{"report_id":"0704072e-f05a-4ff7-b1c1-6db97a965ba8","version":6,"status":"done","tags":[],"date":"2026-01-06T14:47:54Z","url":{"schema":"http","addr":"whatseapp.us.cc","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":0,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"http","addr":"whatseapp.us.cc/","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"title":"WhatsApp Web","dom":{"size":13057,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (6779)","md5":"79aaefd7f96e6bb2d16db37147ef20e1","sha1":"9b4904cb2b50fbdf5356427a3964b62d71b58b8b","sha256":"a6f4ffff0df72827d6f5c8c64f5d3e0194d266680d2583ea509d78a008427246","sha512":"e73603d7ea24da7a232523e71f24ae34562c27f08640a89ba049514ebfdacad56cd64699c6b587cf22f4c6ff8612fb2afa0396c009bfd43b7b9034cd516003a5","ssdeep":"192:qbfoF9BOEfP4KgqhJKE7M3zI4WXkOFH/LHgOXkOFH/LGthC8LF:qbfc1Mk4W02LHgO02LGthC8LF","tlshash":"de423b41159304193c33e1ea77da7b4622b1f00bc944f9197dfd6178cfc5fa4a827aa1","dom_hash":"domhashed72046542f81fe79d728fd625ed0f12","first_seen":"2026-01-03T19:49:36.852275Z","last_seen":"2026-04-18T00:23:15.474469Z","times_seen":23,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"whatseapp.us.cc","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":0,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-10T14:47:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-06T14:47:36Z","timestamp":1767710856,"ip_dst":{"addr":"172.67.75.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42160,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ETPRO POLICY Observed External IP Lookup Domain (api.ip .sb in TLS SNI)","source":"{\"timestamp\":\"2026-01-06T14:47:36.152320+0000\",\"flow_id\":1703064600327689,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.51\",\"src_port\":42160,\"dest_ip\":\"172.67.75.172\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2835930,\"rev\":4,\"signature\":\"ETPRO POLICY Observed External IP Lookup Domain (api.ip .sb in TLS SNI)\",\"category\":\"Device Retrieving External IP Address Detected\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_04_17\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0043\"],\"mitre_tactic_name\":[\"Reconnaissance\"],\"mitre_technique_id\":[\"T1590\"],\"mitre_technique_name\":[\"Gather_Victim_Network_Information\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_11_19\"]}},\"tls\":{\"sni\":\"api.ip.sb\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3422,\"start\":\"2026-01-06T14:47:36.144905+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"whatseapp.us.cc","ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"domain_registered":"2006-04-07","domain_rank":0,"first_seen":"2026-01-06T14:47:55.791915Z","last_seen":"2026-01-06T14:47:55.791915Z","alert_count":60,"request_count":12,"received_data":2875029,"sent_data":4431,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"api.ip.sb","ip":{"addr":"172.67.75.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-08-07","domain_rank":410938,"first_seen":"2018-03-13T12:36:01Z","last_seen":"2026-01-02T12:07:26.358644Z","alert_count":0,"request_count":2,"received_data":2913,"sent_data":890,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"skp.it.com","ip":{"addr":"47.250.88.217","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Malaysia","country_code":"MY"},"domain_registered":"1992-10-23","domain_rank":0,"first_seen":"2026-01-03T19:49:30.288051Z","last_seen":"2026-01-03T19:49:30.288052Z","alert_count":0,"request_count":5,"received_data":4517,"sent_data":2667,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"whatseapp.us.cc/assets/en-CUrTyJ4q.js","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"af171249877475e1dc78cebb3977551a","sha1":"c709ddd3363e7210600dba56d6c3fa87177e47a3","sha256":"2218d9ddbf6cfad7f30ee4971cba4f083ca93a77974b6659637e9c96f2757e4f","sha512":"16505d2c0ac8958c5c15aa0ff77549cf06c3e63de90afb49d21678021cfef1e18e0176ff638ae6e7b4ac8d7aff7a2edbcf899b6b2c02115b213bb98372289b91","ssdeep":"192:hlK61hUrrfH9dXO4VC8LKrOk/7+9CUxV+/5zUuaRnuDRArqId:hlT1hUrrv9dXO4VC8LPkj+9CUxV+/5zI","tlshash":"d3e1b6de655a2a330e8347077cbf770daaec052d8e67282f58ff415a62d5791732218c","size":7147,"data":"","first_seen":"2026-01-03T19:49:36.854829Z","last_seen":"2026-04-18T00:23:15.485321Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"Function","is_inline":false,"md5":"ae05ef7a1a664db2bb83ba7d0f39801b","sha1":"66bbdb4acd98df6832e06c193ec7f4013affa296","sha256":"8c117493067641397e0de60b420f6e8713216da86a17c9fec8a3c6645d0cec42","sha512":"b9cc82720b3650ef64e4f2c8a8766dc0b31c897e198be17ef19565b2de584df13b62b19dee7465208757bab57470125bcb98345ea4f0cd8bf60510f0c638f4a9","ssdeep":"","tlshash":"d4c080c870c62d047515b41164bf34e45034401670489b46ccd4d8542d630f08233d98","size":156,"data":"","first_seen":"2026-01-03T19:49:36.871677Z","last_seen":"2026-04-18T00:23:15.489851Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"Function","is_inline":false,"md5":"bcc706613537267e40d19bf38aafa98f","sha1":"0fede3de3475c37cb00ffc1404751567a5305f8a","sha256":"c08f17f565473de3130a01cb0bce21a2dc7f4dddb415d559a7b1124b9b59e4a3","sha512":"f01bf85279353dce07e8da170a2aa7932178b56af847444d89b165dc0bf466cde23b53cbe20b2350c2be9719a652676223a8c2c1baa5667acfba5813cea897d5","ssdeep":"","tlshash":"a3c080c5e0c77e105652571151ff25d45134443674891f139dd4dc593e220f4d233edd","size":165,"data":"","first_seen":"2026-01-03T19:49:36.874809Z","last_seen":"2026-04-18T00:23:15.492795Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"Function","is_inline":false,"md5":"52ea0c2df717a076bbb80fd37e5a52ae","sha1":"8ac8123a33dfd37470d4aae19482309c3265de83","sha256":"4802a6b789dfa8a456d1d88f410aa1a4358e35fd02dd6f3dd7a4a047273fec4c","sha512":"a7db19448edf9293bacde937948e9c4238c4f96bb1a71d6084bdf0fa2dc03240a04f5224825d77d42c1f9852ea00a13c4908f4b605e1e8731c364922330b0182","ssdeep":"","tlshash":"acc0c0c0b0c37c000203d600207f20e8603c881ab08807078cb4d8083f631b08333edc","size":172,"data":"","first_seen":"2026-01-03T19:49:36.873624Z","last_seen":"2026-04-18T00:23:15.493614Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"Function","is_inline":false,"md5":"020831ae4e38f16b449db8e30ed17f6d","sha1":"769017db9a99c5436715f3960d699245e172dcce","sha256":"aa4501df9e19292bb747cd3b68a4727c30f6c461b0fe3100302f86ea081c0f48","sha512":"718b2fead353c5e1d2ea37ee5886ec3af76a13981d3bb9a676424155244057183baf74100b46661edd909a15c68e29d81b2b478a14bf83009844acfbb90daec9","ssdeep":"","tlshash":"11c08cc9b0c36d00160b6a1465bf34e49024886ab58c1f078de8e86a3fa30b49233e9c","size":158,"data":"","first_seen":"2024-10-04T11:00:33.210701Z","last_seen":"2026-08-08T05:00:07.314467Z","times_seen":283,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"Function","is_inline":false,"md5":"ae05ef7a1a664db2bb83ba7d0f39801b","sha1":"66bbdb4acd98df6832e06c193ec7f4013affa296","sha256":"8c117493067641397e0de60b420f6e8713216da86a17c9fec8a3c6645d0cec42","sha512":"b9cc82720b3650ef64e4f2c8a8766dc0b31c897e198be17ef19565b2de584df13b62b19dee7465208757bab57470125bcb98345ea4f0cd8bf60510f0c638f4a9","ssdeep":"","tlshash":"d4c080c870c62d047515b41164bf34e45034401670489b46ccd4d8542d630f08233d98","size":156,"data":"","first_seen":"2026-01-03T19:49:36.871677Z","last_seen":"2026-04-18T00:23:15.489851Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"Function","is_inline":false,"md5":"1f55d83ef16b623d4d9bf7f055691235","sha1":"7536c531b6aaef1e11104f875c4b2e7b3c2d187e","sha256":"07bd4258825daff7bf15278ed04342d417e318d8e1e6396e082ff983c9fa187b","sha512":"6fa0e24e2fcbfe2f6e5d7494bdf415ba641f431d91f8975181fb0ba6cd7970814e4d9eebed0e9f36f338bc26fb2e50988a23ed819e572f0658acc4d3e8c098a8","ssdeep":"","tlshash":"9df0c06351df2760af5324803c9b2cf4b22070293638b5669cd8d0591bd5ef94439a98","size":503,"data":"","first_seen":"2026-01-03T19:49:36.872712Z","last_seen":"2026-04-18T00:23:15.49083Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/assets/index-BNCAkVth.js","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"7bf21f450ea622f4350f557f943e55cb","sha1":"7bbacf34fb823757679bffdfc941fa55536bf7cc","sha256":"43e8d93b588dfc5b31234c14543e3b67e21e0e2f67b0db982fb28d7562fb5ba2","sha512":"52387f373aa0b90f9d04224787e12462e74a60735e6eb00702c7b8e5f46b3d932e50d465527663ea64cfb309543369fa16f85e5b82583f7866c4a587670e3502","ssdeep":"24576:aBmHiIc4ZPIM1B7/qf0UrymxfvyfF6mpRy2f2ZdNgcgWGWCXY2B+FsKELjAX5:aBmHiIc4ZPb1BC0UGmxfqfF6mpRyRNgG","tlshash":"02655a84b599b43583bb59d5506f0405b63d1b08f40884e4f0bdcea93abad94a2fbf7c","size":1523780,"data":"","first_seen":"2026-01-03T19:49:36.870374Z","last_seen":"2026-04-18T00:23:15.491965Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"whatseapp.us.cc/img/favicon.png","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:36.290Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /img/favicon.png HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAccept-Ranges: bytes\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nCache-Control: max-age=2592000\r\nContent-Length: 787\r\nContent-Type: image/png\r\nDate: Tue, 06 Jan 2026 14:47:36 GMT\r\nEtag: \"6954c5b4-313\"\r\nExpires: Thu, 05 Feb 2026 14:47:36 GMT\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":787,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"c5088e888c97ad440a61d247596f88e5","sha1":"865a0d1bb7e1245e046c5e1bae988cce53330280","sha256":"d0cadf240e89340b93df35240e7809039c1c574be05fbe2cf3243e2f487bc9ec","sha512":"ae2a039fc7c2ec70ad33eec78b3392d96d7899fb8bfffce45808c5d9e1ae6b3a73607b85d04433de16da43a8c007cb158e5d461302845edd15cba387d4b7e946","ssdeep":"","tlshash":"3101c530a610efb8c39b8eaaa6a0c2741219119d967aa63a080de03fce608c042d003c","first_seen":"2023-05-03T14:02:32Z","last_seen":"2026-08-06T23:04:55.355629Z","times_seen":1563,"resource_available":false,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ip.sb/geoip","fqdn":"api.ip.sb","domain":"ip.sb","tld":"sb"},"ip":{"addr":"172.67.75.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:36.338Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ip.sb","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Dec 2025 02:37:32 GMT","end":"Mon, 16 Mar 2026 03:37:30 GMT"},"fingerprint":{"sha1":"24:02:51:A7:97:86:16:7B:A6:FB:32:20:E8:6D:27:67:B4:5B:ED:59","sha256":"E6:A4:9B:54:C9:F6:6A:F9:19:BB:6D:05:75:CC:43:E5:AF:1E:84:9C:3A:4C:1D:C3:A9:A8:B1:E0:2E:03:56:7E"}}},"request":{"raw":"GET /geoip HTTP/1.1\r\nHost: api.ip.sb\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: http://whatseapp.us.cc/\r\nOrigin: http://whatseapp.us.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 14:47:36 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncf-ray: 9b9c02f42adb1525-OSL\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\nage: 0\r\ncache-control: public, max-age=0, must-revalidate\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qCdYvlrvwLNABlIp7C9qgRG3nSXDn6pnIQC3se49nyNoJ7E0uTJF3pWZZsci%2FvwrX1km1c3E4wL%2BWydyjJKWDPsRIUIoEcmO\"}]}\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-cache-note: The cf-cache-status header doesnt actually reflect the real cache status, we always return the geo information of your current connecting ip (see the x-ip header)\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-ip: 91.90.42.154\r\nx-protocol: HTTP/2.0\r\netag: W/\"2af051524e1238fe937b5d5e84fc8d35f4e1af91\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":345,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"8a696ea096c90633733107aa97d4a637","sha1":"2af051524e1238fe937b5d5e84fc8d35f4e1af91","sha256":"3d960fc5811a27f19b79f83a2d71228d62f03411a7402f7a71538a0d29b72a61","sha512":"7377bf9df9ce54ae981a2de1a288254cf1db58cb442d2e6ffe7c9553c47bb55ef5ed9b4fbb3585cf5d5d9cdeb37329638dcf6377127fb85498faffc83e7b8b59","ssdeep":"","tlshash":"2ee0dfd840ac2f16f82b834e474e8dab2bbc510a8189d5858db66f58d2c97be650670e","first_seen":"2026-01-06T10:36:52.068168Z","last_seen":"2026-01-06T16:56:48.690355Z","times_seen":4,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":132,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"skp.it.com/api/registerChat","fqdn":"skp.it.com","domain":"skp.it.com","tld":"it.com"},"ip":{"addr":"47.250.88.217","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Malaysia","country_code":"MY"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:36.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"skp.it.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Dec 2025 05:45:44 GMT","end":"Wed, 25 Mar 2026 05:45:43 GMT"},"fingerprint":{"sha1":"D5:7B:31:0D:A2:43:52:6C:34:F0:F9:BA:AB:59:D7:F4:3A:DD:68:C5","sha256":"55:E3:7A:58:69:4F:68:26:15:2F:DF:92:9F:69:5C:30:98:14:D0:44:AF:4B:AD:14:6D:74:71:BE:2D:8E:05:F8"}}},"request":{"raw":"OPTIONS /api/registerChat HTTP/1.1\r\nHost: skp.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://whatseapp.us.cc/\r\nOrigin: http://whatseapp.us.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ncache-control: no-cache, private\r\ndate: Tue, 06 Jan 2026 14:47:37 GMT\r\naccess-control-allow-origin: *\r\nvary: Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: content-type\r\naccess-control-max-age: 0\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T05:24:27.754443Z","times_seen":17773657,"resource_available":true,"data":null}},"time_used":1206,"timings":{"blocked":488,"dns":55,"connect":213,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"skp.it.com/ws/","fqdn":"skp.it.com","domain":"skp.it.com","tld":"it.com"},"ip":{"addr":"47.250.88.217","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Malaysia","country_code":"MY"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:38.081Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"skp.it.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Dec 2025 05:45:44 GMT","end":"Wed, 25 Mar 2026 05:45:43 GMT"},"fingerprint":{"sha1":"D5:7B:31:0D:A2:43:52:6C:34:F0:F9:BA:AB:59:D7:F4:3A:DD:68:C5","sha256":"55:E3:7A:58:69:4F:68:26:15:2F:DF:92:9F:69:5C:30:98:14:D0:44:AF:4B:AD:14:6D:74:71:BE:2D:8E:05:F8"}}},"request":{"raw":"GET /ws/ HTTP/1.1\r\nHost: skp.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: http://whatseapp.us.cc\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 34E4w5VAW+Wg5KMFn0ZSJA==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx\r\nDate: Tue, 06 Jan 2026 14:47:38 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: 95WgfRnL/FHDtOjh9hAA8DKK0ms=\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T05:24:27.754443Z","times_seen":17773657,"resource_available":true,"data":null}},"time_used":667,"timings":{"blocked":0,"dns":1,"connect":220,"send":0,"wait":219,"receive":0,"ssl":227},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/stylex.css","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:34.291Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /stylex.css HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nContent-Type: text/css\r\nDate: Tue, 06 Jan 2026 14:47:34 GMT\r\nEtag: W/\"6954c5b4-33f97\"\r\nExpires: Wed, 07 Jan 2026 02:47:34 GMT\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":212887,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"2891822bfd970982b8543db66568bc70","sha1":"309813c0fe88f70082bfc66df46f2127f4dca234","sha256":"67c4c1167510362f240d95d1c555f68c86e293ea01f6e1eadc49056e970c056c","sha512":"19fc0af56df59db7b06bfffaac9d3b95a3bf7ec3d3a6a5cc85c0302fbd43081ccdec50355b8a215b6d9ba9fef32ddf827188fd970c57994103cc3eca58a397bc","ssdeep":"6144:YLLCGv62rxtawYKuPW3tMQXuzS+mA9LJWAOn6:YLLZ62rxtawYKuPW3tMQ+zSu9LJWAOn6","tlshash":"7f241fb66afced2e7c32da2999d85e54b34da8036d1d3e61bad4305c6ec13ecc813644","first_seen":"2026-01-03T19:49:36.868061Z","last_seen":"2026-04-18T00:23:15.488113Z","times_seen":23,"resource_available":false,"data":null}},"time_used":647,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":438,"receive":209,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/app.css","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:34.293Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /app.css HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nContent-Type: text/css\r\nDate: Tue, 06 Jan 2026 14:47:34 GMT\r\nEtag: W/\"6954c5b4-38a0b\"\r\nExpires: Wed, 07 Jan 2026 02:47:34 GMT\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":231947,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"bdf1775c97a75f0fa4c6c89f6707dd16","sha1":"2b7519e300a5f91deb4bae2aab50a3971490150e","sha256":"31788499ce90b2a464c987626b72e2874ff9b320958883862ce756ac3bbcc0f0","sha512":"34248ae312dc6f31a5be47cda8acbf8528fa3e22ab6c902fca13c13a8bfe13bb06568cd68aca087d9a6a197bc96f7f5fcfff99dca46c111f8359913677d1249b","ssdeep":"3072:F+7iT3g75TQ7LN+XdRkK2dL8B6Q2TuQ0n:F+783g1mIdRSL8BT2Tu3n","tlshash":"4334b46166d32a9c351b82bf33ea9b1773380887d409fe183dee70b88f591dd65b2910","first_seen":"2024-08-19T13:21:09.901808Z","last_seen":"2026-05-12T22:50:32.098469Z","times_seen":44,"resource_available":false,"data":null}},"time_used":700,"timings":{"blocked":18,"dns":1,"connect":21,"send":0,"wait":445,"receive":215,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/apple-touch-icon.png","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:36.288Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nCache-Control: max-age=2592000\r\nContent-Encoding: gzip\r\nContent-Type: image/png\r\nDate: Tue, 06 Jan 2026 14:47:36 GMT\r\nEtag: W/\"6954c5b4-12c3\"\r\nExpires: Thu, 05 Feb 2026 14:47:36 GMT\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4803,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 194 x 194, 8-bit colormap, non-interlaced","md5":"e872691e449e137aac21b048c42b9539","sha1":"bc1d23d193fdee85fad4e0c392a512645d07dd30","sha256":"8286d412dd31e8fab1f6d67092d86685fbc4f9702863f8262ce8fef566c96592","sha512":"2ee78b84c1587d146f871bebebeea2c53863c141ab46b1b72ca9dc9546d2114a381e274063acfdead781c09d156157dd91771adc0f63631c87b73a3fc58a844a","ssdeep":"96:a3QCa2VZRjKqmBP3llpe2K+tKnwmZHew7rzNCaI00vtCI6uD:aH7VbmBP3lGSmHewRCaI0ICI6uD","tlshash":"fea15cda77ec7a24486a3b6b87ccdd8ef481011071e9603bae098850794499b5ff7028","first_seen":"2023-05-03T14:02:32Z","last_seen":"2026-08-04T21:46:16.254958Z","times_seen":571,"resource_available":false,"data":null}},"time_used":233,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":233,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/index.css","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:34.294Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /index.css HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nContent-Type: text/css\r\nDate: Tue, 06 Jan 2026 14:47:34 GMT\r\nEtag: W/\"6954c5b4-4fbec\"\r\nExpires: Wed, 07 Jan 2026 02:47:34 GMT\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":326636,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"d9918282432c8700aa59f285c4c97d2e","sha1":"613df3f3b236d3030b3c48e7bc76ead15fd6c815","sha256":"1dc721b88bf4de1541e8d82f04a57abffb4d53e22a61e20b83ba81c220bc0e40","sha512":"4a3a1528bb224b3fbdf7aedd870e09456e11757a1eef3b49bd58f22eceee189a8a0b57303930849ece98c8a879cca3813619a27aed3e18887b70d12d39c7c5f0","ssdeep":"6144:7VPiNX9+9KmPPhEmDW6W24KMAM2wbvKN4nku:hhEIu","tlshash":"9764b355e713653b182be63e79c4e9885f14df92d9228ba6fb40b40891c7da102e3d3f","first_seen":"2025-04-20T11:25:52.963782Z","last_seen":"2026-05-14T01:57:27.309193Z","times_seen":56,"resource_available":false,"data":null}},"time_used":680,"timings":{"blocked":17,"dns":1,"connect":21,"send":0,"wait":434,"receive":207,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/assets/en-CUrTyJ4q.js","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:36.074Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/en-CUrTyJ4q.js HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/assets/index-BNCAkVth.js\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nContent-Type: application/javascript\r\nDate: Tue, 06 Jan 2026 14:47:36 GMT\r\nEtag: W/\"6954c5b4-1beb\"\r\nExpires: Wed, 07 Jan 2026 02:47:36 GMT\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7147,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (5898)","md5":"af171249877475e1dc78cebb3977551a","sha1":"c709ddd3363e7210600dba56d6c3fa87177e47a3","sha256":"2218d9ddbf6cfad7f30ee4971cba4f083ca93a77974b6659637e9c96f2757e4f","sha512":"16505d2c0ac8958c5c15aa0ff77549cf06c3e63de90afb49d21678021cfef1e18e0176ff638ae6e7b4ac8d7aff7a2edbcf899b6b2c02115b213bb98372289b91","ssdeep":"192:hlK61hUrrfH9dXO4VC8LKrOk/7+9CUxV+/5zUuaRnuDRArqId:hlT1hUrrv9dXO4VC8LPkj+9CUxV+/5zI","tlshash":"d3e1b6de655a2a330e8347077cbf770daaec052d8e67282f58ff415a62d5791732218c","first_seen":"2026-01-03T19:49:36.854829Z","last_seen":"2026-04-18T00:23:15.485321Z","times_seen":23,"resource_available":true,"data":null}},"time_used":231,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ip.sb/geoip","fqdn":"api.ip.sb","domain":"ip.sb","tld":"sb"},"ip":{"addr":"172.67.75.172","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:36.080Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.ip.sb","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Dec 2025 02:37:32 GMT","end":"Mon, 16 Mar 2026 03:37:30 GMT"},"fingerprint":{"sha1":"24:02:51:A7:97:86:16:7B:A6:FB:32:20:E8:6D:27:67:B4:5B:ED:59","sha256":"E6:A4:9B:54:C9:F6:6A:F9:19:BB:6D:05:75:CC:43:E5:AF:1E:84:9C:3A:4C:1D:C3:A9:A8:B1:E0:2E:03:56:7E"}}},"request":{"raw":"GET /geoip HTTP/1.1\r\nHost: api.ip.sb\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://whatseapp.us.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 14:47:36 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncf-ray: 9b9c02f30fb71525-OSL\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O46D85E9TR7YJygltsZ4WwXnYPNpHaESIneIbR0%2B2ILFMxDBjI5K4WsgGk6jjLvVNANbWBsFUMHqSB3vDSe4ZXsJ8so0ZxOI\"}]}\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-cache-note: The cf-cache-status header doesnt actually reflect the real cache status, we always return the geo information of your current connecting ip (see the x-ip header)\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-ip: 91.90.42.154\r\nx-protocol: HTTP/2.0\r\netag: W/\"2af051524e1238fe937b5d5e84fc8d35f4e1af91\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":345,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"8a696ea096c90633733107aa97d4a637","sha1":"2af051524e1238fe937b5d5e84fc8d35f4e1af91","sha256":"3d960fc5811a27f19b79f83a2d71228d62f03411a7402f7a71538a0d29b72a61","sha512":"7377bf9df9ce54ae981a2de1a288254cf1db58cb442d2e6ffe7c9553c47bb55ef5ed9b4fbb3585cf5d5d9cdeb37329638dcf6377127fb85498faffc83e7b8b59","ssdeep":"","tlshash":"2ee0dfd840ac2f16f82b834e474e8dab2bbc510a8189d5858db66f58d2c97be650670e","first_seen":"2026-01-06T10:36:52.068168Z","last_seen":"2026-01-06T16:56:48.690355Z","times_seen":4,"resource_available":false,"data":null}},"time_used":476,"timings":{"blocked":86,"dns":65,"connect":1,"send":0,"wait":303,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/nation/no.svg","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:36.623Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /nation/no.svg HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAccept-Ranges: bytes\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Length: 318\r\nContent-Type: image/svg+xml\r\nDate: Tue, 06 Jan 2026 14:47:36 GMT\r\nEtag: \"6954c5b4-13e\"\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":318,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"859a13561a1b24bfa65fb1a03835da49","sha1":"c2ab5ac79474bf31976cef328f5880ab07d0654f","sha256":"ceea17af051dceefd5759a824213eb40ac8a8095aa88a6874a7bbc8de637357a","sha512":"e0f028eca9a2f6dd45d61807c4929c1125a26f83de3062d3a4980cf32e1790093bafa0522c7a706882259ef22b057f0495833cc39f5b902bd22fe59a872c7f87","ssdeep":"","tlshash":"f5e0c2ecd33db800ca2483102f2d35e390a9b0cee18512ebfc5009a820ae6968dc3dd1","first_seen":"2023-05-07T17:48:28Z","last_seen":"2026-08-07T23:20:25.355544Z","times_seen":4599,"resource_available":false,"data":null}},"time_used":232,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/dianhua.png","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:36.629Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /dianhua.png HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nCache-Control: max-age=2592000\r\nContent-Encoding: gzip\r\nContent-Type: image/png\r\nDate: Tue, 06 Jan 2026 14:47:36 GMT\r\nEtag: W/\"6954c5b4-12b2\"\r\nExpires: Thu, 05 Feb 2026 14:47:36 GMT\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4786,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"bcdea161b3a714f93dfebee6b9bf33b7","sha1":"f2302c9aa213a73a051635cb2634dc8afded2dbf","sha256":"841bafa862a8436d3c3a5ef0f3e7564bc016ba30769d4313f707ef30f9ec251f","sha512":"55971dcd48b4388e5c6db30479463d61bdee423f237ae1f6a5f9919793ffe38b0580b33590612ede5de12a2de51c2a910efdaf763746e1a4cfa2133680f3c556","ssdeep":"96:xpWCE11wukia4lcPKNENmg8Y9qXJS6HKanUDDBANp9nGg7/ERqFGswFe:GC0wfF4CwMqXJZHznCUnGg7/ERqFGVe","tlshash":"24a18eb940aae5f9f6851b2793d08918bc76012bbb483c56574d19f3ff6b1c50cb21a8","first_seen":"2026-01-03T19:49:36.858243Z","last_seen":"2026-04-18T00:23:15.486152Z","times_seen":23,"resource_available":false,"data":null}},"time_used":231,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T14:47:33.923Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\nContent-Type: text/html\r\nDate: Tue, 06 Jan 2026 14:47:34 GMT\r\nEtag: W/\"6954c5b4-1902\"\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\nContent-Length: 1919\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6402,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"69d07a59768b8895c2e2372f8f927ded","sha1":"690503e2c555a57b75d234874056a7ecde6af14d","sha256":"c397b5d72ab79a00bdf198a0efe0d4d59a85242f648813028d8637bc6f95ec41","sha512":"6458b514a52b9faf1c38fd065368f6bcb3e7b023506a564680732f0a38d46347c8e2315c954ce3786042c2b1475497c915a9103db1576b8dd0c798f090a244dc","ssdeep":"48:Duupv8dWQUyNmQFRJU1+pTwF9wVDqjAkD6qb9cEnCRatchVArIcMdYDT0DXl2Di6:6u1sRUyvZTKRlbOEfP4KgqhJ1DAQzIiL","tlshash":"1bd12d4549e3005a7c1bd1792bfb630923645403ce5ade587c9eb2bacf407ac98b3be1","first_seen":"2026-01-03T19:49:36.861156Z","last_seen":"2026-04-18T00:23:15.487025Z","times_seen":23,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":23,"dns":2,"connect":21,"send":0,"wait":230,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"skp.it.com/api/registerChat","fqdn":"skp.it.com","domain":"skp.it.com","tld":"it.com"},"ip":{"addr":"47.250.88.217","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Malaysia","country_code":"MY"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:37.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"skp.it.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Dec 2025 05:45:44 GMT","end":"Wed, 25 Mar 2026 05:45:43 GMT"},"fingerprint":{"sha1":"D5:7B:31:0D:A2:43:52:6C:34:F0:F9:BA:AB:59:D7:F4:3A:DD:68:C5","sha256":"55:E3:7A:58:69:4F:68:26:15:2F:DF:92:9F:69:5C:30:98:14:D0:44:AF:4B:AD:14:6D:74:71:BE:2D:8E:05:F8"}}},"request":{"raw":"POST /api/registerChat HTTP/1.1\r\nHost: skp.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 17\r\nOrigin: http://whatseapp.us.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":17,"data":"{\"language\":\"en\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Tue, 06 Jan 2026 14:47:37 GMT\r\nx-ratelimit-limit: 60\r\nx-ratelimit-remaining: 59\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1253,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"9ddb57c92acf4c5969a35d361568c727","sha1":"c64d4521486b6e611c4f6569767509f461ee75d9","sha256":"c4b20990a40b703596a61faab054334636286202a40c481f6c15db9a77bcbf12","sha512":"a5bf3a5ac50eaa26247a178564d19d32f1d26b7408fbaf01ae380d397846c0fadb8b673adefdf10e6096a2cb0894e23bf4d503c743acff9b09c9e6ff457ae41c","ssdeep":"","tlshash":"6b210f01ba1854564ff7a8873e5ef146eed63146b50ccbc89bafcf64089c034314a945","first_seen":"2026-01-06T14:47:59.84002Z","last_seen":"2026-01-06T14:47:59.84002Z","times_seen":1,"resource_available":false,"data":null}},"time_used":242,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":242,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"skp.it.com/api/getSocketAddress","fqdn":"skp.it.com","domain":"skp.it.com","tld":"it.com"},"ip":{"addr":"47.250.88.217","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Malaysia","country_code":"MY"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:37.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"skp.it.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Dec 2025 05:45:44 GMT","end":"Wed, 25 Mar 2026 05:45:43 GMT"},"fingerprint":{"sha1":"D5:7B:31:0D:A2:43:52:6C:34:F0:F9:BA:AB:59:D7:F4:3A:DD:68:C5","sha256":"55:E3:7A:58:69:4F:68:26:15:2F:DF:92:9F:69:5C:30:98:14:D0:44:AF:4B:AD:14:6D:74:71:BE:2D:8E:05:F8"}}},"request":{"raw":"OPTIONS /api/getSocketAddress HTTP/1.1\r\nHost: skp.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://whatseapp.us.cc/\r\nOrigin: http://whatseapp.us.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ncache-control: no-cache, private\r\ndate: Tue, 06 Jan 2026 14:47:37 GMT\r\naccess-control-allow-origin: *\r\nvary: Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: content-type\r\naccess-control-max-age: 0\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T05:24:27.754443Z","times_seen":17773657,"resource_available":true,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"skp.it.com/api/getSocketAddress","fqdn":"skp.it.com","domain":"skp.it.com","tld":"it.com"},"ip":{"addr":"47.250.88.217","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Malaysia","country_code":"MY"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:37.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"skp.it.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Dec 2025 05:45:44 GMT","end":"Wed, 25 Mar 2026 05:45:43 GMT"},"fingerprint":{"sha1":"D5:7B:31:0D:A2:43:52:6C:34:F0:F9:BA:AB:59:D7:F4:3A:DD:68:C5","sha256":"55:E3:7A:58:69:4F:68:26:15:2F:DF:92:9F:69:5C:30:98:14:D0:44:AF:4B:AD:14:6D:74:71:BE:2D:8E:05:F8"}}},"request":{"raw":"POST /api/getSocketAddress HTTP/1.1\r\nHost: skp.it.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 63\r\nOrigin: http://whatseapp.us.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":63,"data":"{\"chat_id\":\"695d2089148b393c2931063b\",\"language\":\"en\",\"type\":1}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncache-control: no-cache, private\r\ndate: Tue, 06 Jan 2026 14:47:37 GMT\r\nx-ratelimit-limit: 60\r\nx-ratelimit-remaining: 58\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":985,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"06523c4f806b147c1d4752cac6787efb","sha1":"fe80ce0e72e58e7a27167dcb1439a83ba2a097d9","sha256":"043060040b3e891859f9da55ec155a8fb3139043ededfa28e7237b3eb2f7ecd7","sha512":"02bd3006f280241b2f38935eee69b43d3b5bb68bc80394c66c0efeadf0bad5801b1b74e5ca2fe122983242951b36f658120ab79748875ce8ab2dc19d1efc4021","ssdeep":"","tlshash":"6611dc05fa2984528db7a8836f9fb483fada2086b54dcbdcdbeccf5408dc0353646944","first_seen":"2026-01-06T14:47:59.840909Z","last_seen":"2026-01-06T14:47:59.840909Z","times_seen":1,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":235,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"whatseapp.us.cc/","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T14:47:32.560Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T05:24:27.754443Z","times_seen":17773657,"resource_available":true,"data":null}},"time_used":1296,"timings":{"blocked":1296,"dns":0,"connect":22,"send":0,"wait":0,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/assets/index-BNCAkVth.js","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:34.295Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-BNCAkVth.js HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nContent-Type: application/javascript\r\nDate: Tue, 06 Jan 2026 14:47:34 GMT\r\nEtag: W/\"6954c5b4-174044\"\r\nExpires: Wed, 07 Jan 2026 02:47:34 GMT\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1523780,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (43181)","md5":"e0c36348520aa733a142984430c37388","sha1":"f306e7413b8f029e1388e9c264dfbf7ab6bf353b","sha256":"7eea752602dbb0a1463014f52df9ac07d260f5ed07f25dcb843e9daea82214a0","sha512":"3f2f71d77550315d3339b094435f110502a4036dfcb6f0b7952f7d7da228e3330945e3e4a0e90a6570fe5fe480b89fc6cf02ed23268f10b4478f8e2def822351","ssdeep":"24576:aBmHiIc4ZPIM1B7/qf0UrymxfvyfF6mpRy2f2ZdNgcgWGWCXYl:aBmHiIc4ZPb1BC0UGmxfqfF6mpRyRNg8","tlshash":"3e255bc8b599b43983b755d5107f0006b23d1a58b40c84e4f0addee93a76d99a2bbf3c","first_seen":"2026-01-03T19:49:36.86546Z","last_seen":"2026-04-18T00:23:15.484434Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1535,"timings":{"blocked":16,"dns":0,"connect":21,"send":0,"wait":646,"receive":852,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"whatseapp.us.cc/assets/index-AeJFvoKn.css","fqdn":"whatseapp.us.cc","domain":"us.cc","tld":"cc"},"ip":{"addr":"38.60.250.187","port":80,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://whatseapp.us.cc/","date":"2026-01-06T14:47:34.304Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-AeJFvoKn.css HTTP/1.1\r\nHost: whatseapp.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://whatseapp.us.cc/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nContent-Type: text/css\r\nDate: Tue, 06 Jan 2026 14:47:34 GMT\r\nEtag: W/\"6954c5b4-85fb0\"\r\nExpires: Wed, 07 Jan 2026 02:47:34 GMT\r\nLast-Modified: Wed, 31 Dec 2025 06:41:56 GMT\r\nServer: nginx\r\nStrict-Transport-Security: max-age=31536000\r\nVary: Accept-Encoding\r\nX-Cache: BYPASS, write file cache failed: over disk size, current: 966341951488, capacity: 966367641600\r\nTransfer-Encoding: chunked\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":548784,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"f3d4d1885ccacec6d9225a1c4e205163","sha1":"9ffef9f80e01048f7821418b2146f7d9fbb725e2","sha256":"67329c4e5bda79199801bbb14d6d4396e413d86811a74ed0f078b40d80d78496","sha512":"5f17248877dc3f2b4acd0937c98e084a46394e9bc6d1a2cf6f5c6461028d03a102f4d5ad7d56fd7a427d4d100e7cc67be3fcf61a987bda6efd0debf1cac6590c","ssdeep":"6144:RoSI0MGuhT7M8EcH7pTVkad36fFhsSIcO3jVMa/4uta78+B36JL7u1A+wMif/x0w:Rn4jsv1LK5","tlshash":"41c4d655e753513b2e17e67d7bc5e9d8bb28ea61dc12cba5f240a00845c3bf102a3d2b","first_seen":"2026-01-03T19:49:36.862316Z","last_seen":"2026-04-18T00:23:15.483453Z","times_seen":23,"resource_available":false,"data":null}},"time_used":1102,"timings":{"blocked":8,"dns":1,"connect":21,"send":0,"wait":650,"receive":421,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"whatseapp.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"whatseapp.us.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}