{"report_id":"f622ec49-9b29-4c25-a51f-0d7a93aba49c","version":0,"status":"done","tags":[],"date":"2026-09-17T07:46:09Z","url":{"schema":"http","addr":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","fqdn":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","domain":"pastehtml.dev","tld":"dev"},"ip":{"addr":"172.67.141.234","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","fqdn":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","domain":"pastehtml.dev","tld":"dev"},"title":"Adobe.com","dom":{"size":8501,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"8b848b1b957a1463239cc5ee84d20d55","sha1":"0397b4d7da467afa02709e0d0f971bad6d768f36","sha256":"8a172434453e99772e8ea6d24a1df0399b9e9111896d9eaaf231f4678ab18140","sha512":"07f1716e8db654dfd1d67eb97751a7bf8b037fb64b2284ce15821fae6a31bd19b526f4af258a389199f1217abe6baf5be998be3ee340fb72b57d8e74b6f86e51","ssdeep":"96:nMV1OLNrT0aDLlEE899xJXvjDSeOcxTcSDunYK1ES/iBTDvf:Myx/0CZEE899xJrgK8YJzf","tlshash":"960272661ae318562753d97837eb12053661d0038946ce383fac575c8f8fe86e8a37e9","dom_hash":"domhash39c35dbc4b1a413d96722fcd51168297","first_seen":"2026-09-17T03:43:01.474626Z","last_seen":"2026-09-17T07:46:10.501681Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","fqdn":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","domain":"pastehtml.dev","tld":"dev"},"ip":{"addr":"172.67.141.234","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-22T07:46:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-17","alert":"Phishing Block","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","ip":{"addr":"104.21.79.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-17T03:42:57.654992Z","last_seen":"2026-09-17T03:42:57.654992Z","alert_count":8,"request_count":2,"received_data":11234,"sent_data":1017,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"EmailJS:3","description":"EmailJS is a cloud-based email delivery service that allows you to send emails directly from your client-side JavaScript code without the need for a server-side implementation.","website":"https://www.emailjs.com","common_platform_enumeration":"","icon":"EmailJS.svg","categories":["Email"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-09-13T23:16:40.429603Z","alert_count":0,"request_count":1,"received_data":24269,"sent_data":447,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"i.ibb.co","ip":{"addr":"45.43.142.6","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"domain_registered":"2010-07-20","domain_rank":21643,"first_seen":"2018-11-25T10:13:48Z","last_seen":"2026-09-11T08:51:10.898252Z","alert_count":0,"request_count":2,"received_data":67100,"sent_data":1010,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/emailjs-com@3/dist/email.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"53ddfd251c7aafb11e1108b4513af583","sha1":"c56fd7ad093d70d97632fb631804135efb55e92b","sha256":"99f43fa1461b0c951662eb915bf4a4dcfdb5290b1394cd0681906f9960e17291","sha512":"160d675132391e5f7a0cecb4b027fa8d69ac526f99c38df2566bedb6c6969767251d71eeff3507f88deb378e733ef352c5e17b7ba0f8dd373244d25f05844e38","ssdeep":"384:YEyB/S0X7fJfkHQH+LyQ8QjTF7AxZu4BW2uF5n/PErNMEs4+6KykEhNUj2RPXMua:ruhi5GFJzGrj","tlshash":"ffb2628dbea1f0b56767aa64922f440af2672a54740ec8d0c763d9d0acb848f4137f7d","size":23494,"data":"","first_seen":"2023-03-07T21:41:08Z","last_seen":"2026-09-17T07:46:10.507918Z","times_seen":239,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","fqdn":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","domain":"pastehtml.dev","tld":"dev"},"ip":{"addr":"104.21.79.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"8a2a81e917e05b3b1ce1e3aaea5c11f7","sha1":"2931af8bf73bd759552293961a9d90f24b3bb800","sha256":"5cc168b2c919cef911150a77febe8012540c5341995687d5afe8a5311f31f292","sha512":"7d2c773a3f4808f08fa49924ac1170f88ca76e1a3e589cdd64b1e8d4f770c6cd622eb81de449467e6477b938f73e5c79095564e24c3a13822097f6e61c4e2374","ssdeep":"","tlshash":"8ca0220c28c33f80800fa30a032f0202208a22cb082a0a083c0c08c88f000a82e8a308","size":69,"data":"","first_seen":"2026-09-09T09:52:10.354548Z","last_seen":"2026-09-17T07:46:10.513718Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","fqdn":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","domain":"pastehtml.dev","tld":"dev"},"ip":{"addr":"104.21.79.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ba2669393fe5975bfab7bb4f64543905","sha1":"c50fbfe6694526dc13aebf02872793639c4d13f4","sha256":"e67a1a8a8a1c2d03eacaa953bfdcddbbf20e203b3ef38db8f12e1609d47c22db","sha512":"c6d61c9c65856af88a5316f4f35c013db1470d9401ac48df117ee50bf1b473fbde3b3d309127b81ab337ae2120ce123631fb532d0e5b5571a5c13deb5b54c125","ssdeep":"","tlshash":"9b51ba3624675c750bfbda69b7cb1001716190032c52d5707a5c860e1fafe46b4e6bfb","size":2765,"data":"","first_seen":"2026-09-17T03:43:01.493812Z","last_seen":"2026-09-17T07:46:10.514786Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","fqdn":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","domain":"pastehtml.dev","tld":"dev"},"ip":{"addr":"104.21.79.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-17T07:45:41.283Z","timestamp":1789631141283,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pastehtml.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Aug 2026 02:18:02 GMT","end":"Fri, 06 Nov 2026 03:15:20 GMT"},"fingerprint":{"sha1":"56:10:F6:3B:B4:3D:AC:D0:14:87:46:82:35:EA:4D:90:18:5A:A5:DB","sha256":"BD:25:46:DE:10:2B:BC:2F:6A:7F:24:7C:02:2C:65:65:CE:C6:5A:5C:35:C6:9D:93:CC:AE:91:62:5F:2F:CC:87"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public\r\ncontent-disposition: inline\r\npriority: u=0,i\r\ncontent-transfer-encoding: binary\r\ncontent-type: text/html; charset=utf-8\r\ndate: Thu, 17 Sep 2026 07:45:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 27 Aug 2026 06:26:45 GMT\r\nreferrer-policy: no-referrer\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-cache: miss\r\nx-content-type-options: nosniff\r\nx-permitted-cross-domain-policies: none\r\nx-request-id: 4746c663-eefc-4b89-b308-1e1122b7099b\r\nx-robots-tag: noindex\r\nx-runtime: 0.005855\r\nx-xss-protection: 0\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=opOIHSoBcpnj0EZ1m6toYNl8%2FMeydQKzFiZfsTQqc8fV%2B%2B2PVHQM5%2BqaN5CpB8Ey2JJF1r92TMOXyLXLV5iWPNcRHsZzEREmnihgtsXS3PxyKg2RYOi75g%2Fufs5U3cOzGU%2BTl%2FvUTfnSjsxKvLT7jLY0H7d33aIWADWG4ny0cOEf\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a3c67e297e617127-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"EmailJS:3","description":"EmailJS is a cloud-based email delivery service that allows you to send emails directly from your client-side JavaScript code without the need for a server-side implementation.","website":"https://www.emailjs.com","common_platform_enumeration":"","icon":"EmailJS.svg","categories":["Email"]}],"data":{"size":9340,"size_decoded":3858,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"90599ba3d45f945f32095886c167591a","sha1":"69b5c4a76daf20bb3202090c06b14ca97e8265a2","sha256":"be9c0bf1a56d65c9786ee380868ac535f836177b60eb0d50b7673d7dd8f9163f","sha512":"28024f305e16100d9938041d5c0c2f8f9742d910e3b4343b16ef177711a598f3b4d4dac6c49b1c57d86bac3ad3bb0b46f69da3480299c63ee646082412afd464","ssdeep":"96:al1sxpqikT+OgFbUFp49dF2DW/HS6LOcW7Uz4LFrLD4XPQjHXzQjU:aK4ia+xbC49WDBIz4aXAHXUU","tlshash":"cb125425558518462773c768bbe2120dfb6280138a4252783eec535d4fbbc42d9a3fed","first_seen":"2026-09-17T03:43:01.48454Z","last_seen":"2026-09-17T07:46:10.504407Z","times_seen":2,"resource_available":false,"data":null}},"time_used":188,"timings":{"blocked":-1,"dns":43,"connect":21,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-17","alert":"Phishing Block","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/emailjs-com@3/dist/email.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","date":"2026-09-17T07:45:41.830Z","timestamp":1789631141830,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/emailjs-com@3/dist/email.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 3.2.0\r\nx-jsd-version-type: version\r\netag: W/\"5bc6-xW/XrQk9cNl2MvtjGAQTXvtV6Ss\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 17128\r\ndate: Thu, 17 Sep 2026 07:45:41 GMT\r\nx-served-by: cache-fra-etou8220020-FRA, cache-bma-essb1270078-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 9226\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23494,"size_decoded":10001,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (23493), with no line terminators","md5":"53ddfd251c7aafb11e1108b4513af583","sha1":"c56fd7ad093d70d97632fb631804135efb55e92b","sha256":"99f43fa1461b0c951662eb915bf4a4dcfdb5290b1394cd0681906f9960e17291","sha512":"160d675132391e5f7a0cecb4b027fa8d69ac526f99c38df2566bedb6c6969767251d71eeff3507f88deb378e733ef352c5e17b7ba0f8dd373244d25f05844e38","ssdeep":"384:YEyB/S0X7fJfkHQH+LyQ8QjTF7AxZu4BW2uF5n/PErNMEs4+6KykEhNUj2RPXMua:ruhi5GFJzGrj","tlshash":"ffb2628dbea1f0b56767aa64922f440af2672a54740ec8d0c763d9d0acb848f4137f7d","first_seen":"2023-03-07T21:41:08Z","last_seen":"2026-09-17T07:46:10.507918Z","times_seen":239,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":4,"connect":9,"send":0,"wait":10,"receive":2,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.ibb.co/p6NMD7wY/image.jpg","fqdn":"i.ibb.co","domain":"ibb.co","tld":"co"},"ip":{"addr":"45.43.142.6","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","date":"2026-09-17T07:45:41.836Z","timestamp":1789631141836,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ibb.co","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 21:52:48 GMT","end":"Tue, 10 Nov 2026 21:52:47 GMT"},"fingerprint":{"sha1":"2F:89:8C:0E:0D:5A:32:08:66:DB:ED:13:DC:0A:60:1E:F1:27:D6:7C","sha256":"69:B6:46:09:83:BD:EC:DC:D7:58:12:75:FA:A5:C2:22:BA:67:5E:C8:27:39:AC:F1:20:06:D1:14:1B:20:E7:D5"}}},"request":{"raw":"GET /p6NMD7wY/image.jpg HTTP/1.1\r\nHost: i.ibb.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Thu, 17 Sep 2026 07:45:42 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 4665\r\nlast-modified: Fri, 28 Mar 2025 11:04:23 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4665,"size_decoded":5030,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 91x113, components 3","md5":"ed93bf5558b7677bdd8a4adb4c7eba59","sha1":"8eeb0304a9921f2af6025ba9f679a5e77e1cd296","sha256":"f21f84dcb50f2ec2b381b738b4787294c8850f1eec38c2a4997abb44e1e8fc88","sha512":"1ccd9a03b9f0695f7e0e1fc190c02af10d3d97b1464ea47f576c1212fff6b411a06b6b5bdbd479ba084da51db795ea068ceb4e310c3ebfe0a399f9718fa73da3","ssdeep":"96:uIE0CJ1ZIZwQYLPJQ4e8DZaecwQTL0NDMSJQv8XoE5WGPItPP2S:zxIhdEYN1CuWJHl","tlshash":"17a15e26d7437f12efc1a0f92c27c2c1865fb3a16d476a2630b0c51db4db4c246599d4","first_seen":"2026-07-31T06:59:35.515492Z","last_seen":"2026-09-17T07:46:10.509692Z","times_seen":13,"resource_available":false,"data":null}},"time_used":377,"timings":{"blocked":-1,"dns":2,"connect":32,"send":0,"wait":35,"receive":0,"ssl":306},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.ibb.co/m5jbSNV4/Adobe.jpg","fqdn":"i.ibb.co","domain":"ibb.co","tld":"co"},"ip":{"addr":"45.43.142.6","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","date":"2026-09-17T07:45:41.837Z","timestamp":1789631141837,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ibb.co","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 21:52:48 GMT","end":"Tue, 10 Nov 2026 21:52:47 GMT"},"fingerprint":{"sha1":"2F:89:8C:0E:0D:5A:32:08:66:DB:ED:13:DC:0A:60:1E:F1:27:D6:7C","sha256":"69:B6:46:09:83:BD:EC:DC:D7:58:12:75:FA:A5:C2:22:BA:67:5E:C8:27:39:AC:F1:20:06:D1:14:1B:20:E7:D5"}}},"request":{"raw":"GET /m5jbSNV4/Adobe.jpg HTTP/1.1\r\nHost: i.ibb.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Thu, 17 Sep 2026 07:45:41 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 61704\r\nlast-modified: Tue, 04 Mar 2025 11:12:44 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":61704,"size_decoded":62070,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, orientation=upper-left], baseline, precision 8, 1536x753, components 3","md5":"15cb95a64d362f53b6fb25979b283f7c","sha1":"ab4e6cd856c7889fe6728ef52de184641aa7a69f","sha256":"11c8c0a239ddaea67c443cd36cccd1e9a9ce14b531bd8779772c12e896e78a73","sha512":"298004d199f837bf9d6a0144dd047a46f429b91126a3700e0e44aa490adcb5bba6d2b2e0575f864ae6c38f4d8f4311365ddfc2935a0347891151612071324f91","ssdeep":"1536:rg/V3Q877QB3ztLU5WWWZx4vekVaU4hMdO:S31LWWWZue79R","tlshash":"32535e138c188b43a02897a9be134f6c1f597e5ca9877aff00671dcb7a607615c9e13e","first_seen":"2026-08-18T00:56:24.470319Z","last_seen":"2026-09-17T07:46:10.511119Z","times_seen":7,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":1,"connect":32,"send":0,"wait":106,"receive":46,"ssl":74},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/favicon.ico","fqdn":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","domain":"pastehtml.dev","tld":"dev"},"ip":{"addr":"104.21.79.40","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev/","date":"2026-09-17T07:45:42.198Z","timestamp":1789631142198,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pastehtml.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Aug 2026 02:18:02 GMT","end":"Fri, 06 Nov 2026 03:15:20 GMT"},"fingerprint":{"sha1":"56:10:F6:3B:B4:3D:AC:D0:14:87:46:82:35:EA:4D:90:18:5A:A5:DB","sha256":"BD:25:46:DE:10:2B:BC:2F:6A:7F:24:7C:02:2C:65:65:CE:C6:5A:5C:35:C6:9D:93:CC:AE:91:62:5F:2F:CC:87"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 \r\ncache-control: max-age=14400\r\ncontent-type: image/x-icon\r\ndate: Thu, 17 Sep 2026 07:45:42 GMT\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nvary: Accept-Encoding\r\nx-cache: miss\r\nx-request-id: 9175ff44-5742-48b1-aac0-4aa9dbe4fa0a\r\nx-runtime: 0.000540\r\ncf-cache-status: EXPIRED\r\nserver: cloudflare\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=089uBtucF%2FXQWPnxo2ewBT2gIeN9UqB%2F5QCPMheufkK9xfSwLao3OatB3xsTg2dRiBL0oky%2Fr4ZFwnvuALtfCuC2k290p4FTDXkpISEXDAe%2FBdCUZpWivAtoNRcYL0Q7QquMzWeCbN%2FJ4r%2B6Mva47051fZm%2Fcmv1xlteZmx0IPnI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3c67e2eced47127-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":805,"mime_type":"image/x-icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-17T09:51:44.181166Z","times_seen":18513227,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-17","alert":"Phishing Block","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"7afm4c1p0vivd8ae9p2zftpfe9kfqgc2.pastehtml.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}}]}