{"report_id":"f763c316-7724-4e24-a6b7-0011e7e4351f","version":0,"status":"done","tags":[],"date":"2026-07-07T20:29:09Z","url":{"schema":"https","addr":"slon2.to/","fqdn":"slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"138.113.181.189","port":0,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"final":{"url":{"schema":"https","addr":"captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"title":"Captcha","dom":{"size":20276,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15565)","md5":"7a796cad6c1b759e20e9adfe896b91c5","sha1":"77376c73b3d03f223708501dc89fd8ac3d29e05c","sha256":"e0df4a41336ba109f31b209616c9ce56b6e9a3f03c993eb74717d5dcdd1fe541","sha512":"bd8bc058dae4a834845d1b722604d299b88a6d3828e77feab915ee70a1a65470a51a7743a56fb6d71713aa9af65fa29759ea91552fe115348737cac25b07dc82","ssdeep":"384:f2ySpn8Ee4Gj4rv8g/EmKT222FDYDacw6vuNzx9v3kAKq+HCaGWS8Fx:fn94rkg/ERGtaaauNzxtIq+kWS8Fx","tlshash":"d792bf26b45740d26d629c1abfc729a55a2ec027d206daa53f4c63d44fcf0990bfb74c","dom_hash":"domhashc52374264a31a8db631165d44312f1a3","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"slon2.to/","fqdn":"slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"138.113.181.189","port":0,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-11T20:29:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-07","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"slon2.to/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-07","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"captcha.slon2.to/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"captcha.slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"captcha.slon2.to","ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-05T21:52:20.666538Z","last_seen":"2026-03-05T21:52:20.666538Z","alert_count":10,"request_count":8,"received_data":538143,"sent_data":6815,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-05T22:19:28.847206Z","alert_count":0,"request_count":2,"received_data":68878,"sent_data":1153,"comment":"","tags":null,"fingerprints":null},{"fqdn":"slon2.to","ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-05T21:52:20.664701Z","last_seen":"2026-03-05T21:52:20.664701Z","alert_count":6,"request_count":5,"received_data":261437,"sent_data":3826,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-05T22:22:24.069932Z","alert_count":0,"request_count":1,"received_data":10792,"sent_data":532,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"slon2.to/_fec_sbu/fec_wrapper.js","fqdn":"slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"b85560f9190e198947255ac31640310a","sha1":"4dd3db99b8fb32f4b62f7727a2a4dbe8171cdbef","sha256":"58f4453b72abcfa27996828e92c554042fa2fd1cb9cecfa0ff9fe9f0df7a7498","sha512":"ee0c8fa8952bf735042a5a040876115beb0c8c8b60442dc5a62f9f8e631b63139080801ee41708b8c1c9e9ee07677f1565fbf7548c8d8e0271e4265933868155","ssdeep":"","tlshash":"8fe0ab39c43da6f6507281604ab791b86c278230d1268f89b3a9ba3a004f112070b48b","size":419,"data":"","first_seen":"2026-07-07T20:29:12.54147Z","last_seen":"2026-07-07T20:29:12.54147Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"slon2.to/_fec_sbu/hxk_fec_16b50213.js","fqdn":"slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","size":254298,"data":"","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-23T15:04:32.356621Z","times_seen":77,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-07","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"slon2.to/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/_fec_sbu/fec_wrapper.js","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"c1a322a93403d6f997b27d4d1ff1a9ce","sha1":"74046ca9998b3e2b42cca6dae36135cc417e9efd","sha256":"e4951a951996637c31a71777785ea04b08e9171db871f9745a66c33582d2149f","sha512":"00a64090b9374c29f83e7c4ccbb0d518ee1e1ecbbafb3a45b3957f536f807920893af6dc549f2982a1c49b7f50f54acc629c80224e7f62613f4c57bc2b3c79b3","ssdeep":"","tlshash":"36e0a32fc02a2d9e10ec41c6d57b91db9e35636465bd09741088b7719084e055c4741e","size":419,"data":"","first_seen":"2026-07-07T20:29:12.538907Z","last_seen":"2026-07-07T20:29:12.538907Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/_fec_sbu/hxk_fec_16b50213.js","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","size":254298,"data":"","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-23T15:04:32.356621Z","times_seen":77,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-07","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"captcha.slon2.to/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/_fec_sbu/fec_wrapper.js","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ca98a0e29a28e4bf61b2729db4b9be4","sha1":"de2feabee25c51f39fec74b06a9c053c013db113","sha256":"25218c2a4fee5d7e61d4e90eaf114cb95045eb144281c29e1c8e92483662c553","sha512":"5fc14f7c3ccbe33a43569a60c2277ccde309147dd16d409755e54d600e91ecc1a41c5e6e7f4f56acdd307c69a7ed33ca59ed183d5bbc65602bbe676bf6e72df7","ssdeep":"","tlshash":"75e0f126c1655f42b3e19d71c47c8deb344cc3b066d08dc1194c3e30b5ad6e91a4a3e2","size":419,"data":"","first_seen":"2026-07-07T20:29:12.544142Z","last_seen":"2026-07-07T20:29:12.544142Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"captcha.slon2.to/_fec_sbu/hxk_fec_16b50213.js","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","date":"2026-07-07T20:28:48.193Z","timestamp":1783456128193,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /_fec_sbu/hxk_fec_16b50213.js HTTP/1.1\r\nHost: captcha.slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/\r\nCookie: FECWS=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81; FECAS=58DW8vsRR7IE+eZzIV+R2YkxSdFzq+pjRMiptsYGEn7CmqR0FGVN+BhLCK+vOVijqC5JtLKcmvFyoxODFcOZVBsIwZj9MmLm64n4fRrNt35zYY8auV4sTjw8nMOcDYc1nEt48nL4UWyYOgK00La6R/v8nSBcghQgQ0uRRoMQLn9zU5oYVwukiiletwTp8Rfgr3; route=5; server_id=csrv_16; user_id=\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 07 Jul 2026 20:28:48 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 PS-AMS-04LvF160:2 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht PS-AMS-04LvF160AMS\r\nx-ws-request-id: 6a4d6180_PS-AMS-04LvF160_39681-17787\r\nCache-Control: no-cache\r\netag: _16b50213\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":254298,"size_decoded":73440,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (36088)","md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-23T15:04:32.356621Z","times_seen":77,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-07","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"captcha.slon2.to/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"captcha.slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","date":"2026-07-07T20:28:48.582Z","timestamp":1783456128582,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:01 GMT","end":"Mon, 07 Sep 2026 08:41:00 GMT"},"fingerprint":{"sha1":"01:31:A1:A6:4F:08:45:E1:F0:0B:CE:B1:B8:D8:61:D7:D1:70:ED:6F","sha256":"29:C5:5D:01:47:6E:72:F7:2C:CC:0B:96:BB:67:BA:39:CC:03:11:EB:7B:47:F5:3F:CC:DE:12:AC:68:07:A1:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://captcha.slon2.to\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 02 Jul 2026 01:48:31 GMT\r\nexpires: Fri, 02 Jul 2027 01:48:31 GMT\r\ncache-control: public, max-age=31536000\r\nage: 499217\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-07-23T17:50:34.818928Z","times_seen":243868,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":30,"send":0,"wait":16,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","date":"2026-07-07T20:28:48.584Z","timestamp":1783456128584,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:01 GMT","end":"Mon, 07 Sep 2026 08:41:00 GMT"},"fingerprint":{"sha1":"01:31:A1:A6:4F:08:45:E1:F0:0B:CE:B1:B8:D8:61:D7:D1:70:ED:6F","sha256":"29:C5:5D:01:47:6E:72:F7:2C:CC:0B:96:BB:67:BA:39:CC:03:11:EB:7B:47:F5:3F:CC:DE:12:AC:68:07:A1:BA"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://captcha.slon2.to\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 03 Jul 2026 18:21:45 GMT\r\nexpires: Sat, 03 Jul 2027 18:21:45 GMT\r\ncache-control: public, max-age=31536000\r\nage: 353223\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":18720,"size_decoded":19533,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-07-23T17:01:57.960398Z","times_seen":10999,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":28,"dns":0,"connect":0,"send":0,"wait":19,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-07T20:28:47.938Z","timestamp":1783456127938,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /?ref=slon2.to\u0026shop2go=/ HTTP/1.1\r\nHost: captcha.slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/\u0026ws_referrer_origin=https%3A%2F%2Fslon2.to%2F\r\nCookie: FECWS=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81; FECAS=58DW8vsRR7IE+eZzIV+R2YkxSdFzq+pjRMiptsYGEn7CmqR0FGVN+BhLCK+vOVijqC5JtLKcmvFyoxODFcOZVBsIwZj9MmLm64n4fRrNt35zYY8auV4sTjw8nMOcDYc1nEt48nL4UWyYOgK00La6R/latyjB0iQM8RzXorQ8M0MAXlxl00qKhF3jNXaHW7/OP3\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Tue, 07 Jul 2026 20:28:48 GMT\r\nContent-Type: text/html;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nSet-Cookie: route=5; Expires=Wed, 08-Jul-2026 20:28:47 GMT; Path=/\nserver_id=csrv_16\nuser_id=\r\nContent-Language: en-US\r\nvia: 1.1 PS-AMS-04LvF160:17 (W)\r\nX-Px: ms PS-AMS-04LvF160AMS(origin)\r\nx-ws-request-id: 6a4d617f_PS-AMS-04LvF160_42974-64857\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":20286,"size_decoded":13973,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15566)","md5":"491a719bab28b6e6beb9f8be3ce43560","sha1":"a5f08507b3c93093904060acd184fb59b47e9c65","sha256":"91ee9c0843196341a58c3fb26630ec44a060ea51d3340ac14c8e943f7fd237fe","sha512":"94e86fd6e8c3e2092aff8ca4fefcdc2dc9dbcd8e0eb4e4332264720dea58f7d5fa921941056f58b8f1d310d0dd672271584d7e1bf60636b2c2ac476c09a7256a","ssdeep":"384:R2yWon8Ee4Gj4rv8g/EmKT222FDYDacw6vuNzx9v3kAKq+HCaGl8JFc:RO94rkg/ERGtaaauNzxtIq+kl8JFc","tlshash":"9c92cf26b44741d26d229c1abfc729a55a2ec027d206daa53f4c63d44fcf0990bfb78c","first_seen":"2026-07-07T20:29:12.536726Z","last_seen":"2026-07-07T20:29:12.536726Z","times_seen":1,"resource_available":true,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"captcha.slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon2.to/","fqdn":"slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-07T20:28:46.825Z","timestamp":1783456126825,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 406 Not Acceptable\r\nDate: Tue, 07 Jul 2026 20:28:46 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 VM-ARN-01AFE29:0 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nx-ws-request-id: 6a4d617e_VM-ARN-01AFE29_3390-43138\r\nCache-Control: no-store\r\nSet-Cookie: FECW=09198b6a2c9d2ea1cda5315272ae8b926818214b88d91b1275e4fdfb1d3e1bea9a6cb6c5bda46b34497bf25ee9ade0ba0bd165abba46f3978e375a015693aa5e058becab56253f692f6b087f17ac3d6041; Expires=Fri, 04-Jul-36 20:28:46 GMT; Path=/; Secure\nFECWS=09198b6a2c9d2ea1cda5315272ae8b926818214b88d91b1275e4fdfb1d3e1bea9a6cb6c5bda46b34497bf25ee9ade0ba0bd165abba46f3978e375a015693aa5e058becab56253f692f6b087f17ac3d6041; Expires=Fri, 04-Jul-36 20:28:46 GMT; Path=/; Secure; SameSite=None\r\n\r\n","headers":null,"cookies":null,"status_code":"406","status_text":"Not Acceptable","fingerprints":null,"data":{"size":594,"size_decoded":1370,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (397)","md5":"6f9363a0c845c7d9acf2d9ef7326cda5","sha1":"5029e1f45cfd3a5f20fe17e11e8289a0e7111c85","sha256":"8f6a5bc3338214de65e445f90c18f669c416e1bcfd5ec7bf871a1c96180cce12","sha512":"6b94eab8cffcc8e84d82a71ab92ceb954c548f882266bb756d4e289aa9a4b1e3ba1b44bf9a39b2027b56731e998e628f49b64e12478e9bce41a07d301b3b41ca","ssdeep":"","tlshash":"75f047df9d21ff6304486da9e5f5c62a61420704d512d94d37cc305497655fc1cc4308","first_seen":"2026-07-07T20:29:12.537889Z","last_seen":"2026-07-07T20:29:12.537889Z","times_seen":1,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":25,"connect":9,"send":0,"wait":13,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/_fec_sbu/fec_wrapper.js","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","date":"2026-07-07T20:28:47.654Z","timestamp":1783456127654,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /_fec_sbu/fec_wrapper.js HTTP/1.1\r\nHost: captcha.slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/\r\nCookie: FECW=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81; FECWS=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 07 Jul 2026 20:28:47 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 PS-AMS-04LvF160:17 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht PS-AMS-04LvF160AMS\r\nx-ws-request-id: 6a4d617f_PS-AMS-04LvF160_42974-64850\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":419,"size_decoded":694,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (361)","md5":"c1a322a93403d6f997b27d4d1ff1a9ce","sha1":"74046ca9998b3e2b42cca6dae36135cc417e9efd","sha256":"e4951a951996637c31a71777785ea04b08e9171db871f9745a66c33582d2149f","sha512":"00a64090b9374c29f83e7c4ccbb0d518ee1e1ecbbafb3a45b3957f536f807920893af6dc549f2982a1c49b7f50f54acc629c80224e7f62613f4c57bc2b3c79b3","ssdeep":"","tlshash":"36e0a32fc02a2d9e10ec41c6d57b91db9e35636465bd09741088b7719084e055c4741e","first_seen":"2026-07-07T20:29:12.538907Z","last_seen":"2026-07-07T20:29:12.538907Z","times_seen":1,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"captcha.slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/favicon.ico","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","date":"2026-07-07T20:28:48.572Z","timestamp":1783456128572,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: captcha.slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/\r\nCookie: FECWS=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81; FECAS=58DW8vsRR7IE+eZzIV+R2YkxSdFzq+pjRMiptsYGEn7CmqR0FGVN+BhLCK+vOVijqC5JtLKcmvFyoxODFcOZVBsIwZj9MmLm64n4fRrNt35zYY8auV4sTjw8nMOcDYc1nEt48nL4UWyYOgK00La6R/pbPyt3tAsN9x6n8AJ3tDxL35o7tCHb8b8LW1aqZ41PM3; route=5; server_id=csrv_16; user_id=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 07 Jul 2026 20:28:48 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nAge: 36133\r\nx-ws-request-id: 6a4d6180_PS-AMS-04LvF160_39681-17800\r\nvia: 1.1 PS-AMS-04LvF160:2 (W)\r\nX-Px: ht PS-AMS-04LvF160AMS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":250,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T17:51:01.341379Z","times_seen":17481265,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"captcha.slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon2.to/_fec_sbu/hxk_fec_16b50213.js","fqdn":"slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://slon2.to/","date":"2026-07-07T20:28:47.125Z","timestamp":1783456127125,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /_fec_sbu/hxk_fec_16b50213.js HTTP/1.1\r\nHost: slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://slon2.to/\r\nCookie: FECW=09198b6a2c9d2ea1cda5315272ae8b926818214b88d91b1275e4fdfb1d3e1bea9a6cb6c5bda46b34497bf25ee9ade0ba0bd165abba46f3978e375a015693aa5e058becab56253f692f6b087f17ac3d6041; FECWS=09198b6a2c9d2ea1cda5315272ae8b926818214b88d91b1275e4fdfb1d3e1bea9a6cb6c5bda46b34497bf25ee9ade0ba0bd165abba46f3978e375a015693aa5e058becab56253f692f6b087f17ac3d6041\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 07 Jul 2026 20:28:47 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 VM-ARN-01AFE29:5 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nx-ws-request-id: 6a4d617f_VM-ARN-01AFE29_4190-34651\r\nCache-Control: no-cache\r\netag: _16b50213\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":254298,"size_decoded":73436,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (36088)","md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-23T15:04:32.356621Z","times_seen":77,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":8,"send":0,"wait":22,"receive":8,"ssl":13},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-07","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"slon2.to/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon2.to/","fqdn":"slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-07T20:28:47.418Z","timestamp":1783456127418,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://slon2.to/?ws_referrer_origin=ws_referrer_delete\r\nCookie: FECWS=09198b6a2c9d2ea1cda5315272ae8b926818214b88d91b1275e4fdfb1d3e1bea9a6cb6c5bda46b34497bf25ee9ade0ba0bd165abba46f3978e375a015693aa5e058becab56253f692f6b087f17ac3d6041; FECAS=6PYa1jaGQiZij2TX0M7O2s+FoWnbhJZnj1cQqRRhKxOrHyhFjWc+8V2ZPdp6YxL1y7DT9NaJSsJ7UvxzcBLcNcLH/OryxCQIv7u9oZaLc6y3fH507uqIflkMMMAJyUpZPzWk2mYG1jKdk/YJG1Q3oypYpvvR00ZIYHBJqjq5g+hjfy0l7y7gt+jlVplMMJTRce\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nDate: Tue, 07 Jul 2026 20:28:47 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nLocation: https://captcha.slon2.to?ref=slon2.to\u0026shop2go=/\r\nSet-Cookie: server=;Max-Age=1\ncaptcha_uid=;Max-Age=1\r\nvia: 1.1 VM-ARN-01AFE29:5 (W)\r\nX-Px: ms VM-ARN-01AFE29ARN(origin)\r\nx-ws-request-id: 6a4d617f_VM-ARN-01AFE29_4190-34659\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Moved Temporarily","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T17:51:01.341379Z","times_seen":17481265,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@300;400;500;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","date":"2026-07-07T20:28:48.399Z","timestamp":1783456128399,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:02 GMT","end":"Mon, 07 Sep 2026 08:41:01 GMT"},"fingerprint":{"sha1":"FD:DA:E1:3E:1F:AC:E0:96:14:ED:37:58:30:0F:ED:9D:B4:5E:F1:EF","sha256":"7D:36:0C:A4:14:F6:05:8D:F4:E1:CD:BF:84:A7:03:AD:3F:C4:93:AE:B3:D6:7E:99:CB:92:D7:1F:29:A1:49:A4"}}},"request":{"raw":"GET /css2?family=Inter:wght@300;400;500;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon2.to/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 07 Jul 2026 20:28:48 GMT\r\ndate: Tue, 07 Jul 2026 20:28:48 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":1446,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"1be305145d51ecbeb52ba67f2208dea9","sha1":"6f97fc00e9d6771004cb17d53c7ff7d62011e78e","sha256":"5fb68a19bfedc1331144c73515b5cc021af26ac8605c62e73a31771a0e19ee62","sha512":"b3a73238231bbeeaf01907f0e3a78d4221d24b50de71345c66a6d6a4ff6afb5fd8d88b242a57ba35d37f0466edc6d3a19c7e02dfd4563d2ee565ca2cc06182c6","ssdeep":"192:wNA1cO3lnxirNNIxO34OxDENOPCO3/Nx8ONEhYO3RrxGx:8KYXuM1+4","tlshash":"dd227792002ba400ab971dc233cf7f3aaece10896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-11T03:25:11.707221Z","last_seen":"2026-07-22T17:23:02.660568Z","times_seen":3975,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":40,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/css/normalize.css","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","date":"2026-07-07T20:28:48.402Z","timestamp":1783456128402,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /css/normalize.css HTTP/1.1\r\nHost: captcha.slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/\r\nCookie: FECWS=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81; FECAS=58DW8vsRR7IE+eZzIV+R2YkxSdFzq+pjRMiptsYGEn7CmqR0FGVN+BhLCK+vOVijqC5JtLKcmvFyoxODFcOZVBsIwZj9MmLm64n4fRrNt35zYY8auV4sTjw8nMOcDYc1nEt48nL4UWyYOgK00La6R/v8nSBcghQgQ0uRRoMQLn9zU5oYVwukiiletwTp8Rfgr3; route=5; server_id=csrv_16; user_id=\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 07 Jul 2026 20:28:48 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nLast-Modified: Sat, 18 Apr 2026 15:43:37 GMT\r\nAccept-Ranges: bytes\r\nAge: 42441\r\nx-ws-request-id: 6a4d6180_PS-AMS-04LvF160_42974-64866\r\nvia: 1.1 PS-AMS-04LvF160:17 (W)\r\nX-Px: ht PS-AMS-04LvF160AMS\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":4461,"size_decoded":1808,"mime_type":"text/css","magic":"ASCII text","md5":"aab74d6ca10a0902b9fac0e304c4be13","sha1":"7cc28584e1cd4acf258f32322b198faa19e2c47c","sha256":"6b1e238b3810eef313f24f098db4d880175b3ed1168f0c9faaaff9b53089c2fa","sha512":"8908ebef958dec57ec62f0841a1631bfa992ce53e13a55fe00686f1c3ecabedfb662d50d5e567c69c03b0470de149c2bddeaa1a9f9903cfce4bdccfc5ffe1d27","ssdeep":"48:z2Gaml89fIcJq7e/BQLQ1nrnccRjXdmnm/IZvJzXsacPaQfk:KM89fI6z/tTnWHO1c","tlshash":"549151651b604f11522b4e38339beb1533188233895d38ececa199edcf8675bd6d17ca","first_seen":"2023-04-18T10:14:13Z","last_seen":"2026-07-22T17:23:02.6637Z","times_seen":1259,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"captcha.slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon2.to/_fec_sbu/fec_wrapper.js","fqdn":"slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://slon2.to/","date":"2026-07-07T20:28:47.123Z","timestamp":1783456127123,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /_fec_sbu/fec_wrapper.js HTTP/1.1\r\nHost: slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://slon2.to/\r\nCookie: FECW=09198b6a2c9d2ea1cda5315272ae8b926818214b88d91b1275e4fdfb1d3e1bea9a6cb6c5bda46b34497bf25ee9ade0ba0bd165abba46f3978e375a015693aa5e058becab56253f692f6b087f17ac3d6041; FECWS=09198b6a2c9d2ea1cda5315272ae8b926818214b88d91b1275e4fdfb1d3e1bea9a6cb6c5bda46b34497bf25ee9ade0ba0bd165abba46f3978e375a015693aa5e058becab56253f692f6b087f17ac3d6041\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 07 Jul 2026 20:28:47 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 VM-ARN-01AFE29:0 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht VM-ARN-01AFE29ARN\r\nx-ws-request-id: 6a4d617f_VM-ARN-01AFE29_3390-43142\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":419,"size_decoded":689,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (361)","md5":"b85560f9190e198947255ac31640310a","sha1":"4dd3db99b8fb32f4b62f7727a2a4dbe8171cdbef","sha256":"58f4453b72abcfa27996828e92c554042fa2fd1cb9cecfa0ff9fe9f0df7a7498","sha512":"ee0c8fa8952bf735042a5a040876115beb0c8c8b60442dc5a62f9f8e631b63139080801ee41708b8c1c9e9ee07677f1565fbf7548c8d8e0271e4265933868155","ssdeep":"","tlshash":"8fe0ab39c43da6f6507281604ab791b86c278230d1268f89b3a9ba3a004f112070b48b","first_seen":"2026-07-07T20:29:12.54147Z","last_seen":"2026-07-07T20:29:12.54147Z","times_seen":1,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon2.to/favicon.ico","fqdn":"slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"138.113.181.189","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://slon2.to/","date":"2026-07-07T20:28:47.370Z","timestamp":1783456127370,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://slon2.to/\r\nCookie: FECWS=09198b6a2c9d2ea1cda5315272ae8b926818214b88d91b1275e4fdfb1d3e1bea9a6cb6c5bda46b34497bf25ee9ade0ba0bd165abba46f3978e375a015693aa5e058becab56253f692f6b087f17ac3d6041; FECAS=6PYa1jaGQiZij2TX0M7O2s+FoWnbhJZnj1cQqRRhKxOrHyhFjWc+8V2ZPdp6YxL1y7DT9NaJSsJ7UvxzcBLcNcLH/OryxCQIv7u9oZaLc6y3fH507uqIflkMMMAJyUpZPzWk2mYG1jKdk/YJG1Q3oyv0vhfGLl+7YZ/z3CLFak9oSwQLNp6KWw7H9SokwEVv2e\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 07 Jul 2026 20:28:47 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 3870\r\nConnection: keep-alive\r\nServer: PWS/8.3.1.0.8\r\nLast-Modified: Fri, 03 Jul 2026 12:30:15 GMT\r\nETag: \"6a47ab57-f1e\"\r\nAccept-Ranges: bytes\r\nAge: 14693\r\nx-ws-request-id: 6a4d617f_VM-ARN-01AFE29_4190-34656\r\nvia: 1.1 VM-ARN-01AFE29:5 (W)\r\nX-Px: ht VM-ARN-01AFE29ARN\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3870,"size_decoded":4237,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 4 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 32 bits/pixel, 24x24 with \n- PNG image data, 24 x 24, 8-bit colormap, non-interlaced, 32 bits/pixel","md5":"c92b85a5b907c70211f4ec25e29a8c4a","sha1":"1120538c77ad1f28a89243b4b53fe2ac16cc3bc6","sha256":"3d10f7da6c603178340081668c4ac5b3ae9743ca9a262ab0fcd312fbb9f48bdd","sha512":"d792613e3c31d3aea08ae9ce51a26498afed8b48c93290640c64d0a23edc85e524bc1d090b5ba3fa161b3f2f7d31f9d1da5db77b14189fc3f8ed81ff830fa70c","ssdeep":"","tlshash":"26815cb31b994539e5cb0317fa069036d8f1d11e09b5493e1a938c05ad2fe99c26a36e","first_seen":"2023-04-12T20:45:07Z","last_seen":"2026-07-23T14:26:55.146448Z","times_seen":11277,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-07T20:28:47.459Z","timestamp":1783456127459,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /?ref=slon2.to\u0026shop2go=/ HTTP/1.1\r\nHost: captcha.slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://slon2.to/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 406 Not Acceptable\r\nDate: Tue, 07 Jul 2026 20:28:47 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 PS-AMS-04LvF160:17 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht PS-AMS-04LvF160AMS\r\nx-ws-request-id: 6a4d617f_PS-AMS-04LvF160_42974-64846\r\nCache-Control: no-store\r\nSet-Cookie: FECW=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81; Expires=Fri, 04-Jul-36 20:28:47 GMT; Path=/; Secure\nFECWS=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81; Expires=Fri, 04-Jul-36 20:28:47 GMT; Path=/; Secure; SameSite=None\r\n\r\n","headers":null,"cookies":null,"status_code":"406","status_text":"Not Acceptable","fingerprints":null,"data":{"size":635,"size_decoded":1416,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (397)","md5":"0432b14c11ffbc4cd06e6abf1fd01243","sha1":"779abc9fe03403429240d714cfa3f52de6ed237e","sha256":"349e3412128e0ddec1601222cb2c3555ec810af5d1a6730700e4c0023c1de602","sha512":"9b23c86adbdafcc0d6192866ec60b07cbb027faccedc73968745805043bdcdfba2f705443d0fdc0c743b0f626ff2dc7743114c9a31f6595987f1bd8a23a53e63","ssdeep":"","tlshash":"a7f0028dcd76e95e4542adcc98f4a21d88e05f4dae5a401dbbe542462be87cd0c8da0d","first_seen":"2026-07-07T20:29:12.543227Z","last_seen":"2026-07-07T20:29:12.543227Z","times_seen":1,"resource_available":true,"data":null}},"time_used":128,"timings":{"blocked":0,"dns":15,"connect":27,"send":0,"wait":29,"receive":0,"ssl":57},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"captcha.slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/_fec_sbu/hxk_fec_16b50213.js","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","date":"2026-07-07T20:28:47.655Z","timestamp":1783456127655,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /_fec_sbu/hxk_fec_16b50213.js HTTP/1.1\r\nHost: captcha.slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/\r\nCookie: FECW=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81; FECWS=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 07 Jul 2026 20:28:47 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 PS-AMS-04LvF160:17 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht PS-AMS-04LvF160AMS\r\nx-ws-request-id: 6a4d617f_PS-AMS-04LvF160_42974-64851\r\nCache-Control: no-cache\r\netag: _16b50213\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":254298,"size_decoded":73441,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (36088)","md5":"40ee38fae4417d2c970a10da9a206e6f","sha1":"dcde41287f2359523dd0f5f91333b35e40cbec08","sha256":"e963f12ab2c674d09d2cf152f5022f00fc997bd203a1ad769c1bc722583af9f2","sha512":"3b0c55ac563ab44bab3d5f50bc0e5d6ada324aa68313a74154f5a5a1062516aa12dd655f172320cd9c7efbb795ab6c15b84d15bb3e8a8c291ff98437d8d6a22e","ssdeep":"3072:tK9LIuNmJvrnLESR4UCuxopuAEeKqbBC4fdDGlbUVf91d9iMKf99/P4nA3ICmi5c:OwvrnASR4eopjEeKqb3qkf9X","tlshash":"8c446060e3c1688513979fba771fb5d1e95a446a39050847f01cbff0bfa8a13aad1db0","first_seen":"2026-03-20T03:12:04.500829Z","last_seen":"2026-07-23T15:04:32.356621Z","times_seen":77,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":27,"send":0,"wait":36,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-07-07","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"captcha.slon2.to/_fec_sbu/hxk_fec_16b50213.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"captcha.slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"captcha.slon2.to/_fec_sbu/fec_wrapper.js","fqdn":"captcha.slon2.to","domain":"slon2.to","tld":"to"},"ip":{"addr":"163.171.160.192","port":443,"asn":54994,"as":"ML-1432-54994","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/","date":"2026-07-07T20:28:48.192Z","timestamp":1783456128192,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"captcha.slon2.to","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 14:06:48 GMT","end":"Thu, 01 Oct 2026 14:06:47 GMT"},"fingerprint":{"sha1":"BB:59:73:4C:20:CF:FA:FD:74:1D:B0:DC:E3:E0:C7:04:AA:62:CF:FD","sha256":"32:C3:56:7C:12:0B:7D:D8:F8:80:80:4E:2B:CA:12:A4:B5:F6:E0:BD:F2:49:06:D6:87:2C:97:AC:30:A1:F5:0B"}}},"request":{"raw":"GET /_fec_sbu/fec_wrapper.js HTTP/1.1\r\nHost: captcha.slon2.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://captcha.slon2.to/?ref=slon2.to\u0026shop2go=/\r\nCookie: FECWS=59bb9eb7aeb317ec5055380ab3d1b87d67b24cb5fe6c5c669a42a126bc0ce966d7b9d5009e137d66e3a9abfd19da09631cf164ce8a71a90e068fdb73502aac0cc210bf36d0ffee1f91fd13a13fefd6da81; FECAS=58DW8vsRR7IE+eZzIV+R2YkxSdFzq+pjRMiptsYGEn7CmqR0FGVN+BhLCK+vOVijqC5JtLKcmvFyoxODFcOZVBsIwZj9MmLm64n4fRrNt35zYY8auV4sTjw8nMOcDYc1nEt48nL4UWyYOgK00La6R/v8nSBcghQgQ0uRRoMQLn9zU5oYVwukiiletwTp8Rfgr3; route=5; server_id=csrv_16; user_id=\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 07 Jul 2026 20:28:48 GMT\r\nContent-Type: text/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nvia: 1.1 PS-AMS-04LvF160:17 (W)\r\nServer: PWS/8.3.1.0.8\r\nX-Px: ht PS-AMS-04LvF160AMS\r\nx-ws-request-id: 6a4d6180_PS-AMS-04LvF160_42974-64861\r\nCache-Control: no-store\r\nContent-Encoding: gzip\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":419,"size_decoded":693,"mime_type":"text/javascript","magic":"ASCII text, with very long lines (361)","md5":"4ca98a0e29a28e4bf61b2729db4b9be4","sha1":"de2feabee25c51f39fec74b06a9c053c013db113","sha256":"25218c2a4fee5d7e61d4e90eaf114cb95045eb144281c29e1c8e92483662c553","sha512":"5fc14f7c3ccbe33a43569a60c2277ccde309147dd16d409755e54d600e91ecc1a41c5e6e7f4f56acdd307c69a7ed33ca59ed183d5bbc65602bbe676bf6e72df7","ssdeep":"","tlshash":"75e0f126c1655f42b3e19d71c47c8deb344cc3b066d08dc1194c3e30b5ad6e91a4a3e2","first_seen":"2026-07-07T20:29:12.544142Z","last_seen":"2026-07-07T20:29:12.544142Z","times_seen":1,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-07","alert":"Sinkholed","trigger":"captcha.slon2.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}