{"report_id":"11703556-d897-42e9-b48e-63c85ce94f83","version":6,"status":"done","tags":[],"date":"2025-11-20T02:49:36Z","url":{"schema":"http","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":0,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"final":{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"title":"403","dom":{"size":2100,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"ab7a5621d2d4403c77c6c7b8be860c93","sha1":"e8f274438277be4a3aa602280da81829ef13075e","sha256":"56fba59e27d5822a4be2b5a8af1c12c8f406b7e6b20cc193c8abd6d844489832","sha512":"8b53e6fb6c1240f411efa42b3706a28bbed0e44934efc3566f06a9a715734c05066d1f3e1f10fe62367b6ae14035b61636f09de597ebb165861d01ee5f7bf134","ssdeep":"","tlshash":"6a41306584e304010abbe1181bb7f54838b89407e257d80a799c3f98df41f5c96e7b85","dom_hash":"domhash75cdc2b0dacddf6e3bb7ccac022f0681","first_seen":"2025-11-19T17:11:51.446336Z","last_seen":"2025-11-20T12:42:48.597177Z","times_seen":5,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":0,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"tags":null,"meta":null,"user":{"country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-25T02:49:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":3}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-20T02:49:14Z","timestamp":1763606954,"ip_dst":{"addr":"172.18.0.19","port":35400,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 19","source":"{\"timestamp\":\"2025-11-20T02:49:14.119800+0000\",\"flow_id\":722557408467692,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"103.80.133.31\",\"src_port\":443,\"dest_ip\":\"172.18.0.19\",\"dest_port\":35400,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400018,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 19\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-11-20T02:49:13.875244+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-20","alert":"Phishing Block","trigger":"lxjf-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"hm.baidu.com","ip":{"addr":"14.215.182.140","port":443,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"domain_registered":"1999-10-11","domain_rank":54491,"first_seen":"2012-05-26T08:38:45Z","last_seen":"2025-11-17T00:13:10.547488Z","alert_count":0,"request_count":2,"received_data":30877,"sent_data":1086,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"lxjf-wahtsapp.com","ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"domain_registered":"2025-09-28","domain_rank":0,"first_seen":"2025-10-24T01:28:25.332863Z","last_seen":"2025-10-24T01:28:25.332863Z","alert_count":15,"request_count":5,"received_data":9456,"sent_data":2229,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-20T02:49:14Z","timestamp":1763606954,"ip_dst":{"addr":"172.18.0.19","port":35400,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 19","source":"{\"timestamp\":\"2025-11-20T02:49:14.119800+0000\",\"flow_id\":722557408467692,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"103.80.133.31\",\"src_port\":443,\"dest_ip\":\"172.18.0.19\",\"dest_port\":35400,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400018,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 19\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-11-20T02:49:13.875244+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":true,"md5":"530b0a5417fe117c413b71716e175700","sha1":"7a5b31284a4a017cef8fa86ef677d1af65f2e2db","sha256":"4067dc1753c1d80f75322d0d44155dabaa200edd48867f89abadfa264d248dd8","sha512":"ee43a9f192e381109e5d2666fac7fc38946a6d810bab8d1da0d20fc5121e163f6bc512f8de785051fd1bed599a11ece5746173618ecad6b0c075355e4272f4ea","ssdeep":"","tlshash":"00f0e5a4c0e148d189af725e276bfcd53e3114c3e015a0023d1c0f5ddfc026c83a5b42","size":530,"data":"","first_seen":"2025-10-19T14:14:10.924441Z","last_seen":"2025-12-06T03:12:34.907396Z","times_seen":190,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/tj.js","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":false,"md5":"613791a5a916b495ab9f29cf170362fd","sha1":"e0a2847de1f94e2da4e6b8ff33297f7f9329683a","sha256":"ed9a078418e9dd1e4dd1a38464df766dbeb7161d4f17429fefa43b4c7f00f74e","sha512":"8e68e70ad39f838e489d2ad78136ae601f091d956386444d4982e3c351ee764606210fc47b61078e00c75e1b18bf948833b12aa3415fa44337a9d347c13b534c","ssdeep":"","tlshash":"24d02e0f2c9458382375082910fbe94cb6a2546d403da40180dce890a9a0fc2082eb88","size":252,"data":"","first_seen":"2025-11-05T15:43:16.692057Z","last_seen":"2026-07-12T13:54:11.067192Z","times_seen":668,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":true,"md5":"58d81ec03be118b18c33cd30bcddae95","sha1":"4ff1bbe78e0d76f8174247d9d67673a5cb556205","sha256":"2597d949e5e6cc19bdf68fb7b7b0faec9dfa29e4234522480a5ff24345ba75c4","sha512":"c781ee7a927cd76190186db82fd1704b96464404ddf934b0c8cef28a5e57d5abd38a8d109da905060f56b29f8b7c9f21cb0591216b6e5c3e36aad02fde8c71fc","ssdeep":"","tlshash":"d1112f3861a724000ff6e229abaaa11434ad5417b773c80ef21db2507f12f1ce0e6ec6","size":888,"data":"","first_seen":"2025-11-19T17:11:51.452699Z","last_seen":"2025-11-20T12:42:48.606384Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-13T08:12:43.343589Z","times_seen":121776,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-13T08:12:43.343589Z","times_seen":121776,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.js?d9bb8c3e0a8ddf6347b7d9d99b109ee0","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"14.215.182.140","port":443,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc704427a6a682bc27776a3099dc37cb","sha1":"225bc42c5a8e194cfe6f4f72c4d02da15c2d8601","sha256":"462ee02eb1df5868713588f38649498ac4f979976a43d6424e810f6d13ce073d","sha512":"73aee35af072548ff004af6221c580bdd1ccf3e93a7d6ccc9c69a18b2f08871f584cb819574d884bf6f4ac93b12df2eded6e45473c9ec1129e075cdef92a67fb","ssdeep":"384:e2JSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:e24VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"e5d2d9a9b282713293a324a5153f324ef17b5a54bd4968a4f11894c07d38fbb027bfdd","size":29895,"data":"","first_seen":"2025-11-20T02:49:38.124303Z","last_seen":"2025-11-20T02:49:38.124303Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"66da12b5cccd80d0c8313a422659e0eb","sha1":"48806fa5fc5f6b21acd5c1ebb0669e211e1a6647","sha256":"188569fc7a592364e965be002296dacb33f8a6f0e74c484a78b954a2b4a8bdd9","sha512":"fb89997330c0d15f57fb88fa4a5bcfe0edc6ac3d59aea75a5def7d98ef720cba0fff9884e7c96e317c3ce3577d7c9d38a1892216c930bfbc79712fefeacb3b56","ssdeep":"","tlshash":"b4d02e8db1c188882be72d83689b940cda590eb12aa82c00884aa842289bb2311220ad","size":273,"data":"","first_seen":"2025-11-20T02:49:38.127695Z","last_seen":"2025-11-20T02:49:38.127695Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"d97623d172f087d9640da9acd38830ff","sha1":"515bd358bb7d990930f0e2b3de399db1787a2567","sha256":"fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a","sha512":"ce6a1969f698a616663f1a19ccfa12a37a4f6d782432d8a08aeb7879efd3e2becf168422ea66bc47e74f6ba865efaae6eabe3c4faba280d7a21f3a94d7c55da1","ssdeep":"","tlshash":"f0400000000000000000000000300000000000000003000c000000c0c0000000300000","size":7,"data":"","first_seen":"2023-03-12T20:41:17Z","last_seen":"2026-08-05T21:33:10.000859Z","times_seen":9187,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"hm.baidu.com/hm.gif?hca=A3C1ED78A31D24F1\u0026cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=1274095450\u0026si=d9bb8c3e0a8ddf6347b7d9d99b109ee0\u0026v=1.3.2\u0026lv=1\u0026sn=60107\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Flxjf-wahtsapp.com%2F\u0026tt=403","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"14.215.182.140","port":443,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://lxjf-wahtsapp.com/","date":"2025-11-20T02:49:17.349Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /hm.gif?hca=A3C1ED78A31D24F1\u0026cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=1274095450\u0026si=d9bb8c3e0a8ddf6347b7d9d99b109ee0\u0026v=1.3.2\u0026lv=1\u0026sn=60107\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Flxjf-wahtsapp.com%2F\u0026tt=403 HTTP/1.1\r\nHost: hm.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://lxjf-wahtsapp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: private, max-age=0, no-cache\r\nContent-Length: 43\r\nContent-Type: image/gif\r\nDate: Thu, 20 Nov 2025 02:49:17 GMT\r\nP3p: CP=\"CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR\"\r\nPragma: no-cache\r\nServer: apache\r\nSet-Cookie: HMACCOUNT=8A878F0D49E55EA8; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT\r\nStrict-Transport-Security: max-age=172800\r\nX-Content-Type-Options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"ad4b0f606e0f8465bc4c4c170b37e1a3","sha1":"50b30fd5f87c85fe5cba2635cb83316ca71250d7","sha256":"cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda","sha512":"ebfe0c0df4bcc167d5cb6ebdd379f9083df62bef63a23818e1c6adf0f64b65467ea58b7cd4d03cf0a1b1a2b07fb7b969bf35f25f1f8538cc65cf3eebdf8a0910","ssdeep":"","tlshash":"15900003fbc08002c2b2e0300b3b0380238ce2200aa8030b80aeb0acecaa3a20c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-08-14T00:43:53.989429Z","times_seen":376735,"resource_available":true,"data":null}},"time_used":315,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":315,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-20T02:49:13.876Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: lxjf-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\nserver: nginx\r\ndate: Thu, 20 Nov 2025 02:49:14 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2028,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"cbcceab86c45eb8aa1c35805b8ec60a1","sha1":"3069274c003bd88dd893e0e0c8529804f918eae3","sha256":"ede0f7d6e677bcfb44ad084c51ded69e1144ed7f2e2a6fc8ee8380ebe2c1ea8d","sha512":"5659e69e28c8b748b91bed4664186d6853061c5f376ffd3473852ad0360213b2675d3bfbd8da38736928c3ca7f05248b58ef29a3e992abe11a1bacc7778920cb","ssdeep":"","tlshash":"c841426884e304010aabe1282bb6f54438b55447f257d806798c3f999f42f1c96e7fc5","first_seen":"2025-11-19T17:11:51.448588Z","last_seen":"2025-11-20T12:42:48.599921Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1244,"timings":{"blocked":498,"dns":0,"connect":245,"send":0,"wait":248,"receive":0,"ssl":251},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-20","alert":"Phishing Block","trigger":"lxjf-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":80,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-20T02:49:14.737Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: lxjf-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx\r\nDate: Thu, 20 Nov 2025 02:49:15 GMT\r\nContent-Type: text/html\r\nContent-Length: 162\r\nConnection: keep-alive\r\nLocation: https://lxjf-wahtsapp.com/\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2028,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T00:51:56.928895Z","times_seen":17878665,"resource_available":true,"data":null}},"time_used":741,"timings":{"blocked":246,"dns":1,"connect":247,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-20","alert":"Phishing Block","trigger":"lxjf-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-20T02:49:15.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: lxjf-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\nserver: nginx\r\ndate: Thu, 20 Nov 2025 02:49:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2028,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"cbcceab86c45eb8aa1c35805b8ec60a1","sha1":"3069274c003bd88dd893e0e0c8529804f918eae3","sha256":"ede0f7d6e677bcfb44ad084c51ded69e1144ed7f2e2a6fc8ee8380ebe2c1ea8d","sha512":"5659e69e28c8b748b91bed4664186d6853061c5f376ffd3473852ad0360213b2675d3bfbd8da38736928c3ca7f05248b58ef29a3e992abe11a1bacc7778920cb","ssdeep":"","tlshash":"c841426884e304010aabe1282bb6f54438b55447f257d806798c3f999f42f1c96e7fc5","first_seen":"2025-11-19T17:11:51.448588Z","last_seen":"2025-11-20T12:42:48.599921Z","times_seen":5,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":248,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-20","alert":"Phishing Block","trigger":"lxjf-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/tj.js","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://lxjf-wahtsapp.com/","date":"2025-11-20T02:49:15.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /tj.js HTTP/1.1\r\nHost: lxjf-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://lxjf-wahtsapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 20 Nov 2025 02:49:15 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 252\r\nlast-modified: Tue, 04 Nov 2025 14:43:42 GMT\r\netag: \"690a111e-fc\"\r\nexpires: Thu, 20 Nov 2025 14:49:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":252,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"613791a5a916b495ab9f29cf170362fd","sha1":"e0a2847de1f94e2da4e6b8ff33297f7f9329683a","sha256":"ed9a078418e9dd1e4dd1a38464df766dbeb7161d4f17429fefa43b4c7f00f74e","sha512":"8e68e70ad39f838e489d2ad78136ae601f091d956386444d4982e3c351ee764606210fc47b61078e00c75e1b18bf948833b12aa3415fa44337a9d347c13b534c","ssdeep":"","tlshash":"24d02e0f2c9458382375082910fbe94cb6a2546d403da40180dce890a9a0fc2082eb88","first_seen":"2025-11-05T15:43:16.692057Z","last_seen":"2026-07-12T13:54:11.067192Z","times_seen":668,"resource_available":true,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-20","alert":"Phishing Block","trigger":"lxjf-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.js?d9bb8c3e0a8ddf6347b7d9d99b109ee0","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"14.215.182.140","port":443,"asn":4134,"as":"Chinanet","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://lxjf-wahtsapp.com/","date":"2025-11-20T02:49:15.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /hm.js?d9bb8c3e0a8ddf6347b7d9d99b109ee0 HTTP/1.1\r\nHost: hm.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://lxjf-wahtsapp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=0, must-revalidate\r\nContent-Encoding: gzip\r\nContent-Length: 11289\r\nContent-Type: application/javascript\r\nDate: Thu, 20 Nov 2025 02:49:17 GMT\r\nEtag: 9d01d54b8f5c408cb1c1e4de64204cc2\r\nP3p: CP=\"CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR\"\r\nServer: apache\r\nSet-Cookie: HMACCOUNT=A3C1ED78A31D24F1; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT\r\nStrict-Transport-Security: max-age=172800\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":29895,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (619)","md5":"cc704427a6a682bc27776a3099dc37cb","sha1":"225bc42c5a8e194cfe6f4f72c4d02da15c2d8601","sha256":"462ee02eb1df5868713588f38649498ac4f979976a43d6424e810f6d13ce073d","sha512":"73aee35af072548ff004af6221c580bdd1ccf3e93a7d6ccc9c69a18b2f08871f584cb819574d884bf6f4ac93b12df2eded6e45473c9ec1129e075cdef92a67fb","ssdeep":"384:e2JSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:e24VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"e5d2d9a9b282713293a324a5153f324ef17b5a54bd4968a4f11894c07d38fbb027bfdd","first_seen":"2025-11-20T02:49:38.124303Z","last_seen":"2025-11-20T02:49:38.124303Z","times_seen":1,"resource_available":true,"data":null}},"time_used":2524,"timings":{"blocked":1101,"dns":336,"connect":251,"send":0,"wait":316,"receive":4,"ssl":513},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lxjf-wahtsapp.com/favicon.ico","fqdn":"lxjf-wahtsapp.com","domain":"lxjf-wahtsapp.com","tld":"com"},"ip":{"addr":"103.80.133.31","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://lxjf-wahtsapp.com/","date":"2025-11-20T02:49:15.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: lxjf-wahtsapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://lxjf-wahtsapp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Thu, 20 Nov 2025 02:49:16 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1385\r\nlast-modified: Fri, 24 Oct 2025 13:20:10 GMT\r\netag: \"68fb7d0a-569\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"b70e6078004aeb5146c635cc4c8af761","sha1":"08361cabab0812baeb8ecf4dfbdddd10a9104423","sha256":"20ce7e373448ca2a51d95f60fc906f57cc27d103a6bba4e33be3453f7b23b98e","sha512":"76e0a9f494998151ab5f5d1ef2f1e2cd826135537e6b3e77e6653997d6e073696880a1ab5100c6a85aea926edcfe036c31513d08f58c0bcc02db0a4c8b6bec09","ssdeep":"","tlshash":"bf210bf3e36020e90841d4310333621b57fa4f7b6d909371f071509112b944845a1e97","first_seen":"2024-12-25T11:23:49.33594Z","last_seen":"2026-08-01T18:23:46.596239Z","times_seen":1965,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-20","alert":"Phishing Block","trigger":"lxjf-wahtsapp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-20","alert":"Sinkholed","trigger":"lxjf-wahtsapp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}