{"report_id":"0f5d20cd-826a-42c4-bfc3-d1dd75708c7a","version":6,"status":"done","tags":[],"date":"2026-03-02T14:04:26Z","url":{"schema":"http","addr":"fakezoommeeting.site","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":0,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"fakezoommeeting.site/","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"title":"fakezoommeeting.site","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T20:44:55.901176Z","times_seen":17961060,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"fakezoommeeting.site","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":0,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-06T14:04:26Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"s0.wp.com","ip":{"addr":"192.0.77.32","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"1997-03-28","domain_rank":56327,"first_seen":"2017-01-30T05:08:18Z","last_seen":"2026-03-02T06:04:55.758561Z","alert_count":0,"request_count":2,"received_data":284429,"sent_data":926,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"pixel.wp.com","ip":{"addr":"192.0.76.3","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"1997-03-28","domain_rank":22824,"first_seen":"2017-01-30T05:31:40Z","last_seen":"2026-03-01T23:34:34.862702Z","alert_count":0,"request_count":3,"received_data":753,"sent_data":1780,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"stats.wp.com","ip":{"addr":"192.0.76.3","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"1997-03-28","domain_rank":22660,"first_seen":"2017-01-30T05:06:59Z","last_seen":"2026-03-01T23:52:06.278504Z","alert_count":0,"request_count":1,"received_data":13283,"sent_data":413,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"0.gravatar.com","ip":{"addr":"192.0.73.2","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"2004-07-15","domain_rank":67278,"first_seen":"2012-05-21T07:08:47Z","last_seen":"2026-02-25T21:35:15.21823Z","alert_count":0,"request_count":2,"received_data":30307,"sent_data":1043,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"r-login.wordpress.com","ip":{"addr":"192.0.78.18","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"2000-03-03","domain_rank":230904,"first_seen":"2012-05-21T07:12:00Z","last_seen":"2026-02-25T22:27:47.657846Z","alert_count":0,"request_count":1,"received_data":587,"sent_data":653,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fakezoommeeting.site","ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"domain_registered":"2026-02-28","domain_rank":0,"first_seen":"2026-03-02T14:04:26.891996Z","last_seen":"2026-03-02T14:04:26.891996Z","alert_count":13,"request_count":13,"received_data":318132,"sent_data":6728,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress.com","description":"WordPress.com is a platform for self-publishing that is popular for blogging and other works.","website":"https://wordpress.com","common_platform_enumeration":"","icon":"WordPress.svg","categories":["PaaS"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"fakezoommeeting.site/rlt-proxy-js-after","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"6038d3a9df0c4a0d4f2d579a7ddd6819","sha1":"1d5d604b8d36963dc8c97ae4281902437a4d1604","sha256":"b3c9bf3f4459575939fdae9a8189dbb1d5f3404c92a82a9dcf982f8266326c11","sha512":"52972fb643d4188bd66909c583f96236a14d7041732df6f9eb9fdf3f624b7696451f6ea38e39d40e920281193d5de9eab6c33634175eb44b6a2ad821a04298cd","ssdeep":"","tlshash":"5be08c8fc0841c9599a64c3221603a1380875ca3c8218540089a81ad2ab28b0a4f6a8e","size":360,"data":"","first_seen":"2025-12-02T05:46:22.73307Z","last_seen":"2026-03-19T13:18:06.498041Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/jetpack-mu-wpcom-settings-js-before","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"54264ca948dadc6ce073fe5b10f372f7","sha1":"e3302d6e2740923c3bbeb1e3261762a41df1da63","sha256":"28d9fda9a6075b6c2448cff71e4ebda5965793c856abad09d269c81ff9dd63f2","sha512":"1d155380456bf7cec833d0539c83af1898e6cade3332273db3fad76390309b04a83207a32b7ef18ac91d0b65814ccf6848ea491c5c8a66e9c20c066e3fe9ea11","ssdeep":"","tlshash":"def02e13c0dc099920a007b44d9022f2848fa32cc895b2cafcef903a19a2400a2b9a40","size":463,"data":"","first_seen":"2025-12-14T07:50:14.982529Z","last_seen":"2026-03-02T14:04:31.512063Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wpgroho-js-extra","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"046f694d5724e21b8c7ebbfbb0ae9c48","sha1":"7de311e7b91fc246999b0c471bb07b5bbe82a446","sha256":"816394c6e7f51ad339be2d51a136f8f80709a40ad2c4cf1409814234a37fa002","sha512":"6a7ac943c985df4b71cadbff17da9b6ff06033cca091e6e6f65b1dab7c74ab436d53704c85f93956a36897259e01054eee98eb3c558effdd1669c9b8d7836c1d","ssdeep":"","tlshash":"10e01214c0d82dc133d01c31a279006383c95545c06e0e14694cc1436e32002c1f1348","size":394,"data":"","first_seen":"2025-12-02T05:46:22.734688Z","last_seen":"2026-03-19T13:18:06.502366Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"0.gravatar.com/js/hovercards/hovercards.min.js?ver=202610924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1","fqdn":"0.gravatar.com","domain":"gravatar.com","tld":"com"},"ip":{"addr":"192.0.73.2","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6815534a2ef2b24c3f36bf31174f8f1","sha1":"0eb7fb2069e76105e01a1f911336c2affcaa4ff8","sha256":"924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1","sha512":"58cfd90d5b457b52cdec76d595341a1b139763507a558c5873a470cf4d82086f504849f6b848f8e05d4dae01e97e694e63312ec8833f0d0ba50c9dc2d5380e58","ssdeep":"384:Wbj95jEUe9Yh47iiTqFt7L/yj8lxwOqTvkSB93aTTBBTYuX:aqYa+iTi7L/S6wOqTvJ3aTTTTJ","tlshash":"cca2a591eb656472011b9bb1c16fe315e24fa905f7e28040ee32f9c9165ecc6f322e2d","size":21838,"data":"","first_seen":"2025-08-28T00:14:25.8978Z","last_seen":"2026-03-22T08:16:22.072811Z","times_seen":8575,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/js/bilmur.min.js?i=17\u0026m=202610","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5fe307f96e76dd8ad03e2c77eb822155","sha1":"df96b32fae3d1780bc1ae1ac6304f4ecf85708ea","sha256":"1ff089b0a8f51cda03e18980b38b46e10a8c1e5aac97f20c35a926a958c5f9ae","sha512":"4105e7d94d5abca8acd1c3424305e6eaed570ddfc622a3f6799bb72aa0d515b9f229e2254ae1c014bfb64bf6cb4b74d4fbd616c6a08d4f0cd60ffb7ec282c789","ssdeep":"384:gIUFa8xXeKmROq3y81T6oFOMT2aMs9TTvf9Wkk:kRcKq1hO7atjpk","tlshash":"2752d7edf641307613d3a1f2517f160b723b7b915c8a9088912eebd12c7898e526bf9c","size":13941,"data":"","first_seen":"2025-11-03T01:40:22.079034Z","last_seen":"2026-07-19T23:12:16.756811Z","times_seen":22298,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/mu-plugins/actionbar/actionbar.js?v=20250204","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"677222cc88ba59934eda57fe1fd7150b","sha1":"586391d9b76186e22f6c492fb5d2a3c518a4e46a","sha256":"58d9276a59e1fb86a5d3edfa8614d1e33534701851b668b88cb57c4e2c8021a7","sha512":"6ac695087cd5cba6fbf6f5e4bcc323a304a90cbce1a59795bcdcfa6dbf1b32471feac5cebca3e4b4e769d64553dde1473b27be6bae453edd2c546824dc8e81c3","ssdeep":"192:VQY3910Vg7pLtvMFO90ypCyliXVmXOlvFwXLlN+FxO1jeR4K35vohbndoLfKwhJZ:VN30Vg7pLtvMFO90ypCyliXVmX2twX5y","tlshash":"a91275da31b4597432ef0ea7abe69b82b6f0459bf48084de147c8c091e6bcc31773695","size":9088,"data":"","first_seen":"2025-02-05T14:39:46.721215Z","last_seen":"2026-08-18T09:25:02.385792Z","times_seen":18228,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"7da7f28f7ff8f2855c2ef2c53939652a","sha1":"d304ef8044eefbe93f5a3a7732cd9b81751961b1","sha256":"b8b10dfcaab4300c0b0f1b49c42c1b95ee7cd8e087ffe355ee64a62f407a3c3d","sha512":"21238a1fa5e8f9ebb55256b6827ca5bf273b8c3d99bbfbec9a6203192ba37c060ad65a5b22257cb23cb73549cd0f2277e849d94b62980fd1e2476465acbc3d9a","ssdeep":"96:NKy173a7ymf1DnXyM2GLcHXHe8k8KOHgJsmH85bctMzK6kxIpu0fieAFUuPg:NfBWf1DnXyM2GLZzOHzt5xwepvieAhg","tlshash":"94b1538b5b9c1e18887610227c90b395383dd63cb90acf35acbe45286dd9efbc151e4c","size":5575,"data":"","first_seen":"2026-03-02T14:04:31.513862Z","last_seen":"2026-03-02T14:04:31.513862Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"045d9793bea2147d49e2091523bca32f","sha1":"add12c4d76b79a2ac35faec35f62d29a95aba30f","sha256":"e08353fd145bf9e8bfd944b3d6f4ccfa8ee927eda9209edeb5b1744e3b3a85b7","sha512":"9ca71c48df2dddcf5fb60a035e0a40426e4f46ac7c8acdd14fcf1faf60ebd152d3fad1477b9de2d62e3034d2cea7fb54ed6c70f79c4888228b463b1e5c2b3114","ssdeep":"","tlshash":"a5d05e44db5da880803d3024df6f61cc241d527b945008ea1d06e2b0ad74a2f8115cee","size":261,"data":"","first_seen":"2023-03-07T01:29:43Z","last_seen":"2026-07-05T08:21:38.6835Z","times_seen":17083,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wpcom-actionbar-placeholder-js-extra","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"012b0b2056d001aea1d0a3a29a18b7f8","sha1":"6977cb49f8513606afe7a544d81d69cfea8ca05a","sha256":"0b0c3cf9d49e126c5c26155a47b200d5e6f98b8da8b0511eb555e34128e67d62","sha512":"287ffd011d483c9fad392e214af031bd81c08172fc3071c1aeed344374390d291ae59fa34b1f6d4b6721a0817ed8588c771f9e92ceb4b0cfd9a288929bc33801","ssdeep":"","tlshash":"b311cbabf8832c45865345f06dbd634f9865e83acc54a501be9ccd3c033119a609160c","size":898,"data":"","first_seen":"2026-03-02T14:04:31.515277Z","last_seen":"2026-03-02T14:04:31.515277Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"fe147b20350ce203f5267adc24017368","sha1":"09bd8409de5432acddd479d78a0ec745bd7dafd4","sha256":"e4b46e514b1ddbd9ceb18e26551a78f269f40b5d83f9bde17f3e4d55e8c194af","sha512":"ea5f9c24d347231d2661e3b3439703a4d2b4e3277a95fcdea24e4a85a272094408e807635959cb48eeaca1dadd5f20ca007dea2e6bbe4d0cfa70c16ad4ce7a52","ssdeep":"","tlshash":"1e01cbabb8832c45865345d06dbd634f9825e83acc449501be9ccd3c033119a609150c","size":690,"data":"","first_seen":"2026-03-02T14:04:31.516071Z","last_seen":"2026-03-02T14:04:31.516071Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5048b7bf6f335c259cae5d653d50726e","sha1":"96f45044f726eef7c8e7c7f21f6368bf23a2b3f0","sha256":"b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8","sha512":"8990f24d3989c392c00a4fc59d78945a401eb3295fc287a2c718323cc83e27b2d403e9e08162b2cef4f5c944b31d3eee98560acbb7bc4dc58b70b72aa83a4311","ssdeep":"","tlshash":"08f02346b24c383581ff3379b0dfd7817026203cb44d84405a40902d7632e0b60dae6a","size":655,"data":"","first_seen":"2023-05-08T13:17:26Z","last_seen":"2026-08-18T20:08:20.555491Z","times_seen":19968,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-includes/js/wp-emoji-loader.min.js","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"9b6352737d2d98585ef49506f96d6f31","sha1":"f5beb66f35814e7d5153546798d6e1ea61be3950","sha256":"c1485309a9ed4f267f30191b909d416ae8880da41c2231ac4118b4a23123b4fa","sha512":"c2a9a03e42a7c42bee39b1ed7672a71262b56f79748c15e80670508adeffa1f7923e0fb496997e0f9fcadff3078855f561274d34df12e11a72865b86479c95a1","ssdeep":"","tlshash":"3261969ae77a3cdbb2f900f2697a0d47eb614435d6c8d438c9bda3141cb5893c274b46","size":3442,"data":"","first_seen":"2025-12-02T05:46:22.722148Z","last_seen":"2026-03-24T04:02:51.782862Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"88f5e1859a61a6144748cff58d80c844","sha1":"71448e4a0606038eba1907066499bf42bf86b309","sha256":"0c0530e66f27f9baf6235ace89f4c8e7e8f49b1abdb0db34e86ee1b97a5c4157","sha512":"160d29b597246838e8f35617a900cfdd0e46e26433186fc6c320c5147668150203d9b6204aba6df24f939de47d65650d757fb51cce2614452c982bff09f865bd","ssdeep":"","tlshash":"f3d02e1380dc099920a007b44d9022f2848fa32cc885b2cafcee903a19a240062b9a40","size":249,"data":"","first_seen":"2025-12-03T16:21:58.436726Z","last_seen":"2026-03-22T19:25:12.585463Z","times_seen":503,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d791b0deb9032213491b9cbfdf878d47","sha1":"480c1f89c02b3016c7c4800a3b79f62889a3807f","sha256":"df32a81b6c0ea6a818f2c689dd6ad16e11aafec37fae50631b13388a2cd892f6","sha512":"f613863b4007a4d480daaee922639b209592bcb8fc7c1365a6cda3a9b2b7be2fd56fbc18b3de106a9543e9ca3fa48c7eed6a7695c58f3dc2ac5fb48946a975b0","ssdeep":"","tlshash":"4cc02b8fc0c41c95dda64c2231203b1380874cf34821c54008ddc1bd2ab28f064f798f","size":139,"data":"","first_seen":"2025-11-18T19:04:32.054673Z","last_seen":"2026-03-23T10:37:33.188581Z","times_seen":1441,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stats.wp.com/w.js?68","fqdn":"stats.wp.com","domain":"wp.com","tld":"com"},"ip":{"addr":"192.0.76.3","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b4969813ea61ddfc4dd217169337d570","sha1":"8158b7de1166fce531fb3d09acd367cbf1b4b91a","sha256":"bbcc769c4704058d89afc024f24dde11deed8ec61b99f1d52ba935fad8614523","sha512":"a62dd8bf95ec546f4383f2cdff2835ee6c318a4a8b5a063f33581a36fb80125069eaa135a15bd2405dc7a4dff97eb156aa80f539c4dd371bffc6ec9486c6ebb3","ssdeep":"192:LXRPSjDWRYtEAU98twdANhSUxiNlTOD2UNFxlGXCpbJX+fCFbAvywybJKbfOas51:SkKn7wd/CFJX+qkbOKrVa","tlshash":"3442a3a9b1a1f07406fb60a9133f630af1768a25785b94d0d369d8e07d7898f4123fbd","size":12829,"data":"","first_seen":"2024-06-01T12:24:25Z","last_seen":"2026-08-17T06:29:53.745634Z","times_seen":25996,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-includes/js/wp-emoji-release.min.js?m=1764078722i\u0026ver=6.9.1-alpha-61558","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f0cc9ba5cf46af0cd73d521803e3b07e","sha1":"7d2a74f87dc70a39eccce3bae1d4cc404cb134f4","sha256":"fd59b0ebf6282ed71647bf2f6e0d1925bbfd1f270865a832079ebb60259aabca","sha512":"7ec44f08676c195547a623504c7105ef3d0acea5839675599598043f3e0b5a3386452e3db6fbea90722f7be9e6effdae1b89c49e2b05b22b8c415616e07d471d","ssdeep":"384:WzevzApRZTbXU/3o//bEPhXgA5POkpJTX:Wsk9XU/3o//YpXgAs+hX","tlshash":"7fa2959ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c80","size":22762,"data":"","first_seen":"2025-11-10T19:52:32.864936Z","last_seen":"2026-08-18T20:35:47.970056Z","times_seen":311642,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/js/rlt-proxy.js?m=1720530689i","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"146180a330ce9e46e1f9adee12415931","sha1":"6424ee3ad0e04217ad924f8232c66780fb206917","sha256":"4e1ddbb805779444ab8a88a9527fec667fc9686d1247f88727ad3a04b9ec0573","sha512":"8cd22742bab345037fab961b9bc72bf5ad764dbcfadbe6a9fddb60b982deeb07c64b4bcb2259eedbce6d39794ebd4eb15decd05335434967aa2a14bb586f8751","ssdeep":"","tlshash":"8c51ce8fb515213917f29a2abb27360274770091590a9140c16999f13fbab8fc227fce","size":2481,"data":"","first_seen":"2024-07-09T18:34:31Z","last_seen":"2026-08-18T20:08:20.566653Z","times_seen":16026,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"0.gravatar.com/js/hovercards/hovercards.min.css?ver=202610924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1","fqdn":"0.gravatar.com","domain":"gravatar.com","tld":"com"},"ip":{"addr":"192.0.73.2","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.566Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gravatar.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Feb 2026 19:44:12 GMT","end":"Sun, 10 May 2026 19:44:11 GMT"},"fingerprint":{"sha1":"53:E6:67:FE:F3:2D:4B:20:29:65:08:14:EF:1C:5A:C7:E9:D3:E7:65","sha256":"2F:59:A3:5A:A1:8E:34:C4:42:31:2C:80:90:08:4C:1A:EE:BD:36:C9:DA:79:CC:33:02:4D:3C:4E:DC:18:68:67"}}},"request":{"raw":"GET /js/hovercards/hovercards.min.css?ver=202610924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1 HTTP/1.1\r\nHost: 0.gravatar.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 27 Aug 2025 17:47:56 GMT\r\netag: W/\"68af44cc-1d85\"\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\nexpires: Mon, 09 Mar 2026 14:04:04 GMT\r\ncache-control: max-age=604800\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-nc: HIT arn 26\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7557,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (7457)","md5":"76eb82b1efaf3230452da95b7887182f","sha1":"41dbbcbb61c92fd4f313116da3a14f48c2dce4de","sha256":"a3874c1e7d3b8e79b6bb7af0f74051bb75d0e2021e40538740a555f3c247004a","sha512":"2b4d8b97efac710d622abe97615c8646ed08082e12fa40a6fb41b394951a0d9677327929e274cf575fe5d2ecd29181f5daf79377384b85f82c7921a9f6c9c100","ssdeep":"48:AFRV7SZ5pzQhe4MGcYeSAsLEx5+VVLCtJIeCQYH1g2cH7Ay2qcVgENt+Gg1mcSu7:C1SZDcTMGPeeSP3qqc1n6S2f","tlshash":"2df14312df021225501a98b2d899f3aa9354f561d7f34189ff305d1e8b87aeaf360e3d","first_seen":"2025-08-28T00:14:25.895777Z","last_seen":"2026-08-18T13:49:02.221816Z","times_seen":20057,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"r-login.wordpress.com/remote-login.php?wpcom_remote_login=key\u0026origin=aHR0cHM6Ly9mYWtlem9vbW1lZXRpbmcuc2l0ZQ%3D%3D\u0026wpcomid=253012574\u0026time=1772460244","fqdn":"r-login.wordpress.com","domain":"wordpress.com","tld":"com"},"ip":{"addr":"192.0.78.18","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wordpress.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Jan 2026 19:45:24 GMT","end":"Tue, 07 Apr 2026 19:45:23 GMT"},"fingerprint":{"sha1":"E5:FF:13:22:D9:BE:73:43:C6:DC:CC:38:4F:29:33:5D:19:F9:00:69","sha256":"F7:09:98:48:31:28:EA:BE:EE:9E:C7:0B:23:66:B1:33:A4:14:26:EB:BA:98:BE:B2:72:58:B0:D3:63:56:6C:54"}}},"request":{"raw":"GET /remote-login.php?wpcom_remote_login=key\u0026origin=aHR0cHM6Ly9mYWtlem9vbW1lZXRpbmcuc2l0ZQ%3D%3D\u0026wpcomid=253012574\u0026time=1772460244 HTTP/1.1\r\nHost: r-login.wordpress.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:05 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding, Cookie\r\nexpires: Wed, 11 Jan 1984 05:00:00 GMT\r\ncache-control: no-cache, must-revalidate, max-age=0, no-store, private\r\ncontent-encoding: br\r\nx-ac: 17.arn _dfw MISS\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=31536000\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=MISS;dur=414.0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":130,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"7595209a630076644bf6199e39cb6c0b","sha1":"0fbbd4a453e6bc949669cee96119b75ea04ac861","sha256":"49c129fe330b37e4b77cbe8b0f9ed21be6b4e29e9f5f088427f65480572effd0","sha512":"f133b8804db9b40290e1d04749acb543f144d8171635e1f294ed76b25cd48ae32b3a0493354ab9f54be2a80ec73390f13600f8a42d3ee3d8846546ee5241233a","ssdeep":"","tlshash":"1cc09bef5c1588db155104d57525bb1d7455c05ce9056b10d1a9a740059b6da4c0534c","first_seen":"2026-03-02T14:04:31.497775Z","last_seen":"2026-03-02T14:04:31.497775Z","times_seen":1,"resource_available":false,"data":null}},"time_used":514,"timings":{"blocked":50,"dns":2,"connect":8,"send":0,"wait":421,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/plugins/gutenberg-core/v22.5.3/build/styles/block-library/style.min.css?m=1770945363i\u0026cssminify=yes","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /wp-content/plugins/gutenberg-core/v22.5.3/build/styles/block-library/style.min.css?m=1770945363i\u0026cssminify=yes HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: text/css\r\nstrict-transport-security: max-age=31536000\r\nlast-modified: Fri, 13 Feb 2026 01:16:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698e7b65-1ebf2\"\r\ncontent-encoding: br\r\nexpires: Sat, 13 Feb 2027 12:38:38 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 35.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":125938,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d6132d4ebeade770338d67a7853a16b6","sha1":"a25371f49f0b571145113c2a7e482bfebd4d2687","sha256":"4865dc4df4fdbae535d03a8be851537270c6e188fb9f0ae5bf3c5b02579256ad","sha512":"a465a2fb772d255cba858266ad989310dfd6fee8f02987378caccbc5e58d0669cb34d9737c439d19d3df8cbb8d5da41077f1116c6d4ae69215fab153272f278b","ssdeep":"3072:+oeJKCCMQg5Mmjx+qehFP0xTc4iBmgT0cTrnbO27k9w1apPKT:vfMQg5Mmjx+qehFP0xTczTk9caQ","tlshash":"acc3730417b4dcf935ffa73a5e4de258a103aa41c6896be6e066d190728ca494df3f0f","first_seen":"2026-02-06T21:57:44.075987Z","last_seen":"2026-08-17T14:41:38.668854Z","times_seen":160,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/themes/h4/global.css?m=1420737423i\u0026cssminify=yes","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.442Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /wp-content/themes/h4/global.css?m=1420737423i\u0026cssminify=yes HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: text/css\r\ncontent-length: 317\r\nstrict-transport-security: max-age=31536000\r\nx-minify: t\r\nx-minify-cache: hit\r\netag: W/471-1684460922208.3726\r\nexpires: Thu, 15 Oct 2026 05:38:10 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 25.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=2.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":317,"size_decoded":0,"mime_type":"text/css","magic":"CSV ASCII text","md5":"6134a117c00dc1171f42fd8c35b78e88","sha1":"cac0c7c889ea57043338802e8446e9ec8b78fad3","sha256":"224f43833c9a318a3d885fe2ecb4c5b0794e0617ebfff62ad8d729105929246c","sha512":"11896c7411aad29af74ba3fea6417b527271fcdc29e274006c76a7090e2d2114c9afae024d179e967472d7ed6c614db4975d7e256f5405e9199056e8aa1193e7","ssdeep":"","tlshash":"ebe078534791551c000ff5715cac056522543115f647f1e852b2d6319d4bfcc411770c","first_seen":"2025-02-19T23:14:00.002605Z","last_seen":"2026-08-18T20:08:20.565727Z","times_seen":12497,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.447Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: application/javascript\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-minify: t\r\nx-minify-cache: hit\r\netag: W/1125-1684465005221.1526\r\ncontent-encoding: br\r\nexpires: Thu, 15 Oct 2026 05:38:11 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 17.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=3.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":655,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (655), with no line terminators","md5":"5048b7bf6f335c259cae5d653d50726e","sha1":"96f45044f726eef7c8e7c7f21f6368bf23a2b3f0","sha256":"b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8","sha512":"8990f24d3989c392c00a4fc59d78945a401eb3295fc287a2c718323cc83e27b2d403e9e08162b2cef4f5c944b31d3eee98560acbb7bc4dc58b70b72aa83a4311","ssdeep":"","tlshash":"08f02346b24c383581ff3379b0dfd7817026203cb44d84405a40902d7632e0b60dae6a","first_seen":"2023-05-08T13:17:26Z","last_seen":"2026-08-18T20:08:20.555491Z","times_seen":19968,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s0.wp.com/wp-content/themes/a8c/domain-landing-page/img/5.jpg","fqdn":"s0.wp.com","domain":"wp.com","tld":"com"},"ip":{"addr":"192.0.77.32","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.536Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wp.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Feb 2026 19:44:49 GMT","end":"Sun, 03 May 2026 19:44:48 GMT"},"fingerprint":{"sha1":"74:16:DF:29:E8:C6:D5:FE:A5:36:94:0A:16:BE:D1:6C:47:5D:73:4E","sha256":"6B:F6:59:57:FF:CF:20:B1:02:F4:62:B9:0B:13:CF:BC:2A:97:53:23:B5:D3:82:11:79:85:81:64:BE:85:54:75"}}},"request":{"raw":"GET /wp-content/themes/a8c/domain-landing-page/img/5.jpg HTTP/1.1\r\nHost: s0.wp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 277076\r\nlast-modified: Fri, 19 May 2023 02:59:37 GMT\r\netag: \"6466e619-43a54\"\r\nexpires: Thu, 15 Oct 2026 10:51:22 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 26.arn _dca MISS\r\naccept-ranges: bytes\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-nc: HIT arn 10\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=MISS;dur=136.0, a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=0.0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":277076,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, progressive, precision 8, 1440x1024, components 3","md5":"35f05260fc88729a0e82eb38d5bfcbb2","sha1":"f89269db04f133756c1ea75fcc56ac2e57b7b1df","sha256":"81996677263daf2ef80b67df034d7e07ab024772dc37abcd05c1cba55095c555","sha512":"026cc5f4b8d78314476d9f65560be803f386ddedbbdbdf755bc812a96ff21d61ea306a87d93ede0cf7020d829b293457f9306ac78e2c3067041d532e835b3fc9","ssdeep":"6144:3LWDjVP94rYfcjLAYG4SiZYQggYy9+ZS6BVfoD9TDJ5LjBsj:3APXcjO4SiZPggYGkxB09TnHBsj","tlshash":"a044231e8812cdd5fb18c4876a82e41a1238c2d8de0d693776af8bc11b5cd5b27e859f","first_seen":"2025-08-04T05:42:58.127416Z","last_seen":"2026-05-28T06:07:40.31548Z","times_seen":42,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":34,"dns":1,"connect":7,"send":0,"wait":12,"receive":38,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s0.wp.com/i/webclip.png?m=1713868326i","fqdn":"s0.wp.com","domain":"wp.com","tld":"com"},"ip":{"addr":"192.0.77.32","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wp.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Feb 2026 19:44:49 GMT","end":"Sun, 03 May 2026 19:44:48 GMT"},"fingerprint":{"sha1":"74:16:DF:29:E8:C6:D5:FE:A5:36:94:0A:16:BE:D1:6C:47:5D:73:4E","sha256":"6B:F6:59:57:FF:CF:20:B1:02:F4:62:B9:0B:13:CF:BC:2A:97:53:23:B5:D3:82:11:79:85:81:64:BE:85:54:75"}}},"request":{"raw":"GET /i/webclip.png?m=1713868326i HTTP/1.1\r\nHost: s0.wp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: image/png\r\ncontent-length: 6211\r\nlast-modified: Tue, 23 Apr 2024 10:32:15 GMT\r\netag: \"66278e2f-1843\"\r\nexpires: Thu, 15 Oct 2026 05:38:11 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 23.arn _dca MISS\r\naccept-ranges: bytes\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-nc: HIT arn 26\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=MISS;dur=307.0, a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6211,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit colormap, non-interlaced","md5":"f1b192a0d533d4a7d891a5f28b00c90e","sha1":"2b76ce6f402445eae4e65ee4da984a095beb9fdc","sha256":"cdae9c68044f1b74aa02ac5e04a403998f1fa9e5fef51002492617a93d8f2915","sha512":"133c441469583add6cf97faccac8229699f7f73d11562a218e9128d93a43c8e14d996d8ed9502ee2a26d4e6640c31b0c0b53bf57b3868dc2957d8bbf35d1e6cd","ssdeep":"192:4e1QUZCD9dZcskPzFxPQ4jHupVvfcqKxQ66LAQ+:4OCDhzWxJ7jHSHgAz+","tlshash":"38d19f9bfe6714afe287693446c1d35d75b82e4487868ceb8cd06f1f8d186985c3441f","first_seen":"2024-04-26T08:49:23Z","last_seen":"2026-08-18T15:52:15.446627Z","times_seen":9310,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-02T14:04:04.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nstrict-transport-security: max-age=31536000\r\nx-hacker: Want root?  Visit join.a8c.com/hacker and mention this header.\r\nhost-header: WordPress.com\r\nvary: Accept-Encoding, accept, content-type, cookie\r\nlink: \u003chttps://public-api.wordpress.com/wp-json/?rest_route=/sites/fakezoommeeting.wordpress.com\u003e; rel=\"https://api.w.org/\", \u003chttps://wp.me/h7C7Y\u003e; rel=shortlink\r\ncontent-encoding: br\r\nx-ac: 23.arn _dca STALE\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=STALE;dur=1.0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress.com","description":"WordPress.com is a platform for self-publishing that is popular for blogging and other works.","website":"https://wordpress.com","common_platform_enumeration":"","icon":"WordPress.svg","categories":["PaaS"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":46325,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (18446)","md5":"f87ade1fc47c39387b6215169b523c2a","sha1":"2bb8083e59aa64cd39d909f417d59e24245c8bb1","sha256":"bb252e9de805812540fb56ef15a36a83fdeb141f82d6247a6b86cec7a03098fa","sha512":"402d70c6dd4d7fc1e9e0ae650e744b0abfbd6edf92d30b256bdf9fd5a873c657406ab5a8637c70d29580fcc8ab77483c38c459c4d5415fc925e40ca4a93741a0","ssdeep":"768:YBelaxVEeAMZdypH3iW1hRM/5SMDpUmnJaDGl2/+NRCsIHS+Wo0sCoMsPOP:8YwypXiW1hRM/5SMdUmnJaMOxMsPc","tlshash":"5d23b762a16d0424bf690b96f406b32ab06dde3886059df970f5292c5dc7dfb02e736c","first_seen":"2026-03-02T14:04:31.50254Z","last_seen":"2026-03-02T14:04:31.50254Z","times_seen":1,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":72,"dns":47,"connect":7,"send":0,"wait":8,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/_static/??-eJx1i1EKgCAQBS+ULYVEfURnWXQzQ9dwhej22WdE8H7mMQPnoUziQlygbBRJAEcDNkX0rAKy9ezUgY5AyhWoNSINeFhrIxApZ38S1jK/4F8T5O/x6EucOz3Vad0P+w0bNzha\u0026cssminify=yes","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.438Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /_static/??-eJx1i1EKgCAQBS+ULYVEfURnWXQzQ9dwhej22WdE8H7mMQPnoUziQlygbBRJAEcDNkX0rAKy9ezUgY5AyhWoNSINeFhrIxApZ38S1jK/4F8T5O/x6EucOz3Vad0P+w0bNzha\u0026cssminify=yes HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: text/css;charset=utf-8\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 19 May 2023 02:59:37 GMT\r\netag: W/\"6466e619-342e\"\r\ncontent-encoding: br\r\nexpires: Thu, 15 Oct 2026 05:59:55 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 28.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13358,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"68bfd5fb8565dce82410cce70d269892","sha1":"75708e0bda2be98902472596a4b4d884e6f4b85f","sha256":"42d3ddb12674d1a505daa193e811a47abb46f989cb6929d1000afe4c8c29314d","sha512":"ce88bd45de8b7a5759d99af26e9b711221f2a3ffbe6920d36b888d64d329b0f5482c7299fd94b1e5a993a1c80679cc5caee6f0b2c5d3a4dc63993573649e7b21","ssdeep":"192:PtM4UIdGm76BSdGDr2lFqalpTVrfQ+xpv5fe6sEOqnxlGVuskhp3NvKU:KOdf76lDWFqajTVrfQ+nv5feY/ucXLoU","tlshash":"1d5259b1994a222d10a2ef4db3ebeac1760828fb6d25b051f9ec99544fef71c4210f5d","first_seen":"2025-09-21T15:47:59.132793Z","last_seen":"2026-08-13T00:26:40.651015Z","times_seen":184,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/js/bilmur.min.js?i=17\u0026m=202610","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /wp-content/js/bilmur.min.js?i=17\u0026m=202610 HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: application/javascript\r\nstrict-transport-security: max-age=31536000\r\nlast-modified: Fri, 31 Oct 2025 10:41:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6904925f-3675\"\r\ncontent-encoding: br\r\nexpires: Tue, 02 Mar 2027 00:00:02 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 29.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=3.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13941,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13940)","md5":"5fe307f96e76dd8ad03e2c77eb822155","sha1":"df96b32fae3d1780bc1ae1ac6304f4ecf85708ea","sha256":"1ff089b0a8f51cda03e18980b38b46e10a8c1e5aac97f20c35a926a958c5f9ae","sha512":"4105e7d94d5abca8acd1c3424305e6eaed570ddfc622a3f6799bb72aa0d515b9f229e2254ae1c014bfb64bf6cb4b74d4fbd616c6a08d4f0cd60ffb7ec282c789","ssdeep":"384:gIUFa8xXeKmROq3y81T6oFOMT2aMs9TTvf9Wkk:kRcKq1hO7atjpk","tlshash":"2752d7edf641307613d3a1f2517f160b723b7b915c8a9088912eebd12c7898e526bf9c","first_seen":"2025-11-03T01:40:22.079034Z","last_seen":"2026-07-19T23:12:16.756811Z","times_seen":22298,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/i/fonts/merriweathersans/merriweathersans-regular.ttf","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.538Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /i/fonts/merriweathersans/merriweathersans-regular.ttf HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/_static/??-eJx1i1EKgCAQBS+ULYVEfURnWXQzQ9dwhej22WdE8H7mMQPnoUziQlygbBRJAEcDNkX0rAKy9ezUgY5AyhWoNSINeFhrIxApZ38S1jK/4F8T5O/x6EucOz3Vad0P+w0bNzha\u0026cssminify=yes\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: application/font-ttf\r\nstrict-transport-security: max-age=31536000\r\nlast-modified: Fri, 19 May 2023 02:56:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6466e555-d7a8\"\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nexpires: Thu, 15 Oct 2026 05:59:56 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 22.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55208,"size_decoded":0,"mime_type":"application/font-ttf","magic":"TrueType Font data, 16 tables, 1st \"FFTM\", 20 names, Microsoft, language 0x409, Copyright (c) 2013, Sorkin Type Co (www.sorkintype.com) with Reserved Font Name 'Merriweather'Me","md5":"072765c9ce2a1b5a1bec0b3c98b84018","sha1":"cb79bc1a191634feaf0d91afe932e716b5313365","sha256":"5ef6c4d10f8e2105cae607df29fde760dcd153899bdf7438f63f2fab46769290","sha512":"5c45ea17e09641d0fc8340ac5f0963226e2be52a71ea188a7855b1b81802850932bac492eeae1983d3c68d30c0137238902e77a87ebdb9c8de676360252c7284","ssdeep":"768:58nUyZ/a/iavokYDbFrsG2Mh0S5dw3SwosKot91gCfVjZAdlCW+SDvQwGMcPcW0:meQkmJsGt+S5yvrjsZswr","tlshash":"50439e1aa7c5ca27f517733c88242175013bf9382636334f598acf2aec435a885a9fdd","first_seen":"2023-05-26T13:24:02Z","last_seen":"2026-08-13T00:26:40.646861Z","times_seen":196,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pixel.wp.com/g.gif?x_stats-initial-visibility=visible\u0026v=wpcom-no-pv\u0026rand=0.32475315001305416","fqdn":"pixel.wp.com","domain":"wp.com","tld":"com"},"ip":{"addr":"192.0.76.3","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.544Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wp.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Feb 2026 19:44:49 GMT","end":"Sun, 03 May 2026 19:44:48 GMT"},"fingerprint":{"sha1":"74:16:DF:29:E8:C6:D5:FE:A5:36:94:0A:16:BE:D1:6C:47:5D:73:4E","sha256":"6B:F6:59:57:FF:CF:20:B1:02:F4:62:B9:0B:13:CF:BC:2A:97:53:23:B5:D3:82:11:79:85:81:64:BE:85:54:75"}}},"request":{"raw":"GET /g.gif?x_stats-initial-visibility=visible\u0026v=wpcom-no-pv\u0026rand=0.32475315001305416 HTTP/1.1\r\nHost: pixel.wp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: image/gif\r\ncontent-length: 50\r\ncache-control: no-cache\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 6 x 5","md5":"e4d673a55c5656f19ef81563fb10884c","sha1":"1f2d8ed221d39329251ad3a6ff1edb20b7219443","sha256":"f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1","sha512":"e0b03411282a979cf772f700d9e5634b0c25c612e380ad33c0d59059b1b479d027016d5beb148403ef185430db35f5faed362f36ce2c8ecad0e6d8e30cea97b4","ssdeep":"","tlshash":"69900201f9a08180c1206535091a035c62049256490443062255751c5d546650616254","first_seen":"2023-04-05T23:53:38Z","last_seen":"2026-08-18T20:44:51.651599Z","times_seen":117857,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pixel.wp.com/g.gif?crypt=UE5tW3cvZGRWeXosZ0V4dk5hejB0d25DRnx2OFhsPXhjZXlCL3FyPUJXeUguSlt1TT9fMENFVlY5XSxCZzFvUUdKZk1VJXhvdnRkUE1FeDBWSD9KbEFjRlZUMkpTK0gzVVtpfldTcUVNV3ptaU54VURScl1aTnxkJixCdW9xciVWZytjRVpnQn5JTzNQVFk4TVtFS2VyaFt6R0paNl1DfDdFPWt2cWtJWEN1Y3crMXU%3D\u0026v=wpcom-no-pv\u0026rand=0.8364627515455588","fqdn":"pixel.wp.com","domain":"wp.com","tld":"com"},"ip":{"addr":"192.0.76.3","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.547Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wp.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Feb 2026 19:44:49 GMT","end":"Sun, 03 May 2026 19:44:48 GMT"},"fingerprint":{"sha1":"74:16:DF:29:E8:C6:D5:FE:A5:36:94:0A:16:BE:D1:6C:47:5D:73:4E","sha256":"6B:F6:59:57:FF:CF:20:B1:02:F4:62:B9:0B:13:CF:BC:2A:97:53:23:B5:D3:82:11:79:85:81:64:BE:85:54:75"}}},"request":{"raw":"GET /g.gif?crypt=UE5tW3cvZGRWeXosZ0V4dk5hejB0d25DRnx2OFhsPXhjZXlCL3FyPUJXeUguSlt1TT9fMENFVlY5XSxCZzFvUUdKZk1VJXhvdnRkUE1FeDBWSD9KbEFjRlZUMkpTK0gzVVtpfldTcUVNV3ptaU54VURScl1aTnxkJixCdW9xciVWZytjRVpnQn5JTzNQVFk4TVtFS2VyaFt6R0paNl1DfDdFPWt2cWtJWEN1Y3crMXU%3D\u0026v=wpcom-no-pv\u0026rand=0.8364627515455588 HTTP/1.1\r\nHost: pixel.wp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: image/gif\r\ncontent-length: 50\r\ncache-control: no-cache\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 6 x 5","md5":"e4d673a55c5656f19ef81563fb10884c","sha1":"1f2d8ed221d39329251ad3a6ff1edb20b7219443","sha256":"f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1","sha512":"e0b03411282a979cf772f700d9e5634b0c25c612e380ad33c0d59059b1b479d027016d5beb148403ef185430db35f5faed362f36ce2c8ecad0e6d8e30cea97b4","ssdeep":"","tlshash":"69900201f9a08180c1206535091a035c62049256490443062255751c5d546650616254","first_seen":"2023-04-05T23:53:38Z","last_seen":"2026-08-18T20:44:51.651599Z","times_seen":117857,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/mu-plugins/actionbar/actionbar.css?v=20250116","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.578Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /wp-content/mu-plugins/actionbar/actionbar.css?v=20250116 HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: text/css\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-minify: t\r\nx-minify-cache: hit\r\netag: W/18776-1750255843681.0737\r\ncontent-encoding: br\r\nexpires: Thu, 15 Oct 2026 05:38:12 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 22.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16012,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4069)","md5":"081b8dc6366ecbed4540e2095032527f","sha1":"7876286288d2add1e689c9577bf3702aa4a9999e","sha256":"e0149c0e2f0d8a3a537e61c08556fa18e30d249cc6c56e84c5b80f7adeb0fcdb","sha512":"6453382e84605235938f8cce58a0ff986018d7bc59e6d317f681166beabe5a2701db69d3d91b048a7ddb4246f6b8dc63e4e18f05ab5bf266f7b247ef039f23c3","ssdeep":"384:/eZ+AggqgWYwdqJWJ0KI3h3r3pRuYOHg8X1:/ep7kc3c","tlshash":"4a72cad173a23839f62bce53e7c1bd9a903d6a01a4639dddb8725408afb18c64f1b604","first_seen":"2025-09-11T07:13:10.091435Z","last_seen":"2026-08-18T09:25:02.411782Z","times_seen":17692,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":4,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/_static/??-eJx9y0EKAjEMBdALGcNARV2IZ2lrrJWmKU3LXH/iTkFmE/I//+HaIEodVAfyhFZmylUxSifrufmBtmB6ZE+F2GbHqHrA/2xtZiCE1kkV7HKeDONlUPdcp1Ak2ZvQVl9xDyUSKBL9yFJ/AjyLz/1D73xb3Onq3OW8uPcGiipX9A==\u0026cssminify=yes","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.441Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /_static/??-eJx9y0EKAjEMBdALGcNARV2IZ2lrrJWmKU3LXH/iTkFmE/I//+HaIEodVAfyhFZmylUxSifrufmBtmB6ZE+F2GbHqHrA/2xtZiCE1kkV7HKeDONlUPdcp1Ak2ZvQVl9xDyUSKBL9yFJ/AjyLz/1D73xb3Onq3OW8uPcGiipX9A==\u0026cssminify=yes HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: text/css;charset=utf-8\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 19 May 2023 01:47:52 GMT\r\netag: W/\"6466d548-c76\"\r\ncontent-encoding: br\r\nexpires: Tue, 01 Dec 2026 16:50:03 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 28.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3190,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e47f6c4f01fae426dec7f03fcb7f898b","sha1":"44a372576c437ef6548e9d4811b17ee02517019e","sha256":"4ae29346815c678d6ef4a26ca198d4f37de1e20968bb1609ef20105a77ff52b9","sha512":"99989ee5d5f2bd433a23bdd0b5452b79e318ff57f8404b49bfcbabfdcd96ff19e64d7b390e5bfc99a2fd9dd322a28b8bca85024fdc492579e116563a9a467674","ssdeep":"","tlshash":"8c618a962f4a0d44c88e516a7f59c6427d8eecb2cf1e9df7f284b23a86472d001f160e","first_seen":"2025-12-02T05:46:22.71856Z","last_seen":"2026-03-19T13:18:06.488047Z","times_seen":28,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/js/rlt-proxy.js?m=1720530689i","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /wp-content/js/rlt-proxy.js?m=1720530689i HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: application/javascript\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-minify: t\r\nx-minify-cache: hit\r\netag: W/5444-1720530698843.6633\r\ncontent-encoding: br\r\nexpires: Thu, 15 Oct 2026 05:38:11 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 36.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2481,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2481), with no line terminators","md5":"146180a330ce9e46e1f9adee12415931","sha1":"6424ee3ad0e04217ad924f8232c66780fb206917","sha256":"4e1ddbb805779444ab8a88a9527fec667fc9686d1247f88727ad3a04b9ec0573","sha512":"8cd22742bab345037fab961b9bc72bf5ad764dbcfadbe6a9fddb60b982deeb07c64b4bcb2259eedbce6d39794ebd4eb15decd05335434967aa2a14bb586f8751","ssdeep":"","tlshash":"8c51ce8fb515213917f29a2abb27360274770091590a9140c16999f13fbab8fc227fce","first_seen":"2024-07-09T18:34:31Z","last_seen":"2026-08-18T20:08:20.566653Z","times_seen":16026,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/themes/a8c/domain-landing-page/wpcom-wmark-white.svg","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /wp-content/themes/a8c/domain-landing-page/wpcom-wmark-white.svg HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: image/svg+xml\r\nstrict-transport-security: max-age=31536000\r\nlast-modified: Fri, 19 May 2023 01:49:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6466d5b0-a9d\"\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nexpires: Tue, 02 Mar 2027 08:55:04 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 29.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=4.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2717,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6b828efc306b0d91b5a7a243a830231e","sha1":"b45ba6fff42ca151c2d031d270261dcc724e43f8","sha256":"792570eb115095a36426eaca5a95dbe8ee04723b59950d9ff3a7b0fe57bc1b05","sha512":"af4de46c74409f471f4ccc9715e6a28965f4dacbdbe30914efbb7a0ae205e94ea214509bb5c3b962990febcba1b8934932eb21e5938f67258462b66d4229e9d2","ssdeep":"","tlshash":"235134ecc21bc9497e159a6c59b574943b1b31ab94cc84ddf08eac4c81af4a8294bd8e","first_seen":"2023-10-23T21:52:55Z","last_seen":"2026-08-13T00:26:40.636041Z","times_seen":458,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"0.gravatar.com/js/hovercards/hovercards.min.js?ver=202610924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1","fqdn":"0.gravatar.com","domain":"gravatar.com","tld":"com"},"ip":{"addr":"192.0.73.2","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.446Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gravatar.com","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 09 Feb 2026 19:44:12 GMT","end":"Sun, 10 May 2026 19:44:11 GMT"},"fingerprint":{"sha1":"53:E6:67:FE:F3:2D:4B:20:29:65:08:14:EF:1C:5A:C7:E9:D3:E7:65","sha256":"2F:59:A3:5A:A1:8E:34:C4:42:31:2C:80:90:08:4C:1A:EE:BD:36:C9:DA:79:CC:33:02:4D:3C:4E:DC:18:68:67"}}},"request":{"raw":"GET /js/hovercards/hovercards.min.js?ver=202610924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1 HTTP/1.1\r\nHost: 0.gravatar.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 27 Aug 2025 17:47:56 GMT\r\netag: W/\"68af44cc-554e\"\r\nstrict-transport-security: max-age=31536000; includeSubdomains; preload\r\ncontent-encoding: br\r\nexpires: Mon, 09 Mar 2026 14:04:04 GMT\r\ncache-control: max-age=604800\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-nc: HIT arn 36\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=0.0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21838,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (21834), with no line terminators","md5":"e6815534a2ef2b24c3f36bf31174f8f1","sha1":"0eb7fb2069e76105e01a1f911336c2affcaa4ff8","sha256":"924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1","sha512":"58cfd90d5b457b52cdec76d595341a1b139763507a558c5873a470cf4d82086f504849f6b848f8e05d4dae01e97e694e63312ec8833f0d0ba50c9dc2d5380e58","ssdeep":"384:Wbj95jEUe9Yh47iiTqFt7L/yj8lxwOqTvkSB93aTTBBTYuX:aqYa+iTi7L/S6wOqTvJ3aTTTTJ","tlshash":"cca2a591eb656472011b9bb1c16fe315e24fa905f7e28040ee32f9c9165ecc6f322e2d","first_seen":"2025-08-28T00:14:25.8978Z","last_seen":"2026-03-22T08:16:22.072811Z","times_seen":8575,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":25,"dns":12,"connect":7,"send":0,"wait":8,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stats.wp.com/w.js?68","fqdn":"stats.wp.com","domain":"wp.com","tld":"com"},"ip":{"addr":"192.0.76.3","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.448Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wp.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Feb 2026 19:44:49 GMT","end":"Sun, 03 May 2026 19:44:48 GMT"},"fingerprint":{"sha1":"74:16:DF:29:E8:C6:D5:FE:A5:36:94:0A:16:BE:D1:6C:47:5D:73:4E","sha256":"6B:F6:59:57:FF:CF:20:B1:02:F4:62:B9:0B:13:CF:BC:2A:97:53:23:B5:D3:82:11:79:85:81:64:BE:85:54:75"}}},"request":{"raw":"GET /w.js?68 HTTP/1.1\r\nHost: stats.wp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\nx-minify: t\r\nx-minify-cache: hit\r\netag: W/12868-1717166113344.7605\r\na8c-edge-cache: cache\r\ncontent-encoding: br\r\nexpires: Thu, 15 Oct 2026 05:38:10 GMT\r\ncache-control: max-age=31536000\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-allow-origin: *\r\nx-nc: HIT arn\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12829,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12829), with no line terminators","md5":"b4969813ea61ddfc4dd217169337d570","sha1":"8158b7de1166fce531fb3d09acd367cbf1b4b91a","sha256":"bbcc769c4704058d89afc024f24dde11deed8ec61b99f1d52ba935fad8614523","sha512":"a62dd8bf95ec546f4383f2cdff2835ee6c318a4a8b5a063f33581a36fb80125069eaa135a15bd2405dc7a4dff97eb156aa80f539c4dd371bffc6ec9486c6ebb3","ssdeep":"192:LXRPSjDWRYtEAU98twdANhSUxiNlTOD2UNFxlGXCpbJX+fCFbAvywybJKbfOas51:SkKn7wd/CFJX+qkbOKrVa","tlshash":"3442a3a9b1a1f07406fb60a9133f630af1768a25785b94d0d369d8e07d7898f4123fbd","first_seen":"2024-06-01T12:24:25Z","last_seen":"2026-08-17T06:29:53.745634Z","times_seen":25996,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":17,"dns":1,"connect":8,"send":0,"wait":7,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pixel.wp.com/g.gif?blog=253012574\u0026v=wpcom\u0026tz=0\u0026user_id=0\u0026arch_home=1\u0026subd=fakezoommeeting\u0026host=fakezoommeeting.site\u0026ref=\u0026rand=0.02766177386845392","fqdn":"pixel.wp.com","domain":"wp.com","tld":"com"},"ip":{"addr":"192.0.76.3","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wp.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Feb 2026 19:44:49 GMT","end":"Sun, 03 May 2026 19:44:48 GMT"},"fingerprint":{"sha1":"74:16:DF:29:E8:C6:D5:FE:A5:36:94:0A:16:BE:D1:6C:47:5D:73:4E","sha256":"6B:F6:59:57:FF:CF:20:B1:02:F4:62:B9:0B:13:CF:BC:2A:97:53:23:B5:D3:82:11:79:85:81:64:BE:85:54:75"}}},"request":{"raw":"GET /g.gif?blog=253012574\u0026v=wpcom\u0026tz=0\u0026user_id=0\u0026arch_home=1\u0026subd=fakezoommeeting\u0026host=fakezoommeeting.site\u0026ref=\u0026rand=0.02766177386845392 HTTP/1.1\r\nHost: pixel.wp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: image/gif\r\ncontent-length: 50\r\ncache-control: no-cache\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 6 x 5","md5":"e4d673a55c5656f19ef81563fb10884c","sha1":"1f2d8ed221d39329251ad3a6ff1edb20b7219443","sha256":"f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1","sha512":"e0b03411282a979cf772f700d9e5634b0c25c612e380ad33c0d59059b1b479d027016d5beb148403ef185430db35f5faed362f36ce2c8ecad0e6d8e30cea97b4","ssdeep":"","tlshash":"69900201f9a08180c1206535091a035c62049256490443062255751c5d546650616254","first_seen":"2023-04-05T23:53:38Z","last_seen":"2026-08-18T20:44:51.651599Z","times_seen":117857,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-content/mu-plugins/actionbar/actionbar.js?v=20250204","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.582Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /wp-content/mu-plugins/actionbar/actionbar.js?v=20250204 HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: application/javascript\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-minify: t\r\nx-minify-cache: hit\r\netag: W/17401-1738713594313.599\r\ncontent-encoding: br\r\nexpires: Thu, 15 Oct 2026 05:38:12 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 15.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9088,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9088), with no line terminators","md5":"677222cc88ba59934eda57fe1fd7150b","sha1":"586391d9b76186e22f6c492fb5d2a3c518a4e46a","sha256":"58d9276a59e1fb86a5d3edfa8614d1e33534701851b668b88cb57c4e2c8021a7","sha512":"6ac695087cd5cba6fbf6f5e4bcc323a304a90cbce1a59795bcdcfa6dbf1b32471feac5cebca3e4b4e769d64553dde1473b27be6bae453edd2c546824dc8e81c3","ssdeep":"192:VQY3910Vg7pLtvMFO90ypCyliXVmXOlvFwXLlN+FxO1jeR4K35vohbndoLfKwhJZ:VN30Vg7pLtvMFO90ypCyliXVmX2twX5y","tlshash":"a91275da31b4597432ef0ea7abe69b82b6f0459bf48084de147c8c091e6bcc31773695","first_seen":"2025-02-05T14:39:46.721215Z","last_seen":"2026-08-18T09:25:02.385792Z","times_seen":18228,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fakezoommeeting.site/wp-includes/js/wp-emoji-release.min.js?m=1764078722i\u0026ver=6.9.1-alpha-61558","fqdn":"fakezoommeeting.site","domain":"fakezoommeeting.site","tld":"site"},"ip":{"addr":"192.0.78.24","port":443,"asn":2635,"as":"AUTOMATTIC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fakezoommeeting.site/","date":"2026-03-02T14:04:04.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tls.automattic.com","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Sat, 28 Feb 2026 21:55:26 GMT","end":"Fri, 29 May 2026 21:55:25 GMT"},"fingerprint":{"sha1":"73:6D:56:49:43:A3:65:D9:FC:5F:A4:97:85:11:CF:16:08:A2:D5:3B","sha256":"B4:90:8C:AA:AE:51:3D:C6:FE:91:5B:B3:BA:34:88:F1:D1:EE:2A:FC:7E:46:D9:C9:92:5E:EC:B3:FB:47:45:96"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?m=1764078722i\u0026ver=6.9.1-alpha-61558 HTTP/1.1\r\nHost: fakezoommeeting.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fakezoommeeting.site/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Mar 2026 14:04:04 GMT\r\ncontent-type: application/javascript\r\nstrict-transport-security: max-age=31536000\r\nlast-modified: Tue, 25 Nov 2025 13:52:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6925b48a-58ea\"\r\ncontent-encoding: br\r\nexpires: Wed, 03 Feb 2027 13:45:05 GMT\r\ncache-control: max-age=31536000\r\nx-ac: 19.arn _dca HIT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: a8c-cdn, dc;desc=arn, cache;desc=HIT;dur=1.0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22762,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (19823)","md5":"f0cc9ba5cf46af0cd73d521803e3b07e","sha1":"7d2a74f87dc70a39eccce3bae1d4cc404cb134f4","sha256":"fd59b0ebf6282ed71647bf2f6e0d1925bbfd1f270865a832079ebb60259aabca","sha512":"7ec44f08676c195547a623504c7105ef3d0acea5839675599598043f3e0b5a3386452e3db6fbea90722f7be9e6effdae1b89c49e2b05b22b8c415616e07d471d","ssdeep":"384:WzevzApRZTbXU/3o//bEPhXgA5POkpJTX:Wsk9XU/3o//YpXgAs+hX","tlshash":"7fa2959ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c80","first_seen":"2025-11-10T19:52:32.864936Z","last_seen":"2026-08-18T20:35:47.970056Z","times_seen":311642,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-02","alert":"Sinkholed","trigger":"fakezoommeeting.site","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}