{"report_id":"159bdf93-c756-4512-aeae-1adc732a8c29","version":6,"status":"done","tags":["wetransfer","phishing","financial"],"date":"2026-05-08T14:59:27Z","url":{"schema":"http","addr":"arrangehimalayas.com/wp-forms/2/","fqdn":"arrangehimalayas.com","domain":"arrangehimalayas.com","tld":"com"},"ip":{"addr":"68.66.226.79","port":0,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"arrangehimalayas.com/wp-forms/2/","fqdn":"arrangehimalayas.com","domain":"arrangehimalayas.com","tld":"com"},"title":"WeTransfer","dom":{"size":22758,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (12884)","md5":"88e8c42a0e6e95c22ecf6a4b8818af34","sha1":"5e70105bf1d96b7b44597c1610467d06b163d580","sha256":"017d30a0e594cc1d60e12c9b6a4381aec88f2f9b9a044c118eecf45aaea98bda","sha512":"bc6b6c3a81682e27a1842c4c7a2c710314d9f8f9ece86b1d6850e4feb34f048785c536cf817153266b5722dd10c86d87d7483ed48635f4b34491d1fef67966b1","ssdeep":"384:i1VkKQocdShV2T33cc+y49SQnp7i5cNLKeARYvWcd5:i1q1eg33L+y49SEpzxARYvWcd5","tlshash":"3fa24c169e6c1c6a472c29abd3ed18cd152cf393965202c0f0be5c888fd7b255ccb96d","dom_hash":"domhashf141c2cc7eec9e9f89cecdfd7a20a80f","first_seen":"2025-10-28T13:44:21.773176Z","last_seen":"2026-05-08T14:59:27.623612Z","times_seen":29,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"arrangehimalayas.com/wp-forms/2/","fqdn":"arrangehimalayas.com","domain":"arrangehimalayas.com","tld":"com"},"ip":{"addr":"68.66.226.79","port":0,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-12T14:59:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]},"summary":[{"fqdn":"arrangehimalayas.com","ip":{"addr":"68.66.226.79","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"domain_registered":"2018-05-04","domain_rank":0,"first_seen":"2026-04-01T02:39:06.401744Z","last_seen":"2026-05-08T14:18:42.754364Z","alert_count":12,"request_count":3,"received_data":25584,"sent_data":1407,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.wetransfer.net","ip":{"addr":"3.167.2.25","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2009-02-02","domain_rank":0,"first_seen":"2016-11-17T13:36:11Z","last_seen":"2026-05-08T14:18:42.696609Z","alert_count":0,"request_count":1,"received_data":42083,"sent_data":516,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"arrangehimalayas.com/wp-forms/2/script2.js","fqdn":"arrangehimalayas.com","domain":"arrangehimalayas.com","tld":"com"},"ip":{"addr":"68.66.226.79","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4436e379ed8b620dc769cc390c5c47d9","sha1":"e7b48b424a1c021966ed45fe232a83dba74567eb","sha256":"7a3302c0026d1433f41e4b0d218981000e06fac22528ce7f04fa681d907d96da","sha512":"37964a0456419ef2e355f476ee66211d4e0d3eb03e8714de53eff5527d5f1c1a2e0967ec916c93163d24426ea3062c279838765d4d01438904495241fb2fef5d","ssdeep":"","tlshash":"7f510f45b0c104b153bbbbfe70e21208f5ba91276842958e353cc49d6f71d1a26f2edd","size":2798,"data":"","first_seen":"2026-03-06T22:26:15.776225Z","last_seen":"2026-05-08T14:59:27.629604Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"arrangehimalayas.com/wp-forms/2/style.css","fqdn":"arrangehimalayas.com","domain":"arrangehimalayas.com","tld":"com"},"ip":{"addr":"68.66.226.79","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://arrangehimalayas.com/wp-forms/2/","date":"2026-05-08T14:59:05.580Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.arrangehimalayas.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 11:43:00 GMT","end":"Wed, 24 Jun 2026 11:42:59 GMT"},"fingerprint":{"sha1":"72:D6:53:8E:86:7A:49:3A:8D:7F:66:84:08:C8:C6:45:AB:9B:54:C7","sha256":"BA:7D:58:63:F0:D0:1F:2E:A9:5F:09:42:49:EA:49:7C:FA:1D:F0:7A:64:0C:16:B2:D9:DE:88:43:59:7F:88:6D"}}},"request":{"raw":"GET /wp-forms/2/style.css HTTP/1.1\r\nHost: arrangehimalayas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arrangehimalayas.com/wp-forms/2/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: max-age=604800, public\r\nexpires: Fri, 15 May 2026 14:59:05 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 25 Mar 2026 23:09:04 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1443\r\ndate: Fri, 08 May 2026 14:59:05 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7565,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"575074ae0f19738ec4154c6c37258f91","sha1":"644316fef753404138273900ab0e8f22fd92b7bb","sha256":"bbe46e8dbf70907ab57df6cf6ccc4de8ac034174cdd516c524d7aabc9d647414","sha512":"44db22de9a8bf703444f9baa6c1e4e2ea19281f933a10819532adcb0e8cebc877bf5a71c00c56a16edb8d93f409acf97d2cfcd52d54272d2fcaeeb123c462218","ssdeep":"96:xWF9cWv2tA9smLeZKppcIZ/EDwzVo5kR/e:xI0e9sGvRKQW5kR/e","tlshash":"eef1ac0ea90214426937a374afb3425cf79385a7c38281553fdda3858ff567582a2fec","first_seen":"2024-08-20T07:47:14.856246Z","last_seen":"2026-05-08T14:59:27.627667Z","times_seen":32,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"arrangehimalayas.com/wp-forms/2/script2.js","fqdn":"arrangehimalayas.com","domain":"arrangehimalayas.com","tld":"com"},"ip":{"addr":"68.66.226.79","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://arrangehimalayas.com/wp-forms/2/","date":"2026-05-08T14:59:05.582Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.arrangehimalayas.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 11:43:00 GMT","end":"Wed, 24 Jun 2026 11:42:59 GMT"},"fingerprint":{"sha1":"72:D6:53:8E:86:7A:49:3A:8D:7F:66:84:08:C8:C6:45:AB:9B:54:C7","sha256":"BA:7D:58:63:F0:D0:1F:2E:A9:5F:09:42:49:EA:49:7C:FA:1D:F0:7A:64:0C:16:B2:D9:DE:88:43:59:7F:88:6D"}}},"request":{"raw":"GET /wp-forms/2/script2.js HTTP/1.1\r\nHost: arrangehimalayas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arrangehimalayas.com/wp-forms/2/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: max-age=604800, public\r\nexpires: Fri, 15 May 2026 14:59:05 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 25 Mar 2026 23:09:04 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 793\r\ndate: Fri, 08 May 2026 14:59:05 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2798,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"4436e379ed8b620dc769cc390c5c47d9","sha1":"e7b48b424a1c021966ed45fe232a83dba74567eb","sha256":"7a3302c0026d1433f41e4b0d218981000e06fac22528ce7f04fa681d907d96da","sha512":"37964a0456419ef2e355f476ee66211d4e0d3eb03e8714de53eff5527d5f1c1a2e0967ec916c93163d24426ea3062c279838765d4d01438904495241fb2fef5d","ssdeep":"","tlshash":"7f510f45b0c104b153bbbbfe70e21208f5ba91276842958e353cc49d6f71d1a26f2edd","first_seen":"2026-03-06T22:26:15.776225Z","last_seen":"2026-05-08T14:59:27.629604Z","times_seen":6,"resource_available":true,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.wetransfer.net/assets/favicon-d12161435ace47c6883360e08466508593325f134c1852b1d0e6e75d5f76adda.ico","fqdn":"cdn.wetransfer.net","domain":"wetransfer.net","tld":"net"},"ip":{"addr":"3.167.2.25","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://arrangehimalayas.com/wp-forms/2/","date":"2026-05-08T14:59:05.754Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wetransfer.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 01 May 2026 00:00:00 GMT","end":"Sat, 14 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B5:D5:76:1F:6A:4F:27:15:F8:6D:9E:D2:3C:56:45:13:62:9E:50:A6","sha256":"1A:2C:4F:C2:BF:5A:82:13:B7:98:4D:13:0D:18:45:C4:5D:3A:C6:48:8E:03:08:F0:C7:0C:99:5F:97:86:4B:CE"}}},"request":{"raw":"GET /assets/favicon-d12161435ace47c6883360e08466508593325f134c1852b1d0e6e75d5f76adda.ico HTTP/1.1\r\nHost: cdn.wetransfer.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://arrangehimalayas.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 41566\r\ndate: Fri, 07 Nov 2025 12:18:37 GMT\r\nlast-modified: Mon, 05 Nov 2018 14:13:10 GMT\r\netag: \"692e1c7339c359b6412f059c9c9a0474\"\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 57d04bb9ff0f23ac1c33e083d49e973e.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: qI_XFXMC-aKLZZzFL95qnSzDIqQ5uGqIttvxT3swzOn963QGrewwlA==\r\nage: 15734429\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":41566,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel","md5":"692e1c7339c359b6412f059c9c9a0474","sha1":"e7c1a53dca16b7664880e5b8a92524cf9a47fb62","sha256":"d12161435ace47c6883360e08466508593325f134c1852b1d0e6e75d5f76adda","sha512":"115b958093186bf5f98beced2bde91775121083b1e73f720372d793a23ebc7cf130cc4c6196f5f0d725a809fd63997666ae1de36cf070dcb6b6d2178c6796894","ssdeep":"96:pnvhextGn8hK7mxOBsOqHJt46FWJisw0msSieZQckSpyt:pnZHKzxOeOqf46FWuASjQcA","tlshash":"0f13459726c4ca1cc7916f33c0e245fad77adc96cd34ae0fa18cbe5a7471529285b14c","first_seen":"2023-05-01T18:12:38Z","last_seen":"2026-08-12T10:34:40.328969Z","times_seen":2798,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":0,"dns":35,"connect":1,"send":0,"wait":2,"receive":1,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"arrangehimalayas.com/wp-forms/2/","fqdn":"arrangehimalayas.com","domain":"arrangehimalayas.com","tld":"com"},"ip":{"addr":"68.66.226.79","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-08T14:59:04.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.arrangehimalayas.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Mar 2026 11:43:00 GMT","end":"Wed, 24 Jun 2026 11:42:59 GMT"},"fingerprint":{"sha1":"72:D6:53:8E:86:7A:49:3A:8D:7F:66:84:08:C8:C6:45:AB:9B:54:C7","sha256":"BA:7D:58:63:F0:D0:1F:2E:A9:5F:09:42:49:EA:49:7C:FA:1D:F0:7A:64:0C:16:B2:D9:DE:88:43:59:7F:88:6D"}}},"request":{"raw":"GET /wp-forms/2/ HTTP/1.1\r\nHost: arrangehimalayas.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html\r\nlast-modified: Wed, 25 Mar 2026 23:09:04 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6556\r\ndate: Fri, 08 May 2026 14:59:05 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=3600, must-revalidate\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13553,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (12884), with CRLF line terminators","md5":"4f0a257f696af45430a23c2f41d7d985","sha1":"44f2ed4319b47be76b03ace9d2d5f5df9366ee10","sha256":"2973b510c57b76c0cff48ab34fbf3ba845594187282869a79bc2e42d08175638","sha512":"139b6deba724748e4c75ec590ddc5f5feebd7c4279aab26a84d379e9216381e17e282639fec06b05acf6416af13ffe204c94baa720bcaee86713a3b435187b44","ssdeep":"192:ZLS44vW398QNJdJdrUWi5cPQ1+LKNon/KNwJORY1xVVCsQufEUofERDETV8s:ZO49SQnp7i5cNLKeARYvWcNs","tlshash":"b5522a0b9f691c1d87282753e2ed08ccd53de787db4814c8b8a6b8858ceb7649cc9c5d","first_seen":"2025-10-28T13:44:21.775533Z","last_seen":"2026-05-08T14:59:27.63272Z","times_seen":29,"resource_available":true,"data":null}},"time_used":794,"timings":{"blocked":317,"dns":1,"connect":154,"send":0,"wait":158,"receive":1,"ssl":160},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-08","alert":"Sinkholed","trigger":"arrangehimalayas.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}}]}