{"report_id":"0b382451-61ca-499b-992c-72630ebc6293","version":0,"status":"done","tags":[],"date":"2026-09-22T21:27:49Z","url":{"schema":"http","addr":"harmonyblogs.com/m/index.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":0,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"http","addr":"harmonyblogs.com/403.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"title":"ERROR 404 - Not Found!","dom":{"size":4996,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1025)","md5":"249d4db05e42b5005371aea61da99e9a","sha1":"642f16a78d71d68bebcd79115192f191263a486d","sha256":"f55b2fbd4cdf7faab7261afddc878a4846b4a08a511cd7b7fcfac2c9a9e1ed54","sha512":"b4729d6c36727a8a8c1a93c13e151da57d4210ad75bd1de188c7a9c65627727a5fd26dc8dec9404f6bc1efe433f66a22f85ad1ed0d5ad00e916a14b0dc770bea","ssdeep":"96:jBuR8NxSXwXjPiSEC9D2BTR+UqnFowr6rt9G2yxSXwXjPhgGW3xasyOH4:Y8NxSXwX+ST2BTR+UqnFoW6x9G3xSXwH","tlshash":"90a1729f5c93915269a7b8a42ffae30961684403d108cd1bb9dcd5dcef84fd88ca278c","dom_hash":"domhash71083452b8690bca31c4a6e21fe77ec6","first_seen":"2026-09-22T12:40:05.629453Z","last_seen":"2026-09-22T21:28:05.280712Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"harmonyblogs.com/m/index.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":0,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-27T21:27:49Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"aa.app1001.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"aa.app1001.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"sdk.51.la","ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2005-01-17","domain_rank":347679,"first_seen":"2021-03-08T16:03:51Z","last_seen":"2026-09-22T20:37:33.176088Z","alert_count":5,"request_count":5,"received_data":346,"sent_data":1690,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"aa.app1001.shop","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-08T08:05:13.438078Z","last_seen":"2026-09-22T12:40:01.636622Z","alert_count":2,"request_count":1,"received_data":0,"sent_data":560,"comment":"","tags":null,"fingerprints":null},{"fqdn":"harmonyblogs.com","ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-05-23","domain_rank":0,"first_seen":"2026-09-22T21:07:12.309315Z","last_seen":"2026-09-22T21:07:12.309315Z","alert_count":87,"request_count":29,"received_data":344212,"sent_data":12556,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"imto1ken.oss-ap-southeast-6.aliyuncs.com","ip":{"addr":"8.212.139.136","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Philippines","country_code":"PH"},"domain_registered":"2012-04-01","domain_rank":0,"first_seen":"2024-01-09T10:28:12Z","last_seen":"2026-09-19T14:04:55.735621Z","alert_count":0,"request_count":5,"received_data":6984,"sent_data":2428,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/ts.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"becfab42c511b0c79b9f9b7297480966","sha1":"496cc761774031cc00f0d8115f1ec47ef79a9f46","sha256":"1a8a8edd8f92077e6b68d17f8ed8a66a4e96c2f15a8c69baeaf6cb1552f4b756","sha512":"dc982f939e660872732e977461595076a05cf6b6732344604b4e4c40d1ca9ddea446dd02792fc67e55d949ebddb17751567cc3df35f74a29db791379229f5bea","ssdeep":"","tlshash":"52e02b6e9cb316b47a4114ba452fa418f1ea512f1044d402754cfc014f20ea74b1dae4","size":410,"data":"","first_seen":"2026-05-24T15:51:44.163332Z","last_seen":"2026-09-22T21:28:05.303132Z","times_seen":122,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/403.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"eval","is_inline":false,"md5":"d965b416440517f23df57f36865017fa","sha1":"5dbb8a9e9aa74de36f4a0d4e062658e2125343c9","sha256":"64eab5b4485bd92de7da485f42929ba551b7dee1a1a8fc7734b6357717e2dfa4","sha512":"5aadb33545dd702d7165b566552108985a909ba5e4fc9b6f5e8fb419daef903d0028397ce65a04eb9795e79d440a8873d428819c60edc8f5ac93ac3ac3350aa9","ssdeep":"","tlshash":"5c4136d975615d790fe932af6cff071e00224105bc9b931594c98ac1673cf8b9267b8a","size":2170,"data":"","first_seen":"2025-08-01T10:51:10.081406Z","last_seen":"2026-09-22T21:28:05.303793Z","times_seen":319,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/403.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"ad7275f4a7ce3e6e4cd1232867349a9c","sha1":"50bbc7727c236c9339e15258fcd8e350f4879519","sha256":"d54690f5ac17e8a419581062b90119d58f2f39128d2555a539b5820d1145d141","sha512":"b4238ce4ad3b17c5330ce910473459c48dae30aa331fb0984c11f1bbdf6180d1745d2e0675e4ab8e1495c2ef3c22166a66636eb7c16e0bf9d9f0e272799e393b","ssdeep":"","tlshash":"1601261d97e291b1ee2371f51b4fe406ba3a14430008ba0bb80d0b94ffc583887b6f80","size":823,"data":"","first_seen":"2026-05-26T00:05:21.157205Z","last_seen":"2026-09-22T21:28:05.304499Z","times_seen":297,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imto1ken.oss-ap-southeast-6.aliyuncs.com/win.js","fqdn":"imto1ken.oss-ap-southeast-6.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"8.212.139.136","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":false,"md5":"57b8ed0d877ec01d6bd2fc09feff3f4d","sha1":"8bf2ce3728e2ba64c2fbffc3da1f052f065fb462","sha256":"d785a21050c65318aea31fc969c6185bb736a24a68ff981c1501a24eb5b3755b","sha512":"dd38f3c3a26918edac49888859d4fe6db3ec36c0e524740b75f5022fb344e100bee902f2b897e43c28e5aa2c909421803e248b22b66de872f0fac6b0220216e1","ssdeep":"","tlshash":"e5716dccb7e6e25b6bcc1da3fe05abea10b5957b90c17247879cb98d20f424ac668045","size":3542,"data":"","first_seen":"2026-09-08T08:05:20.592722Z","last_seen":"2026-09-22T21:28:05.285566Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imto1ken.oss-ap-southeast-6.aliyuncs.com/ts.js","fqdn":"imto1ken.oss-ap-southeast-6.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"8.212.139.136","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":false,"md5":"c23f793c4e7a9261dd8dc0852e1ad642","sha1":"8ae836114c1a95c5dd419d57e816b38a973ca5ce","sha256":"48e0fdb321f1d298056bddbc82f699d634870fae3e0d363e5b47dd75c280ee1f","sha512":"968f1e457d219dc6350bb2093e2131cc760f42eeb727fd0a5f98195c324459d3cc327872d1d264c2a9a6f85178c30f098924233e664bd4fb59d97b3d5be096e5","ssdeep":"","tlshash":"73e02b6e9c260af4667116bd853fa818f1aa113f4040d102b44cfc021f30d974a1dee4","size":421,"data":"","first_seen":"2023-08-27T19:31:17Z","last_seen":"2026-09-22T21:28:05.294793Z","times_seen":199,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/403.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc99a3365c66963bf6d8734b6a04e0d3","sha1":"1eaf7926da12fc34618d196f6a9853021ab02536","sha256":"daa8ca529a12933e77240bb1099016e402757302d2430b987d201cca48431f07","sha512":"1be12a21313c20768d56f99f43f8748b089506175be66dd16a4a530720313af28aaab08c2ff6e9ca720e8fd31eb41d9d93b0524fe05163b1b357dc5559f556b2","ssdeep":"","tlshash":"f241ed5df4e374b22837301c6b8fa00a74f1547b688cda007d0d9ac26f824a686b77ec","size":2141,"data":"","first_seen":"2026-08-09T06:58:13.67174Z","last_seen":"2026-09-22T21:28:05.290712Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/403.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"bc1790530df2afa0867455558562456a","sha1":"02fc122f45c9aa01df690d4d3706971ff59192fd","sha256":"9b40601d3f8f1f3ff1949554a58776f2b100c48cec8e7317498ba14c9a03b5bc","sha512":"93f2b71a759cc104867a90edac085d07b6c50a7c7e9b5e92274e57fce5b289c61f13ca4a175e7ae53f20893616f60f9b1cfd0d3b76780d3b037a1ab0e02a051a","ssdeep":"","tlshash":"27f09e6fdc41a9545bd225b8a7efd748d05e0428d019c447acd5c4cd2c38fdc042534c","size":502,"data":"","first_seen":"2026-05-13T23:49:49.138519Z","last_seen":"2026-09-22T21:28:05.305149Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/403.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"8ab782f9427da6f405ace3b0485baa21","sha1":"719c5dfe8820f716df4546a2b6d8bf3ce4406f10","sha256":"5773290f21a746c32437eff97cd88ecd04ac99c18f5eb1d1413628d30a0aa488","sha512":"ef8b2e0af14eb7ebe20e0b6a8e683e6dc5f08e669012abf068ce6c4641545fbfe4042d74e4307b52c61a39a787c9bbbf2d581acd43ae3a1bb43a25e8c1e14e83","ssdeep":"","tlshash":"53f09e6fdc41a9545bd225b8a7efd748d05e0428d019c447acd5c4cd2c38fdc042534c","size":575,"data":"","first_seen":"2025-12-18T09:12:07.927298Z","last_seen":"2026-09-22T21:28:05.306569Z","times_seen":39,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/plus/index.php?aid=1","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"697c37804807f715cc8a9e7e47aeabe6","sha1":"f92c1abb436942ff4cf1f9e20e776d0da396765e","sha256":"4143d0f2acaf9b971c69b52061b429c8360e770a41d8743f7d11619af7832325","sha512":"a802cd8a02baba0153c25c25b283a4722fd4dc4e32ad6b8efb5c47920fc36b2c5ed35b77b74cb842dd3d39e9a09b479266416049c7fe8ae51a1a346c893c6abf","ssdeep":"","tlshash":"92b012520e5ed22060040440b471c479567c90349701c904408b48940005be80c06f00","size":89,"data":"","first_seen":"2026-07-31T06:30:05.397529Z","last_seen":"2026-09-22T21:28:05.293555Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/so.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"b0cafb9511fdf8b72bf10d7196b09cea","sha1":"f5833901027245cfb8eba3fb2c552922f223a555","sha256":"2a9c9562a8509bbcda49a8a442fc2f69305a18b089d331fc616e57b5708d3b0b","sha512":"e450a72f7762a8234d5d838fbcace0455a5f933bb56d6b29e20e9a578dda0ff6a51d031a5591c11d56eba149434c5649abe3f1864c6866c20b8bd9000d563cd0","ssdeep":"","tlshash":"8401126e6e56fa2055244ddce971eaa8a0fda135f555ce6c85ee082415c8fcd090ec44","size":731,"data":"","first_seen":"2026-09-22T12:40:05.664447Z","last_seen":"2026-09-22T21:28:05.29009Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/m/index.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"eval","is_inline":false,"md5":"d965b416440517f23df57f36865017fa","sha1":"5dbb8a9e9aa74de36f4a0d4e062658e2125343c9","sha256":"64eab5b4485bd92de7da485f42929ba551b7dee1a1a8fc7734b6357717e2dfa4","sha512":"5aadb33545dd702d7165b566552108985a909ba5e4fc9b6f5e8fb419daef903d0028397ce65a04eb9795e79d440a8873d428819c60edc8f5ac93ac3ac3350aa9","ssdeep":"","tlshash":"5c4136d975615d790fe932af6cff071e00224105bc9b931594c98ac1673cf8b9267b8a","size":2170,"data":"","first_seen":"2025-08-01T10:51:10.081406Z","last_seen":"2026-09-22T21:28:05.303793Z","times_seen":319,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/tj.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"b97d45d1074ff244e974c82810eb7a2a","sha1":"75ca85653c75678b0bc24ce51ae13100c99bba85","sha256":"01913864088cb746ac003085df922b025d9ca79ac5901440b3726ff3cc1f4670","sha512":"062872df604ce76a2263fa6342763638008d998d19eb77413ebdaa5642128790304bdcd6f520d8f3d428aee6e0dadd9ef5fe880d455f9b286094ec758274a7f9","ssdeep":"","tlshash":"d3f0c05f7c05f2106751393633b7da9ce9af14252009c8875cdac4ac2c28ff80116b0c","size":554,"data":"","first_seen":"2025-09-18T02:31:27.203568Z","last_seen":"2026-09-22T21:28:05.28678Z","times_seen":515,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/ajax.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ae1625f00bcb78bf9e9c27ebedfe26d7","sha1":"9f0ee94e3bd3b2fb569441621e2dac7dd21d66fd","sha256":"09decd657ef4c873beb6ecc86f403132e47c126f870cbea1903d1ea7128964d4","sha512":"afc08f97d0908069e23ed2e17147bc922a452cdc90a00792d9e80f5294fa4269241ac071712c8ed241e1cc5cfaa0df8fc4f05ce050eb8b529123131e1cdd7fc7","ssdeep":"","tlshash":"48b012161c42fd9040280c9ac135c86460fc9114d110d94613fd041c1794fdc0c06c45","size":96,"data":"","first_seen":"2025-01-23T11:49:05.260358Z","last_seen":"2026-09-22T21:28:05.286185Z","times_seen":2124,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/apps/CaiJiXia/cjx.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7c796c9667d148e3d1d960eae58ca7e3","sha1":"4921f0df8d5ea9f4b6dbd1c6cad4bbc821374e89","sha256":"c5295e9bc5d73b08ca570e9b9aed94742d70ea16833fe3a9f11ae266225ed7a8","sha512":"58452cfeee70da91c0a40dabce71fbe2c5f2e1002d4b21ec08a5c9a9fd11e99cf3f7c301c6600c48228fcbc39d46738ac24a0baf4cda510e0cf1a17f36194d61","ssdeep":"","tlshash":"2b5162adef5238b306e27ae11cbdc72d105404e6787b8271ec989e8439f0ae44d6b353","size":2488,"data":"","first_seen":"2023-03-07T15:49:45Z","last_seen":"2026-09-22T21:28:05.295404Z","times_seen":2065,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/m/index.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"fff31a8002738e2b53c91db506e2f944","sha1":"72af3abfd69b9efa313eedbca0c259ba8bccbe62","sha256":"dbb43e267430f915da12425975ee9ed7e4e0903b125eee531fc55aa4b7f56c2b","sha512":"afb2f6e4bfdad7c0c2161785ed5d4bb3e3e1c653b23f6edcc053d14e4ce552dc3ecd39ba7ecc3108f9beab6783751ba6a4dc50b26036e0d9e1b254db1664c037","ssdeep":"","tlshash":"2df097aeec51a1986ac339f997abd689e0ae0124d00ec813e5d6c5cd2e3cfc9042134c","size":503,"data":"","first_seen":"2026-05-13T22:37:38.935377Z","last_seen":"2026-09-22T21:28:05.307201Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imto1ken.oss-ap-southeast-6.aliyuncs.com/tj.js","fqdn":"imto1ken.oss-ap-southeast-6.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"8.212.139.136","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Philippines","country_code":"PH"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8d48ed4f849d3a537e0225d3230208f","sha1":"4f8646de1709593d2b4ab56c6caf7c0fd1177fbc","sha256":"98ebdd779e3e1bbdff110cdb3f1b64499478553b072ae12233727b0e7ab2cbb9","sha512":"a18fc25e80f3e39a682cea479fe81c20f6f8b0ebae9ce2e84d9af08d5186bc1cf9e89e14c52580ba0d962291ae291cbd8ba74d42894f157f6024b44af8c5bf58","ssdeep":"","tlshash":"4211c09e7c05e25467973c7a23b7ddace9ae0032100dd80665ebc0ed6d29ff90126b4c","size":1110,"data":"","first_seen":"2024-12-07T07:30:44.931892Z","last_seen":"2026-09-22T21:28:05.294176Z","times_seen":2046,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/m/index.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"8637f466b87679f439e6476a5502b5eb","sha1":"62afb0988d2865654fd4c70685f37143ab5363da","sha256":"aa8c9412f64f8a6aeaaaa9ee78f4379c1880ca64889f808a9b60d62733353ed1","sha512":"1b2b88f41f2fdbb4a2db391c530489d41507e884e4a4be26c37676823631897ba6ff6a5c51834b927778cddd2bc4b15c6c12a80e68b07873db4bacf260f4102b","ssdeep":"","tlshash":"e2f059aed841a258578628bc57dbda48d15e0038d00dc806a4d9c4cd2d28fe4042234c","size":503,"data":"","first_seen":"2026-05-13T22:37:38.928607Z","last_seen":"2026-09-22T21:28:05.307821Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/m/index.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"fbff661a1f761b54e5e380c8a7f40b72","sha1":"158a3edf7d32005e7a26851d574ae257ca420e26","sha256":"fa38e8b52f8860a511c05635f6a46c0fe55599a973495ed645964164538a7de1","sha512":"061f6abb7811348d81218de5712396c10ec430056c4b4c70c54a8f54816da6b4434f1789db7bc6eeb63ef918c69f21abbee797ff564b004c3f9334dc2b3e2318","ssdeep":"","tlshash":"bdf09e6fdc41a9545bd225b8a7efd748d05e0428d019c447acd5c4cd2c38fdc042534c","size":503,"data":"","first_seen":"2025-12-29T09:55:14.029352Z","last_seen":"2026-09-22T21:28:05.309025Z","times_seen":124,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"pc","filename":"http://harmonyblogs.com/Plugins/403.js","line_number":48,"column_number":17},{"level":"log","text":"Region check skipped:NetworkError when attempting to fetch resource.","filename":"http://harmonyblogs.com/Plugins/403.js","line_number":28,"column_number":21}]},"http":[{"url":{"schema":"http","addr":"harmonyblogs.com/403.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T21:27:24.254Z","timestamp":1790112444254,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /403.html HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:24 GMT\r\nContent-Type: text/html\r\nLast-Modified: Thu, 13 Aug 2026 01:53:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a7d2398-e60\"\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3680,"size_decoded":1867,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"29655c1406180894834b9ba46214b4c6","sha1":"49c30deff98195c68ccc7706b16dabc8a1183ee7","sha256":"2f02f30091fb71ca19cc3b21e48b4f85256c7336b02fbbd8d894510bff4f5bab","sha512":"dcd8be6174cd55bc6e9894b4499b2de3303d0c4071bad9438b66d149ca3604fb4a20fe3933d51e8293970e551921806cbe4dc48e4d0c85b9b866a623ecd3d40a","ssdeep":"","tlshash":"5e71339f5ee31052796bb0b01fe5e70925248443d109de1abacc66a8dfc19988de3b8c","first_seen":"2026-09-22T12:40:05.666958Z","last_seen":"2026-09-22T21:28:05.281506Z","times_seen":4,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/404/error404.png","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/403.html","date":"2026-09-22T21:27:25.174Z","timestamp":1790112445174,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /404/error404.png HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/403.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:25 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a7d2398-791\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1937,"size_decoded":1329,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"baee0d263684f83f0043edc317f46b8b","sha1":"075ea54274be1075746dd380f7a5cd8db05e68ee","sha256":"b9fb920b76c24a639a2088f4de1a797b6d3738a89037cf8c77a942f9bc517a5d","sha512":"8079c4ce92dbc49e093303865cd6d647455e5a1b3e779192bd04b2e2d9b7a0bcd318431e50276815de7f799d5047321bd708ae231da2ff882dd2a138c2978f2a","ssdeep":"","tlshash":"3941942683901313b07ad94279b2dbd57a2141cbb6420abcb97129f3dacd07253223dd","first_seen":"2026-08-15T11:14:16.129897Z","last_seen":"2026-09-22T21:28:05.28215Z","times_seen":24,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/favicon.ico","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/403.html","date":"2026-09-22T21:27:25.606Z","timestamp":1790112445606,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/403.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:25 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 4286\r\nLast-Modified: Thu, 13 Aug 2026 01:52:05 GMT\r\nConnection: keep-alive\r\nETag: \"6a7d2345-10be\"\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4286,"size_decoded":4735,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"b1b891d2f48e8efb4dc81e7838f2c552","sha1":"6e6073e95a8804cb96e79f355ff8a297fdea9d60","sha256":"7c5fa4e85828426fe0625af1c7d4ef83f7d78ef2806cc5e0c08d5b27a7d95596","sha512":"4475da2d683cd0eedcd722c6be6fc4687378b2cc9d5e535e04c0f9090e4496902472f00951633abe798306e4c5f6ba60624ce16c538f0c364cdc9121007850f0","ssdeep":"96:E2UyJ/P6JScm5PdJcAocDuM/d3eOWHyGft8JcToPFcHTc:Efmb5xm4VqS0tC","tlshash":"0d9112eca663ec93c400f6ff8a28a6f085c65cb1b553f7e61438b919843547dca12e87","first_seen":"2024-12-07T07:30:44.976335Z","last_seen":"2026-09-22T21:35:10.167913Z","times_seen":2382,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/allimg/171122/1-1G1221956350-L.jpg","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.595Z","timestamp":1790112441595,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/allimg/171122/1-1G1221956350-L.jpg HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:23 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Wed, 22 Nov 2017 11:56:35 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a1565f3-7786\"\r\nExpires: Thu, 22 Oct 2026 21:27:23 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/181029/1-1Q029143IC00.jpg","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.601Z","timestamp":1790112441601,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/181029/1-1Q029143IC00.jpg HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:22 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Mon, 29 Oct 2018 06:37:36 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5bd6aab0-b579\"\r\nExpires: Thu, 22 Oct 2026 21:27:22 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":46457,"size_decoded":31216,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=666, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=892], progressive, precision 8, 266x200, components 3","md5":"2505767294f57e550276e7f7da6b43c9","sha1":"d5ae4c9edc305cf9c72677ad9010b2cbb9235180","sha256":"c2b012eddf39e64be7734ad7eb2beab0ed474cd89859332eaeff38a79fa89073","sha512":"1b40b45b1fa16b4360739beb9534db928de142b99e79abc090fa15f9f24a49284386b3b80f9760965af22ce07a56e4ce979de874a529926fd63e67d55fce92a3","ssdeep":"768:ZQJKWP1QJKaEloW2CQWMpeRqKOPPy68VDnXRSa7Qdq:6A5EPlQK6y68NhSOkq","tlshash":"da23275466504921e1dc7438c0fcca02d2f34ec08e36556f3bedae863faae4a5cd5a93","first_seen":"2026-09-22T13:11:02.632052Z","last_seen":"2026-09-22T21:28:05.284008Z","times_seen":2,"resource_available":false,"data":null}},"time_used":870,"timings":{"blocked":426,"dns":0,"connect":0,"send":0,"wait":223,"receive":221,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imto1ken.oss-ap-southeast-6.aliyuncs.com/win.js","fqdn":"imto1ken.oss-ap-southeast-6.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"8.212.139.136","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:22.059Z","timestamp":1790112442059,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-6.oss.aliyuncs.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 03 Dec 2025 08:27:15 GMT","end":"Sat, 02 Jan 2027 02:51:06 GMT"},"fingerprint":{"sha1":"71:AA:B2:AB:13:43:B4:24:14:D4:17:18:6C:6D:8C:8A:EF:6C:D2:1C","sha256":"9D:B8:09:0A:5D:43:59:9A:AE:6C:F3:99:ED:13:80:FA:DF:21:7D:65:AE:F9:B0:47:DA:3F:24:41:84:58:15:5A"}}},"request":{"raw":"GET /win.js HTTP/1.1\r\nHost: imto1ken.oss-ap-southeast-6.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Tue, 22 Sep 2026 21:27:23 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nx-oss-request-id: 6AB2F2BB147C023233655173\r\nLast-Modified: Sat, 05 Sep 2026 06:33:00 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 2970792823552240472\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: V7jtDYd+wB1r0vwJ/v8/TQ==\r\nx-oss-server-time: 1\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":3542,"size_decoded":1520,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (3542), with no line terminators","md5":"57b8ed0d877ec01d6bd2fc09feff3f4d","sha1":"8bf2ce3728e2ba64c2fbffc3da1f052f065fb462","sha256":"d785a21050c65318aea31fc969c6185bb736a24a68ff981c1501a24eb5b3755b","sha512":"dd38f3c3a26918edac49888859d4fe6db3ec36c0e524740b75f5022fb344e100bee902f2b897e43c28e5aa2c909421803e248b22b66de872f0fac6b0220216e1","ssdeep":"","tlshash":"e5716dccb7e6e25b6bcc1da3fe05abea10b5957b90c17247879cb98d20f424ac668045","first_seen":"2026-09-08T08:05:20.592722Z","last_seen":"2026-09-22T21:28:05.285566Z","times_seen":8,"resource_available":true,"data":null}},"time_used":1906,"timings":{"blocked":-1,"dns":29,"connect":205,"send":0,"wait":217,"receive":0,"ssl":1455},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/ajax.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/403.html","date":"2026-09-22T21:27:24.498Z","timestamp":1790112444498,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /Plugins/ajax.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/403.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:24 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 96\r\nLast-Modified: Sat, 10 Aug 2024 09:01:20 GMT\r\nConnection: keep-alive\r\nETag: \"66b72c60-60\"\r\nExpires: Wed, 23 Sep 2026 09:27:24 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96,"size_decoded":621,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with no line terminators","md5":"ae1625f00bcb78bf9e9c27ebedfe26d7","sha1":"9f0ee94e3bd3b2fb569441621e2dac7dd21d66fd","sha256":"09decd657ef4c873beb6ecc86f403132e47c126f870cbea1903d1ea7128964d4","sha512":"afc08f97d0908069e23ed2e17147bc922a452cdc90a00792d9e80f5294fa4269241ac071712c8ed241e1cc5cfaa0df8fc4f05ce050eb8b529123131e1cdd7fc7","ssdeep":"","tlshash":"48b012161c42fd9040280c9ac135c86460fc9114d110d94613fd041c1794fdc0c06c45","first_seen":"2025-01-23T11:49:05.260358Z","last_seen":"2026-09-22T21:28:05.286185Z","times_seen":2124,"resource_available":true,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":80,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/403.html","date":"2026-09-22T21:27:24.719Z","timestamp":1790112444719,"http_version":"HTTP/1.1","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nContent-Type: text/plain; charset=utf-8\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\nContent-Encoding: gzip\r\nCache-Control: no-store\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nDate: Tue, 22 Sep 2026 21:27:24 GMT\r\nEO-LOG-UUID: 9706390592607489832\r\nEO-Cache-Status: MISS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/tj.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/403.html","date":"2026-09-22T21:27:24.947Z","timestamp":1790112444947,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /Plugins/tj.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/403.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:25 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 554\r\nLast-Modified: Sat, 26 Apr 2025 08:26:16 GMT\r\nConnection: keep-alive\r\nETag: \"680c98a8-22a\"\r\nExpires: Wed, 23 Sep 2026 09:27:25 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":554,"size_decoded":1081,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with very long lines (554), with no line terminators","md5":"b97d45d1074ff244e974c82810eb7a2a","sha1":"75ca85653c75678b0bc24ce51ae13100c99bba85","sha256":"01913864088cb746ac003085df922b025d9ca79ac5901440b3726ff3cc1f4670","sha512":"062872df604ce76a2263fa6342763638008d998d19eb77413ebdaa5642128790304bdcd6f520d8f3d428aee6e0dadd9ef5fe880d455f9b286094ec758274a7f9","ssdeep":"","tlshash":"d3f0c05f7c05f2106751393633b7da9ce9af14252009c8875cdac4ac2c28ff80116b0c","first_seen":"2025-09-18T02:31:27.203568Z","last_seen":"2026-09-22T21:28:05.28678Z","times_seen":515,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/m/index.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T21:27:20.955Z","timestamp":1790112440955,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /m/index.html HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:21 GMT\r\nContent-Type: text/html\r\nLast-Modified: Tue, 22 Sep 2026 21:25:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6ab2f248-4c62\"\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19554,"size_decoded":4775,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (908), with CRLF, LF line terminators","md5":"ddfe931736e36164dfd01f9c3d83796c","sha1":"e62a3326e5cfbb41b70325a7d935ec8f91c81d47","sha256":"9b3884a3957bc58abeafc8bf045073d127ef6d366119d92314ab614781df29a1","sha512":"41a9a644a41c00d5dfdee072f7b046a812e11219ca89fb40ac5e177b04f46c2676934c48f5013cbf5eb4cbc943b88ead79dfe191b0b320101a4e7186a0e12e14","ssdeep":"384:fiwfEhEI9pzgnq5vlrwME+dM02in58E8n:vf0EapzgqBlT8V","tlshash":"e792ee2196eda81f47716bb90e502b3d9c82c58bd92e1e5077accd9faf92f0d5c13086","first_seen":"2026-09-22T21:28:05.287388Z","last_seen":"2026-09-22T21:28:05.287388Z","times_seen":1,"resource_available":true,"data":null}},"time_used":517,"timings":{"blocked":-1,"dns":82,"connect":217,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/allimg/171123/13255B291-0-lp.jpg","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.592Z","timestamp":1790112441592,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/allimg/171123/13255B291-0-lp.jpg HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:22 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Thu, 23 Nov 2017 05:25:57 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a165be5-2696\"\r\nExpires: Thu, 22 Oct 2026 21:27:22 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9878,"size_decoded":10261,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 85\", baseline, precision 8, 180x180, components 3","md5":"45cd280254e1e3171f602043d715a05f","sha1":"8389c2264059074322e3f7a7072c14f6db4548a5","sha256":"2c8c4de8ba54ee2086a732d40ca44a2ce63fe1902f49bf9819e530c70618aee6","sha512":"2e0ddc211c44b901042607065cadaaba5753570ff4bf5bc3bd276d2d8ac49320aefc5ebb714a4af2b6ccd849fd4fcf4b9c6c5707bef55c60f67d97062b03fdef","ssdeep":"192:7RgAWOVK7VjO6eHWki+1SRzIGbkSM8h8aYVbb7FQJ1yVNdoKHYNqfMQ99sF7c8gt:7RgAkoOr/hIF6ANdoKHqbQfsF7c7GU","tlshash":"bf12cf076a03c916802c7787c51115dbc30d75e66f96b788b863c6695774cf8732c637","first_seen":"2026-09-22T12:40:05.645849Z","last_seen":"2026-09-22T21:28:05.288651Z","times_seen":3,"resource_available":false,"data":null}},"time_used":667,"timings":{"blocked":449,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/so.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.835Z","timestamp":1790112441835,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /so.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:21 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 731\r\nLast-Modified: Mon, 24 Aug 2026 01:24:20 GMT\r\nConnection: keep-alive\r\nETag: \"6a8b9d44-2db\"\r\nExpires: Wed, 23 Sep 2026 09:27:21 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":731,"size_decoded":1258,"mime_type":"application/javascript","magic":"HTML document, ASCII text","md5":"b0cafb9511fdf8b72bf10d7196b09cea","sha1":"f5833901027245cfb8eba3fb2c552922f223a555","sha256":"2a9c9562a8509bbcda49a8a442fc2f69305a18b089d331fc616e57b5708d3b0b","sha512":"e450a72f7762a8234d5d838fbcace0455a5f933bb56d6b29e20e9a578dda0ff6a51d031a5591c11d56eba149434c5649abe3f1864c6866c20b8bd9000d563cd0","ssdeep":"","tlshash":"8401126e6e56fa2055244ddce971eaa8a0fda135f555ce6c85ee082415c8fcd090ec44","first_seen":"2026-09-22T12:40:05.664447Z","last_seen":"2026-09-22T21:28:05.29009Z","times_seen":4,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/tj.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:22.064Z","timestamp":1790112442064,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /Plugins/tj.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:22 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 554\r\nLast-Modified: Sat, 26 Apr 2025 08:26:16 GMT\r\nConnection: keep-alive\r\nETag: \"680c98a8-22a\"\r\nExpires: Wed, 23 Sep 2026 09:27:22 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":554,"size_decoded":1081,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with very long lines (554), with no line terminators","md5":"b97d45d1074ff244e974c82810eb7a2a","sha1":"75ca85653c75678b0bc24ce51ae13100c99bba85","sha256":"01913864088cb746ac003085df922b025d9ca79ac5901440b3726ff3cc1f4670","sha512":"062872df604ce76a2263fa6342763638008d998d19eb77413ebdaa5642128790304bdcd6f520d8f3d428aee6e0dadd9ef5fe880d455f9b286094ec758274a7f9","ssdeep":"","tlshash":"d3f0c05f7c05f2106751393633b7da9ce9af14252009c8875cdac4ac2c28ff80116b0c","first_seen":"2025-09-18T02:31:27.203568Z","last_seen":"2026-09-22T21:28:05.28678Z","times_seen":515,"resource_available":true,"data":null}},"time_used":407,"timings":{"blocked":186,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/403.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:22.070Z","timestamp":1790112442070,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /Plugins/403.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:22 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Wed, 12 Aug 2026 02:05:23 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a7bd4e3-85d\"\r\nExpires: Wed, 23 Sep 2026 09:27:22 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2141,"size_decoded":1467,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"dc99a3365c66963bf6d8734b6a04e0d3","sha1":"1eaf7926da12fc34618d196f6a9853021ab02536","sha256":"daa8ca529a12933e77240bb1099016e402757302d2430b987d201cca48431f07","sha512":"1be12a21313c20768d56f99f43f8748b089506175be66dd16a4a530720313af28aaab08c2ff6e9ca720e8fd31eb41d9d93b0524fe05163b1b357dc5559f556b2","ssdeep":"","tlshash":"f241ed5df4e374b22837301c6b8fa00a74f1547b688cda007d0d9ac26f824a686b77ec","first_seen":"2026-08-09T06:58:13.67174Z","last_seen":"2026-09-22T21:28:05.290712Z","times_seen":7,"resource_available":true,"data":null}},"time_used":616,"timings":{"blocked":395,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:23.992Z","timestamp":1790112443992,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/403.html","date":"2026-09-22T21:27:25.168Z","timestamp":1790112445168,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/allimg/171122/1-1G1221954490-L.jpg","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.598Z","timestamp":1790112441598,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/allimg/171122/1-1G1221954490-L.jpg HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:23 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Wed, 22 Nov 2017 11:54:49 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a156589-596d4\"\r\nExpires: Thu, 22 Oct 2026 21:27:23 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:23.997Z","timestamp":1790112443997,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/m/style/js/menuclick.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.587Z","timestamp":1790112441587,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /m/style/js/menuclick.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:21 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Mon, 29 Oct 2018 06:58:37 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5bd6af9d-22f8\"\r\nExpires: Wed, 23 Sep 2026 09:27:21 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8952,"size_decoded":2176,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (8952), with no line terminators","md5":"61cc4bededd410a7e1446aaaaea68061","sha1":"404b86305fff63fbca0d33f303340e5fd3cbc049","sha256":"78511c484e569a86779d162e520585d911687cd7ff6a8960cf66eed888a9c171","sha512":"b5713b79b9c48dae443f36a9a0046e79eb6e8ea1a9575b51b60b558effa671c0fdc7582c86cb08c02edc9b845a20be74080c43321169d0b6ec199b1cd55bb116","ssdeep":"192:muWedH6vjBWbINy3k5OjpSXEhnEuA40DQ8Yl63Wc/BJVVON:mnedH6vjBWbINy3k5OjpSXEhanhYtmJs","tlshash":"6a0299da5315c8871f8e7c4bbfa56ad6a25682a256cc3163c25cf70801fa483c5ddcf9","first_seen":"2026-09-22T12:40:05.653725Z","last_seen":"2026-09-22T21:28:05.292187Z","times_seen":4,"resource_available":true,"data":null}},"time_used":443,"timings":{"blocked":-1,"dns":0,"connect":220,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/plus/index.php?aid=1","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.578Z","timestamp":1790112441578,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /plus/index.php?aid=1 HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:21 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nSet-Cookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03; path=/\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"d2m6eilklhgmftqam9s6t1an03","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=d2m6eilklhgmftqam9s6t1an03; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":89,"size_decoded":717,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"697c37804807f715cc8a9e7e47aeabe6","sha1":"f92c1abb436942ff4cf1f9e20e776d0da396765e","sha256":"4143d0f2acaf9b971c69b52061b429c8360e770a41d8743f7d11619af7832325","sha512":"a802cd8a02baba0153c25c25b283a4722fd4dc4e32ad6b8efb5c47920fc36b2c5ed35b77b74cb842dd3d39e9a09b479266416049c7fe8ae51a1a346c893c6abf","ssdeep":"","tlshash":"92b012520e5ed22060040440b471c479567c90349701c904408b48940005be80c06f00","first_seen":"2026-07-31T06:30:05.397529Z","last_seen":"2026-09-22T21:28:05.293555Z","times_seen":28,"resource_available":true,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/allimg/171122/1-1G1221956020-L.jpg","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.597Z","timestamp":1790112441597,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/allimg/171122/1-1G1221956020-L.jpg HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:23 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Wed, 22 Nov 2017 11:56:02 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a1565d2-777d\"\r\nExpires: Thu, 22 Oct 2026 21:27:23 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/ajax.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:22.060Z","timestamp":1790112442060,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /Plugins/ajax.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:22 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 96\r\nLast-Modified: Sat, 10 Aug 2024 09:01:20 GMT\r\nConnection: keep-alive\r\nETag: \"66b72c60-60\"\r\nExpires: Wed, 23 Sep 2026 09:27:22 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96,"size_decoded":621,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with no line terminators","md5":"ae1625f00bcb78bf9e9c27ebedfe26d7","sha1":"9f0ee94e3bd3b2fb569441621e2dac7dd21d66fd","sha256":"09decd657ef4c873beb6ecc86f403132e47c126f870cbea1903d1ea7128964d4","sha512":"afc08f97d0908069e23ed2e17147bc922a452cdc90a00792d9e80f5294fa4269241ac071712c8ed241e1cc5cfaa0df8fc4f05ce050eb8b529123131e1cdd7fc7","ssdeep":"","tlshash":"48b012161c42fd9040280c9ac135c86460fc9114d110d94613fd041c1794fdc0c06c45","first_seen":"2025-01-23T11:49:05.260358Z","last_seen":"2026-09-22T21:28:05.286185Z","times_seen":2124,"resource_available":true,"data":null}},"time_used":404,"timings":{"blocked":183,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imto1ken.oss-ap-southeast-6.aliyuncs.com/tj.js","fqdn":"imto1ken.oss-ap-southeast-6.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"8.212.139.136","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:22.062Z","timestamp":1790112442062,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-6.oss.aliyuncs.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 03 Dec 2025 08:27:15 GMT","end":"Sat, 02 Jan 2027 02:51:06 GMT"},"fingerprint":{"sha1":"71:AA:B2:AB:13:43:B4:24:14:D4:17:18:6C:6D:8C:8A:EF:6C:D2:1C","sha256":"9D:B8:09:0A:5D:43:59:9A:AE:6C:F3:99:ED:13:80:FA:DF:21:7D:65:AE:F9:B0:47:DA:3F:24:41:84:58:15:5A"}}},"request":{"raw":"GET /tj.js HTTP/1.1\r\nHost: imto1ken.oss-ap-southeast-6.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Tue, 22 Sep 2026 21:27:23 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nx-oss-request-id: 6AB2F2BBFFEFC43638C116BD\r\nLast-Modified: Mon, 12 Aug 2024 07:31:50 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 12654278826270211217\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: 6NSO1PhJ06U34CJdMjAgjw==\r\nx-oss-server-time: 1\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":1110,"size_decoded":972,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with very long lines (554)","md5":"e8d48ed4f849d3a537e0225d3230208f","sha1":"4f8646de1709593d2b4ab56c6caf7c0fd1177fbc","sha256":"98ebdd779e3e1bbdff110cdb3f1b64499478553b072ae12233727b0e7ab2cbb9","sha512":"a18fc25e80f3e39a682cea479fe81c20f6f8b0ebae9ce2e84d9af08d5186bc1cf9e89e14c52580ba0d962291ae291cbd8ba74d42894f157f6024b44af8c5bf58","ssdeep":"","tlshash":"4211c09e7c05e25467973c7a23b7ddace9ae0032100dd80665ebc0ed6d29ff90126b4c","first_seen":"2024-12-07T07:30:44.931892Z","last_seen":"2026-09-22T21:28:05.294176Z","times_seen":2046,"resource_available":true,"data":null}},"time_used":1715,"timings":{"blocked":-1,"dns":26,"connect":204,"send":0,"wait":206,"receive":0,"ssl":1279},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imto1ken.oss-ap-southeast-6.aliyuncs.com/ts.js","fqdn":"imto1ken.oss-ap-southeast-6.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"8.212.139.136","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:22.066Z","timestamp":1790112442066,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-6.oss.aliyuncs.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 03 Dec 2025 08:27:15 GMT","end":"Sat, 02 Jan 2027 02:51:06 GMT"},"fingerprint":{"sha1":"71:AA:B2:AB:13:43:B4:24:14:D4:17:18:6C:6D:8C:8A:EF:6C:D2:1C","sha256":"9D:B8:09:0A:5D:43:59:9A:AE:6C:F3:99:ED:13:80:FA:DF:21:7D:65:AE:F9:B0:47:DA:3F:24:41:84:58:15:5A"}}},"request":{"raw":"GET /ts.js HTTP/1.1\r\nHost: imto1ken.oss-ap-southeast-6.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Tue, 22 Sep 2026 21:27:23 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 421\r\nConnection: keep-alive\r\nx-oss-request-id: 6AB2F2BBA69F1F3332A61BDD\r\nAccept-Ranges: bytes\r\nETag: \"C23F793C4E7A9261DD8DC0852E1AD642\"\r\nLast-Modified: Mon, 04 May 2026 14:04:13 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 16067097553053625117\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: wj95PE56kmHdjcCFLhrWQg==\r\nx-oss-server-time: 1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":421,"size_decoded":982,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"c23f793c4e7a9261dd8dc0852e1ad642","sha1":"8ae836114c1a95c5dd419d57e816b38a973ca5ce","sha256":"48e0fdb321f1d298056bddbc82f699d634870fae3e0d363e5b47dd75c280ee1f","sha512":"968f1e457d219dc6350bb2093e2131cc760f42eeb727fd0a5f98195c324459d3cc327872d1d264c2a9a6f85178c30f098924233e664bd4fb59d97b3d5be096e5","ssdeep":"","tlshash":"73e02b6e9c260af4667116bd853fa818f1aa113f4040d102b44cfc021f30d974a1dee4","first_seen":"2023-08-27T19:31:17Z","last_seen":"2026-09-22T21:28:05.294793Z","times_seen":199,"resource_available":true,"data":null}},"time_used":1083,"timings":{"blocked":-1,"dns":22,"connect":213,"send":0,"wait":215,"receive":0,"ssl":632},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/tj.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/403.html","date":"2026-09-22T21:27:24.497Z","timestamp":1790112444497,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /Plugins/tj.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/403.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:24 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 554\r\nLast-Modified: Sat, 26 Apr 2025 08:26:16 GMT\r\nConnection: keep-alive\r\nETag: \"680c98a8-22a\"\r\nExpires: Wed, 23 Sep 2026 09:27:24 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":554,"size_decoded":1081,"mime_type":"application/javascript","magic":"HTML document, ASCII text, with very long lines (554), with no line terminators","md5":"b97d45d1074ff244e974c82810eb7a2a","sha1":"75ca85653c75678b0bc24ce51ae13100c99bba85","sha256":"01913864088cb746ac003085df922b025d9ca79ac5901440b3726ff3cc1f4670","sha512":"062872df604ce76a2263fa6342763638008d998d19eb77413ebdaa5642128790304bdcd6f520d8f3d428aee6e0dadd9ef5fe880d455f9b286094ec758274a7f9","ssdeep":"","tlshash":"d3f0c05f7c05f2106751393633b7da9ce9af14252009c8875cdac4ac2c28ff80116b0c","first_seen":"2025-09-18T02:31:27.203568Z","last_seen":"2026-09-22T21:28:05.28678Z","times_seen":515,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/apps/CaiJiXia/cjx.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.584Z","timestamp":1790112441584,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /Plugins/apps/CaiJiXia/cjx.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:21 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Fri, 15 Sep 2023 06:11:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6503f5a2-9b8\"\r\nExpires: Wed, 23 Sep 2026 09:27:21 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2488,"size_decoded":2009,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2484), with CRLF line terminators","md5":"7c796c9667d148e3d1d960eae58ca7e3","sha1":"4921f0df8d5ea9f4b6dbd1c6cad4bbc821374e89","sha256":"c5295e9bc5d73b08ca570e9b9aed94742d70ea16833fe3a9f11ae266225ed7a8","sha512":"58452cfeee70da91c0a40dabce71fbe2c5f2e1002d4b21ec08a5c9a9fd11e99cf3f7c301c6600c48228fcbc39d46738ac24a0baf4cda510e0cf1a17f36194d61","ssdeep":"","tlshash":"2b5162adef5238b306e27ae11cbdc72d105404e6787b8271ec989e8439f0ae44d6b353","first_seen":"2023-03-07T15:49:45Z","last_seen":"2026-09-22T21:28:05.295404Z","times_seen":2065,"resource_available":true,"data":null}},"time_used":433,"timings":{"blocked":-1,"dns":0,"connect":215,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/m/style/js/jquery-1.10.2.min.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.585Z","timestamp":1790112441585,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /m/style/js/jquery-1.10.2.min.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:21 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Thu, 23 Nov 2017 05:41:22 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a165f82-16c7f\"\r\nExpires: Wed, 23 Sep 2026 09:27:21 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":93311,"size_decoded":33732,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32072), with CRLF line terminators","md5":"848b72edd3ba460478d2ab0e0fb039b2","sha1":"0aaedc90ae4350dd36684e3eb2701c0cead268b7","sha256":"85368d48fe44bd25a74cb4bd146f2c5179b67660b7d0515ea11ec8c1f420a27f","sha512":"c7db72cbd467736ef7fecde3a8d7fa08bb95cafc3c794fb46a57710a5308029d08010301f51bda34a6b7eb28a4189b02acc73973626268efc21236a3acbe6e5c","ssdeep":"1536:O4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RAfDknv+p0WzH/Io9Z7qABZnu0sFs:OGsKXAI2p0WP9bDrstfab","tlshash":"2e93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","first_seen":"2024-09-22T17:25:55Z","last_seen":"2026-09-22T21:28:05.296014Z","times_seen":8,"resource_available":true,"data":null}},"time_used":670,"timings":{"blocked":-1,"dns":0,"connect":221,"send":0,"wait":228,"receive":221,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/allimg/171122/2022235413-0-lp.jpg","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.594Z","timestamp":1790112441594,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/allimg/171122/2022235413-0-lp.jpg HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:23 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Wed, 22 Nov 2017 12:22:24 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a156c00-b40\"\r\nExpires: Thu, 22 Oct 2026 21:27:23 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2880,"size_decoded":3277,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 85\", baseline, precision 8, 240x57, components 3","md5":"9a6ee72dad352817ec14136d7ab9ce9b","sha1":"c0d27f959e6281ad25b30c395da475b4ea09ba7a","sha256":"f97ab315fb51a16e053a7a33acf5a0504bdf9887079e31edb0032d00c5e10ec3","sha512":"cfdac149ed155c2313bbb0568496c8454634b61499b56d5af0f1db8c3dfbb2a39a2cbdf461bc15b4bde3090081f9cb6a2e779c8129ad76ade94f041f4ee9db11","ssdeep":"","tlshash":"93515c6e8e404590df3f9eb3884a571aad0a2f261c44db82ef7282922b6175c8c3c5a4","first_seen":"2026-09-22T12:40:05.662015Z","last_seen":"2026-09-22T21:28:05.297347Z","times_seen":3,"resource_available":false,"data":null}},"time_used":2395,"timings":{"blocked":2174,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aa.app1001.shop/imtoken/","fqdn":"aa.app1001.shop","domain":"app1001.shop","tld":"shop"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:23.977Z","timestamp":1790112443977,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /imtoken/ HTTP/1.1\r\nHost: aa.app1001.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"aa.app1001.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"aa.app1001.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:23.994Z","timestamp":1790112443994,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"harmonyblogs.com/m/index.html","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T21:27:17.952Z","timestamp":1790112437952,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /m/index.html HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/allimg/171123/13164JJ8-0-lp.gif","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.593Z","timestamp":1790112441593,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/allimg/171123/13164JJ8-0-lp.gif HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:23 GMT\r\nContent-Type: image/gif\r\nLast-Modified: Thu, 23 Nov 2017 05:16:50 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a1659c2-2568\"\r\nExpires: Thu, 22 Oct 2026 21:27:23 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9576,"size_decoded":10155,"mime_type":"image/gif","magic":"GIF image data, version 87a, 240 x 135","md5":"9f84c3d7a99a751732e0e9d06f68fa86","sha1":"0ed6b159f616b3622c91a81bd7de56ba84d5712e","sha256":"126867dc7f298f6adeb0ad7f959d6b65595cde77d32aa004045c3c5601aaeb63","sha512":"6656d636dec9536ccbde35c26ed6287b86aadac5be37691b7726e9c2bd5d4d5d893572dab1769e64f466838345fbc8854285cdb150562eaa9ade250e67afd9c8","ssdeep":"192:pLuO0AIWdI4T8fYmaTZxNyrtbwXRRxpAEsVF080Kw:gnaBAfYmuZDypwHxpAhC5","tlshash":"c212c0101d5cd50bc9bb6b4272386057f2c959bcfa683ca3042ab4dc8f45f91657e0d0","first_seen":"2026-09-22T12:40:05.657485Z","last_seen":"2026-09-22T21:28:05.298538Z","times_seen":3,"resource_available":false,"data":null}},"time_used":2391,"timings":{"blocked":2174,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/allimg/171122/1-1G1221954100-L.jpg","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.599Z","timestamp":1790112441599,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/allimg/171122/1-1G1221954100-L.jpg HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:22 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Wed, 22 Nov 2017 11:54:10 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a156562-ac1a\"\r\nExpires: Thu, 22 Oct 2026 21:27:22 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":44058,"size_decoded":43334,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 649x465, components 3","md5":"80502cc2e9ab3c5fff4ee3f47ed16564","sha1":"ee4dc4bb010538004989d13c4076b2fd8765535c","sha256":"e12046e986b79d26e171a855ce493c0f99cf0cfc188929de7943b3505cccbeb9","sha512":"26b3ed3c6e0d7d3a46c9c0bbfe5eb7cee32dbf4677f40427274ac2325a1a6d1c8152e073b1943a9b75b062a52b6ac9d20df447465b9f742735e836e30335e5f4","ssdeep":"768:0LiNvtGdwwvniMXfMW3ndExwtvXovhtMFKvtXC5ZICJyvxAiJ:VtAvniMXmwto5tFv1C3ICAAg","tlshash":"fa13f157835a8857eb765733ce47bae01dc68e092e5606a3d9981fc6fbce96c27004c8","first_seen":"2026-09-22T13:11:02.641653Z","last_seen":"2026-09-22T21:28:05.299775Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1068,"timings":{"blocked":420,"dns":0,"connect":0,"send":0,"wait":217,"receive":431,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/allimg/171122/1945091N2-0-lp.jpg","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.600Z","timestamp":1790112441600,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/allimg/171122/1945091N2-0-lp.jpg HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:22 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Wed, 22 Nov 2017 11:45:10 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a156346-2256\"\r\nExpires: Thu, 22 Oct 2026 21:27:22 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8790,"size_decoded":8997,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 85\", baseline, precision 8, 180x180, components 3","md5":"55285ffaab12dc74b3302293b829988a","sha1":"1f658c6a98c601719a46bd320ccf10c856a93a9f","sha256":"c8029d76268ed5e3f3d434ac956204865938cc69668461f2b985b5525cf2a15f","sha512":"3201f8b297938010e4eeef380b365bfd3092c70ce414b9dfbd06a6a7b48ed0b13f2c0e96f3fdcff13bf7e42a59a33f674978adcff436b8a5ee4e1a4c1fe29135","ssdeep":"192:7a4S4O9fXjBPb91cTW4zWw6sJGWnTvVJ1t3dx6eQ:7a4S4GBPb90WSWw6uGqTjtPQ","tlshash":"36028f3ed60601e3510fff7ade4a8b5886a897d3bac042d91d5b06bf8be09d0186d10d","first_seen":"2026-09-22T13:11:02.64585Z","last_seen":"2026-09-22T21:28:05.300744Z","times_seen":3,"resource_available":false,"data":null}},"time_used":641,"timings":{"blocked":420,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imto1ken.oss-ap-southeast-6.aliyuncs.com/404.js","fqdn":"imto1ken.oss-ap-southeast-6.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"8.212.139.136","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:22.068Z","timestamp":1790112442068,"http_version":"HTTP/1.1","security_state":"","security_info":null,"request":{"raw":"GET /404.js HTTP/1.1\r\nHost: imto1ken.oss-ap-southeast-6.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: AliyunOSS\r\nDate: Tue, 22 Sep 2026 21:27:23 GMT\r\nContent-Type: application/xml\r\nContent-Length: 380\r\nConnection: keep-alive\r\nx-oss-request-id: 6AB2F2BBFFEFC437308516BD\r\nx-oss-server-time: 1\r\nx-oss-ec: 0026-00000001\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imto1ken.oss-ap-southeast-6.aliyuncs.com/404.js","fqdn":"imto1ken.oss-ap-southeast-6.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"8.212.139.136","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Philippines","country_code":"PH"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:24.001Z","timestamp":1790112444001,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET /404.js HTTP/1.1\r\nHost: imto1ken.oss-ap-southeast-6.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/apps/CaiJiXia/cjx.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/403.html","date":"2026-09-22T21:27:24.722Z","timestamp":1790112444722,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /Plugins/apps/CaiJiXia/cjx.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/403.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:24 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Fri, 15 Sep 2023 06:11:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6503f5a2-9b8\"\r\nExpires: Wed, 23 Sep 2026 09:27:24 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2488,"size_decoded":2009,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2484), with CRLF line terminators","md5":"7c796c9667d148e3d1d960eae58ca7e3","sha1":"4921f0df8d5ea9f4b6dbd1c6cad4bbc821374e89","sha256":"c5295e9bc5d73b08ca570e9b9aed94742d70ea16833fe3a9f11ae266225ed7a8","sha512":"58452cfeee70da91c0a40dabce71fbe2c5f2e1002d4b21ec08a5c9a9fd11e99cf3f7c301c6600c48228fcbc39d46738ac24a0baf4cda510e0cf1a17f36194d61","ssdeep":"","tlshash":"2b5162adef5238b306e27ae11cbdc72d105404e6787b8271ec989e8439f0ae44d6b353","first_seen":"2023-03-07T15:49:45Z","last_seen":"2026-09-22T21:28:05.295404Z","times_seen":2065,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/m/style/css/style.css","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.580Z","timestamp":1790112441580,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /m/style/css/style.css HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:21 GMT\r\nContent-Type: text/css\r\nLast-Modified: Mon, 29 Oct 2018 03:44:14 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5bd6820e-73d5\"\r\nExpires: Wed, 23 Sep 2026 09:27:21 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29653,"size_decoded":7056,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"f4856c0211a5e6c63513ee05aa6df620","sha1":"0ba1eec1ee1b0a04b954b5f88068cad5b3fc14ae","sha256":"a1c9c89199430b99a886043baf473d11f95b41fed2c65f8621f38fb9d51b1cf1","sha512":"91de004067d97cacf488a3cf408b634843d5744c1b66960e43a6f6bc44240d761e5454b4e29531cd5b9e1ec5d4f1a781676055d40d914b5146f1d2171f4d8c67","ssdeep":"768:XlmH+VIJVJjTKJqUrCIBBAJIJZO0XJE0metLg1kLXhJ2TCtcpRDkRAFru0HYS0aU:MQoP5fF6p","tlshash":"45d25975d664208eb207bbf4bff41f565f5950a2ae0b027dfab47928d24781835332d1","first_seen":"2026-09-22T12:40:05.66877Z","last_seen":"2026-09-22T21:28:05.301544Z","times_seen":4,"resource_available":true,"data":null}},"time_used":443,"timings":{"blocked":-1,"dns":0,"connect":220,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/uploads/allimg/171122/1-1G1221953150-L.jpg","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:21.599Z","timestamp":1790112441599,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /uploads/allimg/171122/1-1G1221953150-L.jpg HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:22 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Wed, 22 Nov 2017 11:53:15 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5a15652b-8d5d\"\r\nExpires: Thu, 22 Oct 2026 21:27:22 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36189,"size_decoded":33391,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 651x550, components 3","md5":"759badbdfc51ab179e94736087765a42","sha1":"c687d4d6f644d07e5e754e1df69ce03a8196d1a0","sha256":"fc906646d1c3c9e483f0dade52a97daf1a4e7860f4d514e4065037575bd7d88b","sha512":"5e93dc2c5b15583e1d1ee592b926e88480c485044f14f8e8198d6350f3a57eba5825d5f616facb1d81ffc91ce4cacdc6d2c5b9bb243c0e0021f8aaebff2b4b08","ssdeep":"768:3doYvT5AU2Co29TIwuRd85nvcRaXSiEjIm7L:tLvCUeQzDFrSiRm7L","tlshash":"64f2be1cbac8c6a0d71d17b69d12367d4d25acdf78b3ddb3e2954f01a028aba8449dc1","first_seen":"2026-09-22T13:11:02.635453Z","last_seen":"2026-09-22T21:28:05.302302Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1083,"timings":{"blocked":420,"dns":0,"connect":220,"send":0,"wait":222,"receive":221,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"harmonyblogs.com/Plugins/ts.js","fqdn":"harmonyblogs.com","domain":"harmonyblogs.com","tld":"com"},"ip":{"addr":"154.219.186.196","port":80,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://harmonyblogs.com/m/index.html","date":"2026-09-22T21:27:22.067Z","timestamp":1790112442067,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /Plugins/ts.js HTTP/1.1\r\nHost: harmonyblogs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://harmonyblogs.com/m/index.html\r\nCookie: PHPSESSID=d2m6eilklhgmftqam9s6t1an03\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:27:22 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 410\r\nLast-Modified: Wed, 12 Aug 2026 02:04:34 GMT\r\nConnection: keep-alive\r\nETag: \"6a7bd4b2-19a\"\r\nExpires: Wed, 23 Sep 2026 09:27:22 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":410,"size_decoded":937,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"becfab42c511b0c79b9f9b7297480966","sha1":"496cc761774031cc00f0d8115f1ec47ef79a9f46","sha256":"1a8a8edd8f92077e6b68d17f8ed8a66a4e96c2f15a8c69baeaf6cb1552f4b756","sha512":"dc982f939e660872732e977461595076a05cf6b6732344604b4e4c40d1ca9ddea446dd02792fc67e55d949ebddb17751567cc3df35f74a29db791379229f5bea","ssdeep":"","tlshash":"52e02b6e9cb316b47a4114ba452fa418f1ea512f1044d402754cfc014f20ea74b1dae4","first_seen":"2026-05-24T15:51:44.163332Z","last_seen":"2026-09-22T21:28:05.303132Z","times_seen":122,"resource_available":true,"data":null}},"time_used":417,"timings":{"blocked":200,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"harmonyblogs.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"harmonyblogs.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}