{"report_id":"05bac7e1-fd7d-4e85-bfee-f687bb1eb284","version":0,"status":"done","tags":[],"date":"2026-10-13T13:19:30Z","url":{"schema":"https","addr":"tetherleads.site/","fqdn":"tetherleads.site","domain":"tetherleads.site","tld":"site"},"ip":{"addr":"163.61.236.12","port":0,"asn":153634,"as":"CodeNext IT Solution","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"www.tetherleads.site/login","fqdn":"www.tetherleads.site","domain":"tetherleads.site","tld":"site"},"title":"Tether Leads — Login","dom":{"size":11111,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (362)","md5":"f903d6d2d6306ac7712b69a9448c163d","sha1":"2218fde836b21c3455c1f834d0b1efec84cf72b5","sha256":"aa21cd4a22fffc8076b884e2b858d02ba9f3847bd225cbb6744a76df5b92330f","sha512":"1cb8f8230f9e2b43c70f24ea6f21e349c7eba1ea82561bd20225c0a4e059e3c21c877794f6952e58f4c6ac79addbb89f7d907bb153bffbe4adc42efcd1642740","ssdeep":"192:7yE4UEAsEOqFe5khJP6ijtNZ/jG8sjRfV/+ySbFVQS6l:7ydHAs2SMgVWyEzQS6l","tlshash":"743296aa62731816b92399642ba75a4e3129d003d507d9483fec335ccf86edbe97335c","dom_hash":"domhashba389d697eccb3e7cd3107c85076c654","first_seen":"2026-10-13T13:19:34.550962Z","last_seen":"2026-10-13T13:19:34.550962Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"tetherleads.site/","fqdn":"tetherleads.site","domain":"tetherleads.site","tld":"site"},"ip":{"addr":"163.61.236.12","port":0,"asn":153634,"as":"CodeNext IT Solution","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-17T13:19:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"www.tetherleads.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"tetherleads.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"files.catbox.moe","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.tetherleads.site","ip":{"addr":"163.61.236.12","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2026-09-21","domain_rank":0,"first_seen":"2026-10-13T13:05:44.110477Z","last_seen":"2026-10-13T13:05:44.110477Z","alert_count":4,"request_count":4,"received_data":13504,"sent_data":2158,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"tetherleads.site","ip":{"addr":"163.61.236.12","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2026-09-21","domain_rank":0,"first_seen":"2026-10-13T13:05:44.108766Z","last_seen":"2026-10-13T13:05:44.108767Z","alert_count":1,"request_count":1,"received_data":356,"sent_data":485,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"files.catbox.moe","ip":{"addr":"108.181.20.35","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"domain_registered":"2015-04-06","domain_rank":519029,"first_seen":"2015-06-29T23:27:11Z","last_seen":"2026-10-11T09:02:56.796213Z","alert_count":1,"request_count":1,"received_data":134458,"sent_data":545,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.tetherleads.site/login","fqdn":"www.tetherleads.site","domain":"tetherleads.site","tld":"site"},"ip":{"addr":"163.61.236.12","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4b57873799aefc129b0bceb884ebfc94","sha1":"07b3feca5d3283317974c244bf5f9bb733ba1736","sha256":"b778de57ca38fc32f496428cb3ebe214faca9cfe37e3f076477e4e1fc13e82b1","sha512":"c928941cd21570fcc34da0672509f432ab52a9c1b3b14de9a092f59eb97c6745eb45a2cfb1e345e5fb99851c2e63b0bc56b72ec940059d29dbb62e7680824cce","ssdeep":"","tlshash":"2d412cef70b61c310fab49b662131bda313540063816d9c13eec605a1fb4f49a833bca","size":2120,"data":"","first_seen":"2026-09-22T14:06:15.119616Z","last_seen":"2026-10-13T13:19:34.561608Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.tetherleads.site/favicon.ico","fqdn":"www.tetherleads.site","domain":"tetherleads.site","tld":"site"},"ip":{"addr":"163.61.236.12","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.tetherleads.site/login","date":"2026-10-13T13:19:00.008Z","timestamp":1791897540008,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tetherleads.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 21 Sep 2026 19:20:50 GMT","end":"Sun, 20 Dec 2026 19:20:49 GMT"},"fingerprint":{"sha1":"6F:61:8D:80:C7:D5:BA:C6:79:B4:03:2E:0C:CA:47:2E:C4:AF:47:C0","sha256":"3A:DB:0E:84:BF:E8:1C:6D:7A:00:29:D8:E6:FD:DC:27:D6:4F:50:1E:E8:45:75:15:38:5C:23:72:B5:EA:93:57"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.tetherleads.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.tetherleads.site/login\r\nCookie: PHPSESSID=f873a727c67d11573ae5d92921fd6788\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"f873a727c67d11573ae5d92921fd6788"}],"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Tue, 13 Oct 2026 13:19:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-10-13T15:32:18.051132Z","times_seen":159081,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"www.tetherleads.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tetherleads.site/","fqdn":"tetherleads.site","domain":"tetherleads.site","tld":"site"},"ip":{"addr":"163.61.236.12","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-13T13:18:58.399Z","timestamp":1791897538399,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tetherleads.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 21 Sep 2026 19:20:50 GMT","end":"Sun, 20 Dec 2026 19:20:49 GMT"},"fingerprint":{"sha1":"6F:61:8D:80:C7:D5:BA:C6:79:B4:03:2E:0C:CA:47:2E:C4:AF:47:C0","sha256":"3A:DB:0E:84:BF:E8:1C:6D:7A:00:29:D8:E6:FD:DC:27:D6:4F:50:1E:E8:45:75:15:38:5C:23:72:B5:EA:93:57"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tetherleads.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ncontent-type: text/html\r\ncontent-length: 795\r\ndate: Tue, 13 Oct 2026 13:18:58 GMT\r\nserver: LiteSpeed\r\nlocation: https://www.tetherleads.site/\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-13T15:42:38.690533Z","times_seen":19084803,"resource_available":true,"data":null}},"time_used":618,"timings":{"blocked":-1,"dns":224,"connect":97,"send":0,"wait":98,"receive":0,"ssl":199},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"tetherleads.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.tetherleads.site/","fqdn":"www.tetherleads.site","domain":"tetherleads.site","tld":"site"},"ip":{"addr":"163.61.236.12","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-13T13:18:59.026Z","timestamp":1791897539026,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tetherleads.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 21 Sep 2026 19:20:50 GMT","end":"Sun, 20 Dec 2026 19:20:49 GMT"},"fingerprint":{"sha1":"6F:61:8D:80:C7:D5:BA:C6:79:B4:03:2E:0C:CA:47:2E:C4:AF:47:C0","sha256":"3A:DB:0E:84:BF:E8:1C:6D:7A:00:29:D8:E6:FD:DC:27:D6:4F:50:1E:E8:45:75:15:38:5C:23:72:B5:EA:93:57"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.tetherleads.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nset-cookie: PHPSESSID=f873a727c67d11573ae5d92921fd6788; path=/; secure\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\nlocation: login.php\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 13 Oct 2026 13:18:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"f873a727c67d11573ae5d92921fd6788","quoted":false,"path":"/","secure":true,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=f873a727c67d11573ae5d92921fd6788; path=/; secure"}],"status_code":"302","status_text":"Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-13T15:42:38.690533Z","times_seen":19084803,"resource_available":true,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":3,"connect":97,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"www.tetherleads.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.tetherleads.site/login.php","fqdn":"www.tetherleads.site","domain":"tetherleads.site","tld":"site"},"ip":{"addr":"163.61.236.12","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-13T13:18:59.147Z","timestamp":1791897539147,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tetherleads.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 21 Sep 2026 19:20:50 GMT","end":"Sun, 20 Dec 2026 19:20:49 GMT"},"fingerprint":{"sha1":"6F:61:8D:80:C7:D5:BA:C6:79:B4:03:2E:0C:CA:47:2E:C4:AF:47:C0","sha256":"3A:DB:0E:84:BF:E8:1C:6D:7A:00:29:D8:E6:FD:DC:27:D6:4F:50:1E:E8:45:75:15:38:5C:23:72:B5:EA:93:57"}}},"request":{"raw":"GET /login.php HTTP/1.1\r\nHost: www.tetherleads.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=f873a727c67d11573ae5d92921fd6788\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"f873a727c67d11573ae5d92921fd6788"}],"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ncontent-type: text/html\r\ncontent-length: 795\r\ndate: Tue, 13 Oct 2026 13:18:59 GMT\r\nserver: LiteSpeed\r\nlocation: https://www.tetherleads.site/login\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-13T15:42:38.690533Z","times_seen":19084803,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"www.tetherleads.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.tetherleads.site/login","fqdn":"www.tetherleads.site","domain":"tetherleads.site","tld":"site"},"ip":{"addr":"163.61.236.12","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-13T13:18:59.248Z","timestamp":1791897539248,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tetherleads.site","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 21 Sep 2026 19:20:50 GMT","end":"Sun, 20 Dec 2026 19:20:49 GMT"},"fingerprint":{"sha1":"6F:61:8D:80:C7:D5:BA:C6:79:B4:03:2E:0C:CA:47:2E:C4:AF:47:C0","sha256":"3A:DB:0E:84:BF:E8:1C:6D:7A:00:29:D8:E6:FD:DC:27:D6:4F:50:1E:E8:45:75:15:38:5C:23:72:B5:EA:93:57"}}},"request":{"raw":"GET /login HTTP/1.1\r\nHost: www.tetherleads.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=f873a727c67d11573ae5d92921fd6788\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"f873a727c67d11573ae5d92921fd6788"}],"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 3735\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 13 Oct 2026 13:18:59 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":11032,"size_decoded":4201,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (362)","md5":"07e88392681f8fd561c59153307c9dae","sha1":"335ec4f39b76d848fb30661fef59eacbb46d3b81","sha256":"8e8fe8d6cf1e23e6f184a0bcc3d2aad5f77f22729a4972cbcc19e4c8c647f9eb","sha512":"1224f389f93755266f97b539fc06b452b9ea29554114f4c6e055d1c3173a697b52b00f8df3be02b7c8bf7e5d3b187d89eddb1482096ca9121306d3b6f72e02e3","ssdeep":"192:tyEkUEAsEOqFe5khJP6ijtNZ/jG8sjfNog+ySbFVQS6J:ty1HAs2SMiEyEzQS6J","tlshash":"be32a6aa62731816b96399642ba75a4e3129d003d507d9483fec331ccf86edbe97335c","first_seen":"2026-10-13T13:19:34.558688Z","last_seen":"2026-10-13T13:19:34.558688Z","times_seen":1,"resource_available":true,"data":null}},"time_used":116,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":116,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"www.tetherleads.site","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"files.catbox.moe/v56uoq.png","fqdn":"files.catbox.moe","domain":"catbox.moe","tld":"moe"},"ip":{"addr":"108.181.20.35","port":443,"asn":40676,"as":"AS40676","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.tetherleads.site/login","date":"2026-10-13T13:18:59.898Z","timestamp":1791897539898,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P384","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"catbox.moe","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 13 Sep 2026 08:58:06 GMT","end":"Sat, 12 Dec 2026 08:58:05 GMT"},"fingerprint":{"sha1":"75:46:20:EE:CB:A5:05:26:F1:E1:18:62:F0:C7:23:63:E0:FC:32:D9","sha256":"5E:C0:E8:9D:85:47:61:96:A9:60:84:BC:24:57:0F:E4:3E:AB:52:97:71:71:7F:8E:36:B0:6C:20:3C:D6:E8:21"}}},"request":{"raw":"GET /v56uoq.png HTTP/1.1\r\nHost: files.catbox.moe\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.tetherleads.site/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 13 Oct 2026 13:19:00 GMT\r\ncontent-type: image/png\r\ncontent-length: 133925\r\nlast-modified: Tue, 15 Sep 2026 08:20:09 GMT\r\netag: \"6aa8ffb9-20b25\"\r\nx-content-type-options: nosniff\r\ncontent-security-policy: default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":133925,"size_decoded":134458,"mime_type":"image/png","magic":"PNG image data, 558 x 447, 8-bit/color RGBA, non-interlaced","md5":"4bc5570a2ca281e602bf0f37302da1eb","sha1":"ffd32a1ad245f05766a1d72d71e3234b766ff63a","sha256":"0925575cfd1ad349d74a0abaefb85739f50f46f97925db00fb2f7ed7db05b3eb","sha512":"8583b17014a35e3ef5cbbf249a638a68a111d5df020727ac6f4079238c5be8b12aa7fc61bdb566021b405ab8b14a7511285c83d980fc76f7882d26383043c68d","ssdeep":"3072:O9VVE4rbacnMrUxDoH0j/PDK5KAa7B9l0tNJx6qvgyqUX:O/LrBnM+9j3m5KAcB92tY6X","tlshash":"ded312e6527b1be24a06e3858324b0145bd3d72639b103ad2964d93e5415b4bbc2fffc","first_seen":"2026-09-22T14:06:15.118581Z","last_seen":"2026-10-13T13:19:34.560472Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1212,"timings":{"blocked":-1,"dns":2,"connect":148,"send":0,"wait":153,"receive":445,"ssl":464},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-10-13","alert":"Sinkholed","trigger":"files.catbox.moe","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}}]}