received_data":33812,"sent_data":965,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"qrtabeli.com","ip":{"addr":"83.228.107.181","port":443,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":8,"request_count":8,"received_data":525275,"sent_data":4577,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"qrtabeli.com/wp-content/plugins/under-construction-page/themes/images/favicon.png","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":443,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","date":"2025-10-14T03:44:38.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qrtabeli.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Sep 2025 19:06:32 GMT","end":"Sat, 27 Dec 2025 19:06:31 GMT"},"fingerprint":{"sha1":"A6:D6:29:89:90:33:1E:B8:2E:77:E5:6E:A1:8D:C5:88:A1:EE:DC:9E","sha256":"70:D3:00:58:3B:D5:75:C5:6A:61:43:EF:32:9B:3A:9C:1E:61:98:28:E1:E1:3D:FD:9C:F3:9C:14:06:70:EF:82"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/images/favicon.png HTTP/1.1\r\nHost: qrtabeli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 21 Oct 2025 03:44:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 04 Oct 2025 22:33:47 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4026\r\ndate: Tue, 14 Oct 2025 03:44:38 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4026,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"681d9fea92467c7f1ed22bde59350c24","sha1":"657b331834626baac8592984a683d64cbc38e045","sha256":"8386858d306bc25e56bce985206c92c1cfb06466a5cd98c6cc935383417277e0","sha512":"98c4500b234c10eb245ff9b22ff4b2a5101c9e7133a38cd69f08b497279f8a46a8499a93b7c33fe5aeecddd820434a838d97dd105ed6e3255edd37f6baf653f4","ssdeep":"","tlshash":"cd817c8da00867e8e5ce805770de10a89bf3ce081ba3b53b263e378579e450d64d02f1","first_seen":"2023-05-01T06:45:09Z","last_seen":"2026-04-04T12:11:12.831853Z","times_seen":1048,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":78,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"qrtabeli.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.bunny.net/css?family=Roboto:400,900","fqdn":"fonts.bunny.net","domain":"bunny.net","tld":"net"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","date":"2025-10-14T03:44:37.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fonts.bunny.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Sep 2025 23:10:51 GMT","end":"Thu, 18 Dec 2025 23:10:50 GMT"},"fingerprint":{"sha1":"DF:9D:97:88:1D:C7:EB:71:28:28:BB:4D:03:F0:DA:74:A7:1C:08:06","sha256":"35:56:C5:B2:79:26:95:BC:3B:93:D2:97:4E:81:83:6B:E4:89:64:4C:66:48:82:E7:1B:DA:77:79:CC:58:52:30"}}},"request":{"raw":"GET /css?family=Roboto:400,900 HTTP/1.1\r\nHost: fonts.bunny.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qrtabeli.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 14 Oct 2025 03:44:37 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 781720\r\ncdn-uid: 3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\ncache-control: public, max-age=2592000\r\nlast-modified: Tue, 23 Sep 2025 15:40:22 GMT\r\ncdn-proxyver: 1.34\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/23/2025 15:40:22\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 12acd208075135d9b955b3069498c068\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":11208,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1445)","md5":"b29bd72374a42003feee75ddfe61df92","sha1":"4d17c989c42d48728b94e562266a2912cd81d63c","sha256":"d6ea081d9a548a56c0c1ccfe8b2ebf254827c90180f1a730f72e4bcd28c76330","sha512":"2d454463e62c055f74148222ab40fad9d70c776a9eb6957b1e8075806573330de25b1c2b4b4de7eaf1714cebd0a2f4f3502f82d53fbd8438e2c7787404e2e612","ssdeep":"192:9YJQz3iE3K5fOHRjQ/zliUDpXLq+068Jnzw8q3JLfOHRjnwzOeGDpAL9Nj3:2Ji3VSfgRjIlh7qjJzw9tfgRjCO3e9d","tlshash":"7732f1b700192404d3d718a312da6e15be1f92067389f016ea1cdcd4afe6a7947f637e","first_seen":"2025-01-19T12:34:21.889468Z","last_seen":"2026-03-21T22:15:51.040092Z","times_seen":151,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":34,"dns":33,"connect":1,"send":0,"wait":2,"receive":0,"ssl":6},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qrtabeli.com/wp-content/plugins/under-construction-page/themes/under_construction_text/style.css?v=4.03","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":443,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","date":"2025-10-14T03:44:37.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qrtabeli.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Sep 2025 19:06:32 GMT","end":"Sat, 27 Dec 2025 19:06:31 GMT"},"fingerprint":{"sha1":"A6:D6:29:89:90:33:1E:B8:2E:77:E5:6E:A1:8D:C5:88:A1:EE:DC:9E","sha256":"70:D3:00:58:3B:D5:75:C5:6A:61:43:EF:32:9B:3A:9C:1E:61:98:28:E1:E1:3D:FD:9C:F3:9C:14:06:70:EF:82"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/under_construction_text/style.css?v=4.03 HTTP/1.1\r\nHost: qrtabeli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 21 Oct 2025 03:44:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 04 Oct 2025 22:33:47 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 559\r\ndate: Tue, 14 Oct 2025 03:44:37 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1604,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"ca65e06ef998becb8e423d280da30ddd","sha1":"307e979bd5d84c85cde020b7196cb8438cc7f002","sha256":"7ba7d64d06c184df59cf13e3bdeba83d2a31615ae21f8b4d88ae015e138579b2","sha512":"07ac417b51ac731ccbe0530a9716e37af5e9490db5342439c4a480fbe5dda0ac707bcf971431862838e53f1ea75f8c11ca76e8b386cd2fc5e2356af52b294940","ssdeep":"","tlshash":"0031e31d62629344f03bcce067734a77ee988811874f63e6b2e03165f640ac14379f8d","first_seen":"2025-02-27T14:01:14.510789Z","last_seen":"2026-03-28T18:01:31.354964Z","times_seen":27,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"qrtabeli.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qrtabeli.com/wp-content/plugins/under-construction-page/themes/under_construction_text/under_construction_text.png","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":443,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","date":"2025-10-14T03:44:37.894Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qrtabeli.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Sep 2025 19:06:32 GMT","end":"Sat, 27 Dec 2025 19:06:31 GMT"},"fingerprint":{"sha1":"A6:D6:29:89:90:33:1E:B8:2E:77:E5:6E:A1:8D:C5:88:A1:EE:DC:9E","sha256":"70:D3:00:58:3B:D5:75:C5:6A:61:43:EF:32:9B:3A:9C:1E:61:98:28:E1:E1:3D:FD:9C:F3:9C:14:06:70:EF:82"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/under_construction_text/under_construction_text.png HTTP/1.1\r\nHost: qrtabeli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 21 Oct 2025 03:44:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 04 Oct 2025 22:33:47 GMT\r\naccept-ranges: bytes\r\ncontent-length: 284332\r\ndate: Tue, 14 Oct 2025 03:44:37 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":284332,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2828 x 1274, 8-bit/color RGBA, non-interlaced","md5":"2cd55cc59a155a9c8dc4162a6e473d1b","sha1":"e8c32e7a124143a7edf232159dbbc3a8f80134d2","sha256":"5190c89b236cfd8d986671f6f973a316fc671728bf1a0c2554e328803eda095b","sha512":"df098e7f921919ad5203b3b6cf278bb466cbde88df6f4bfe51863e583bf1650e8d1f8160cd65a5d121c8c6d354178cbff21107fc7242ba1caf19a7778fd883e1","ssdeep":"6144:efhQtuxZr5UNbLF9gbaLKYBDovr7t0FL4/mquU1c6m43:eZUuxZryNbLLgb2zBEnGF09ct43","tlshash":"ce5412763963e8911d6f92bc553e74ca8902313ed0547df07d3fb4accb02a990daa6d2","first_seen":"2023-05-03T22:47:26Z","last_seen":"2026-03-28T18:01:31.349553Z","times_seen":125,"resource_available":false,"data":null}},"time_used":377,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":289,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"qrtabeli.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qrtabeli.com/wp-content/plugins/under-construction-page/themes/fonts/fontawesome-webfont.woff2?v=4.7.0","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":443,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","date":"2025-10-14T03:44:38.012Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qrtabeli.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Sep 2025 19:06:32 GMT","end":"Sat, 27 Dec 2025 19:06:31 GMT"},"fingerprint":{"sha1":"A6:D6:29:89:90:33:1E:B8:2E:77:E5:6E:A1:8D:C5:88:A1:EE:DC:9E","sha256":"70:D3:00:58:3B:D5:75:C5:6A:61:43:EF:32:9B:3A:9C:1E:61:98:28:E1:E1:3D:FD:9C:F3:9C:14:06:70:EF:82"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1\r\nHost: qrtabeli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qrtabeli.com/wp-content/plugins/under-construction-page/themes/css/font-awesome.min.css?v=4.03\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 21 Oct 2025 03:44:38 GMT\r\ncontent-type: font/woff2\r\nlast-modified: Sat, 04 Oct 2025 22:33:47 GMT\r\naccept-ranges: bytes\r\ncontent-length: 77160\r\ndate: Tue, 14 Oct 2025 03:44:38 GMT\r\nserver: LiteSpeed\r\naccess-control-allow-origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":77160,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 77160, version 4.459","md5":"af7ae505a9eed503f8b8e6982036873e","sha1":"d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c","sha256":"2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe","sha512":"838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892","ssdeep":"1536:/MkbAPfd1vyBKwHz4kco36ZvIaBfRPlajyXUA2jVTc:L0nXnHdfRVEAS2","tlshash":"7d7302e63b6c4943e03d6460708abe9f104b3ab42fe057e5c876db7f2722992b71552c","first_seen":"2023-04-05T03:30:47Z","last_seen":"2026-04-04T13:47:07.150669Z","times_seen":410533,"resource_available":true,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":178,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"qrtabeli.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":443,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-14T03:44:37.205Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qrtabeli.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Sep 2025 19:06:32 GMT","end":"Sat, 27 Dec 2025 19:06:31 GMT"},"fingerprint":{"sha1":"A6:D6:29:89:90:33:1E:B8:2E:77:E5:6E:A1:8D:C5:88:A1:EE:DC:9E","sha256":"70:D3:00:58:3B:D5:75:C5:6A:61:43:EF:32:9B:3A:9C:1E:61:98:28:E1:E1:3D:FD:9C:F3:9C:14:06:70:EF:82"}}},"request":{"raw":"GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/ HTTP/1.1\r\nHost: qrtabeli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nexpires: Wed, 11 Jan 1984 05:00:00 GMT\r\ncache-control: no-cache, must-revalidate, max-age=0, no-store, private\r\ncontent-type: text/html; charset=UTF-8\r\nretry-after: 86400\r\ncontent-length: 692\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 14 Oct 2025 03:44:37 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":2308,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"6f7dc006ce483d9d11e104b17d7ad598","sha1":"b5d94ba41bb57871783d325f95d555c8ac26d04d","sha256":"7a9d4c23864ce6aa0a166f689c793149fe33ffe744da85144a89c4d000983077","sha512":"b91fab1b23d23a9d6bdaeebecb2ca444142111d455228dab9456fd380513dc9c6c1202294d8856e7c778718e3d156c04bbb1eaa9f57e568781d74471f9daac6a","ssdeep":"","tlshash":"7441fe331494a503927683a594627a08efd58357e61ec982f5ed125f4ff1f93ccab348","first_seen":"2025-10-14T03:45:05.415314Z","last_seen":"2025-10-14T03:45:05.415314Z","times_seen":1,"resource_available":false,"data":null}},"time_used":748,"timings":{"blocked":274,"dns":116,"connect":75,"send":0,"wait":200,"receive":0,"ssl":80},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"qrtabeli.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qrtabeli.com/wp-content/plugins/under-construction-page/themes/css/bootstrap.min.css?v=4.03","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":443,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","date":"2025-10-14T03:44:37.887Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qrtabeli.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Sep 2025 19:06:32 GMT","end":"Sat, 27 Dec 2025 19:06:31 GMT"},"fingerprint":{"sha1":"A6:D6:29:89:90:33:1E:B8:2E:77:E5:6E:A1:8D:C5:88:A1:EE:DC:9E","sha256":"70:D3:00:58:3B:D5:75:C5:6A:61:43:EF:32:9B:3A:9C:1E:61:98:28:E1:E1:3D:FD:9C:F3:9C:14:06:70:EF:82"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/css/bootstrap.min.css?v=4.03 HTTP/1.1\r\nHost: qrtabeli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 21 Oct 2025 03:44:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 04 Oct 2025 22:33:47 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 18270\r\ndate: Tue, 14 Oct 2025 03:44:37 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":121200,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65371)","md5":"ec3bb52a00e176a7181d454dffaea219","sha1":"6527d8bf3e1e9368bab8c7b60f56bc01fa3afd68","sha256":"f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c","sha512":"e8c5daf01eae68ed7c1e277a6e544c7ad108a0fa877fb531d6d9f2210769b7da88e4e002c7b0be3b72154ebf7cbf01a795c8342ce2dad368bd6351e956195f8b","ssdeep":"768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh","tlshash":"2cc3c7a0f21031ea7333c55a75d0ed872219a153e56a4fb7f22f25d88f845ca1673f1a","first_seen":"2023-04-05T03:13:25Z","last_seen":"2026-04-04T13:42:56.504528Z","times_seen":56204,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"qrtabeli.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qrtabeli.com/wp-content/plugins/under-construction-page/themes/css/common.css?v=4.03","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":443,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","date":"2025-10-14T03:44:37.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qrtabeli.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Sep 2025 19:06:32 GMT","end":"Sat, 27 Dec 2025 19:06:31 GMT"},"fingerprint":{"sha1":"A6:D6:29:89:90:33:1E:B8:2E:77:E5:6E:A1:8D:C5:88:A1:EE:DC:9E","sha256":"70:D3:00:58:3B:D5:75:C5:6A:61:43:EF:32:9B:3A:9C:1E:61:98:28:E1:E1:3D:FD:9C:F3:9C:14:06:70:EF:82"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/css/common.css?v=4.03 HTTP/1.1\r\nHost: qrtabeli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 21 Oct 2025 03:44:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 04 Oct 2025 22:33:47 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 380\r\ndate: Tue, 14 Oct 2025 03:44:37 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":878,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"ff5f4043c56a489170d734b484ca89ce","sha1":"16784187421cc67e0fca55906fb788ac672c3598","sha256":"dc64cd943b89cddfc8078ea6238b4e26a4d94156225332777ec6e5ee61662d42","sha512":"e197bdd471bf153be4ee6db4fa68bf514a23482237512750a00c50cde02f9b0cacf1f3d99265fdc84c8ce5feed86e97ea167e108c1fe8fd04e7ed36d1efcf8d9","ssdeep":"","tlshash":"e51116ad8355030c9373d3605bb2c6b0775a80f16a875afd75f112506d88db68360d8d","first_seen":"2025-02-27T14:01:14.509299Z","last_seen":"2026-04-04T01:34:40.877655Z","times_seen":415,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"qrtabeli.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qrtabeli.com/wp-content/plugins/under-construction-page/themes/css/font-awesome.min.css?v=4.03","fqdn":"qrtabeli.com","domain":"qrtabeli.com","tld":"com"},"ip":{"addr":"83.228.107.181","port":443,"asn":8866,"as":"Vivacom Bulgaria EAD","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","date":"2025-10-14T03:44:37.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qrtabeli.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Sep 2025 19:06:32 GMT","end":"Sat, 27 Dec 2025 19:06:31 GMT"},"fingerprint":{"sha1":"A6:D6:29:89:90:33:1E:B8:2E:77:E5:6E:A1:8D:C5:88:A1:EE:DC:9E","sha256":"70:D3:00:58:3B:D5:75:C5:6A:61:43:EF:32:9B:3A:9C:1E:61:98:28:E1:E1:3D:FD:9C:F3:9C:14:06:70:EF:82"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/css/font-awesome.min.css?v=4.03 HTTP/1.1\r\nHost: qrtabeli.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 21 Oct 2025 03:44:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 04 Oct 2025 22:33:47 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6658\r\ndate: Tue, 14 Oct 2025 03:44:37 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":31000,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (30837)","md5":"269550530cc127b6aa5a35925a7de6ce","sha1":"512c7d79033e3028a9be61b540cf1a6870c896f8","sha256":"799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd","sha512":"49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b","ssdeep":"384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf","tlshash":"78d241e8e54c01d66731c48bff81b36862b6fb3dd5854da9f01f290c29d226522c5fba","first_seen":"2023-04-05T03:13:25Z","last_seen":"2026-04-04T13:45:15.144372Z","times_seen":236715,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"qrtabeli.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.bunny.net/roboto/files/roboto-latin-900-normal.woff2","fqdn":"fonts.bunny.net","domain":"bunny.net","tld":"net"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://qrtabeli.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209134\u0026pdata=http:/","date":"2025-10-14T03:44:38.006Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fonts.bunny.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 19 Sep 2025 23:10:51 GMT","end":"Thu, 18 Dec 2025 23:10:50 GMT"},"fingerprint":{"sha1":"DF:9D:97:88:1D:C7:EB:71:28:28:BB:4D:03:F0:DA:74:A7:1C:08:06","sha256":"35:56:C5:B2:79:26:95:BC:3B:93:D2:97:4E:81:83:6B:E4:89:64:4C:66:48:82:E7:1B:DA:77:79:CC:58:52:30"}}},"request":{"raw":"GET /roboto/files/roboto-latin-900-normal.woff2 HTTP/1.1\r\nHost: fonts.bunny.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://qrtabeli.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.bunny.net/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 14 Oct 2025 03:44:38 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 20684\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 781720\r\ncdn-uid: 3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\ncache-control: public, max-age=2592000\r\netag: \"68b2329d-50cc\"\r\nlast-modified: Fri, 29 Aug 2025 23:07:09 GMT\r\ncdn-storageserver: SE-583\r\ncdn-fileserver: 318\r\ncdn-proxyver: 1.34\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 09/08/2025 14:36:52\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 5dd19aed926222006ec8b94ecd817162\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":20684,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20684, version 1.0","md5":"1b7363d64c4db8772ea3e6a51864ac5e","sha1":"613247d2ae1023056a497d01279d5103a0ff393a","sha256":"0ef8a8fa25c458bcf4ac50a6dd593225dd8a6875043d7fc78ce14caa0788dff1","sha512":"cdc9be8f3dcc0bd38b2f6c7d76852975ec360c23c95806ceb1e54682098d3e7c3030625b27ccff2597b084a8bc0cb2b14032d0c449915622845f24ce7d9525ac","ssdeep":"384:DREB4e02rIBeqCaSA+Clx15n68g4k3iGlgISeWc7kWvx9xJNoL:1EBOeB2+SLnLzslglc7ksHxm","tlshash":"3592d00bc7784e34e172a6178ddc282250a14ffbd1cad15ecc044de9aeec2548ba6c76","first_seen":"2025-01-10T20:21:10.911444Z","last_seen":"2026-04-04T09:42:51.519019Z","times_seen":2395,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":8,"dns":0,"connect":1,"send":0,"wait":4,"receive":1,"ssl":4},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}