{"report_id":"2296d7c2-5708-40b5-9e0e-63cb76fa4c51","version":6,"status":"done","tags":[],"date":"2026-03-04T07:01:21Z","url":{"schema":"https","addr":"pairs.li/","fqdn":"pairs.li","domain":"pairs.li","tld":"li"},"ip":{"addr":"172.245.126.210","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"pairs.li/","fqdn":"pairs.li","domain":"pairs.li","tld":"li"},"title":"PayPay","dom":{"size":1468,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (651)","md5":"5a8721e5c243dd1c50e2afaeb72ff0e5","sha1":"e33f124cf4cfe18aa9d91de9bda6888de5c6b626","sha256":"5adcd5996cf969489c44da4592e0f321ddc6c210e0587f40ba6bfb594be06003","sha512":"94d87eff1596e9edf06bb0ec0a780388c2508322daa9df8a48001018b76d0d3e771bb30fafda6c9ae0484045a0e587b8a811cfe2df45e74b4798a52f8f30b93c","ssdeep":"","tlshash":"1531401e33a4683e1323c1e85980bb2515769b07cac4e6b0e17e9174df6598fe8425fc","dom_hash":"domhash156ae1ed0bbb9f576baa01e6c38dcad3","first_seen":"2026-03-04T07:01:31.160526Z","last_seen":"2026-03-04T07:01:31.160526Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"pairs.li/","fqdn":"pairs.li","domain":"pairs.li","tld":"li"},"ip":{"addr":"172.245.126.210","port":0,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-08T07:01:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-04","alert":"Phishing Block","trigger":"pairs.li","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"pairs.li","ip":{"addr":"172.245.126.210","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-04T07:01:21.543128Z","last_seen":"2026-03-04T07:01:21.543128Z","alert_count":16,"request_count":4,"received_data":130515,"sent_data":1739,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-03-01T22:18:12.522658Z","alert_count":0,"request_count":1,"received_data":3284,"sent_data":468,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"pairs.li/assets/index-B0XpZ5mb.js","fqdn":"pairs.li","domain":"pairs.li","tld":"li"},"ip":{"addr":"172.245.126.210","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3948f556bd1523cc0f6a608d9b279d2e","sha1":"98ab5a02c0383db9aebb91dcdc6c6714ce51ead1","sha256":"e618873108a285d0292f2682631f8cfb30e8542a624b9613385600f32aa1d7a2","sha512":"811ae61628e0bb4bbe107b0c8e71751a412477138d494e0f76f55c40f854a82d9a8afd025be40c8dbd3e75524def752f6ffe75ac969a8a0459e4b4de15e960e0","ssdeep":"1536:XnXbe1GzlKObIWlyjSLrMrIHdqA6LarAhRspODK/UPhRMacTgLCLpv6s:3L+MbStrIHdqlariRyONPh+acTgLYv6s","tlshash":"61b319e93286b47293f619f140771002f3292d49380e84d5f16cedab3d6685a627bfbd","size":114450,"data":"","first_seen":"2026-03-04T07:01:31.179347Z","last_seen":"2026-03-04T07:01:31.179347Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"pairs.li/assets/index-m1fVboRD.css","fqdn":"pairs.li","domain":"pairs.li","tld":"li"},"ip":{"addr":"172.245.126.210","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pairs.li/","date":"2026-03-04T07:00:59.794Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pairs.li","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 15:13:47 GMT","end":"Sun, 31 May 2026 15:13:46 GMT"},"fingerprint":{"sha1":"A0:A5:AF:18:B9:DB:E3:36:2D:21:91:21:C5:E3:4A:4D:58:F0:86:0B","sha256":"CB:B4:51:BC:01:72:74:02:52:25:71:E4:C6:24:51:D5:CF:A0:3F:30:58:4E:16:26:1A:74:94:AF:8E:56:4C:65"}}},"request":{"raw":"GET /assets/index-m1fVboRD.css HTTP/1.1\r\nHost: pairs.li\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pairs.li/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 04 Mar 2026 07:00:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 02 Mar 2026 23:48:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a621b6-3443\"\r\nexpires: Wed, 04 Mar 2026 19:00:59 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13379,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (13378)","md5":"535134f36662a3d6a57741e32a37aa13","sha1":"7f95a0b854b60f2c72d32988a104de3aeb0cb148","sha256":"56bb23f9a74100dbeb1debd7ba9e21c12c1667aec82a44f2d90fb33fcbbeb4e2","sha512":"23b0f3887122ef035e3b837991e236ad9a04d497a883874adefb90c6fef9bd28d119c7f165d74748d649550719adb8fe0a9bba185196096bb4ba10d21d0327d3","ssdeep":"384:IiTAJ65sPgrpA9mzcUWdqVqkIwwtz5sARbk06wvg/ndgPG+gHM:retm7DM","tlshash":"955272303349701df03bc595acd2dbdd2264e663e11e96968aa677298dcb0c73731b8e","first_seen":"2026-03-04T07:01:31.167173Z","last_seen":"2026-03-04T07:01:31.167173Z","times_seen":1,"resource_available":false,"data":null}},"time_used":438,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":438,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-04","alert":"Phishing Block","trigger":"pairs.li","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pairs.li/assets/index-B0XpZ5mb.js","fqdn":"pairs.li","domain":"pairs.li","tld":"li"},"ip":{"addr":"172.245.126.210","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pairs.li/","date":"2026-03-04T07:00:59.791Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pairs.li","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 15:13:47 GMT","end":"Sun, 31 May 2026 15:13:46 GMT"},"fingerprint":{"sha1":"A0:A5:AF:18:B9:DB:E3:36:2D:21:91:21:C5:E3:4A:4D:58:F0:86:0B","sha256":"CB:B4:51:BC:01:72:74:02:52:25:71:E4:C6:24:51:D5:CF:A0:3F:30:58:4E:16:26:1A:74:94:AF:8E:56:4C:65"}}},"request":{"raw":"GET /assets/index-B0XpZ5mb.js HTTP/1.1\r\nHost: pairs.li\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pairs.li/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 04 Mar 2026 07:00:59 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 02 Mar 2026 23:48:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a621b6-1bf12\"\r\nexpires: Wed, 04 Mar 2026 19:00:59 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":114450,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (36312)","md5":"1bb4c640a5e99862d386767911c97e2d","sha1":"effbb893924daae92e1e20999cffbfe8f655a1b1","sha256":"bcec920f58707a30ac61c2d14829d72531cbd66f7d8a5650ed3a3f299f703afb","sha512":"544a581fdf787b7118b65c0c6dc1acbc36bbe320e15aab06f6faa4a593e5404de8f3d7041cebd859db1ce784125b896575a47128bfdf27213a453a97491211a8","ssdeep":"3072:3L+MbStrIHdqlariRyONPh+acTglQvT9R:3aMbStsgskPh+53vhR","tlshash":"34b31ae93286b57293f708f540771002f3292989380d84d5f16cedeb3d6685a627bebd","first_seen":"2026-03-04T07:01:31.170346Z","last_seen":"2026-03-04T07:01:31.170346Z","times_seen":1,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-04","alert":"Phishing Block","trigger":"pairs.li","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pairs.li/favicon.ico","fqdn":"pairs.li","domain":"pairs.li","tld":"li"},"ip":{"addr":"172.245.126.210","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pairs.li/","date":"2026-03-04T07:01:00.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pairs.li","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 15:13:47 GMT","end":"Sun, 31 May 2026 15:13:46 GMT"},"fingerprint":{"sha1":"A0:A5:AF:18:B9:DB:E3:36:2D:21:91:21:C5:E3:4A:4D:58:F0:86:0B","sha256":"CB:B4:51:BC:01:72:74:02:52:25:71:E4:C6:24:51:D5:CF:A0:3F:30:58:4E:16:26:1A:74:94:AF:8E:56:4C:65"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: pairs.li\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pairs.li/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 04 Mar 2026 07:01:00 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 0\r\nlast-modified: Fri, 28 Mar 2025 18:49:34 GMT\r\netag: \"67e6ef3e-0\"\r\nexpires: Fri, 03 Apr 2026 07:01:00 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/x-icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T06:24:33.301952Z","times_seen":17774380,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-04","alert":"Phishing Block","trigger":"pairs.li","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pairs.li/","fqdn":"pairs.li","domain":"pairs.li","tld":"li"},"ip":{"addr":"172.245.126.210","port":443,"asn":36352,"as":"AS-COLOCROSSING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-04T07:00:59.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pairs.li","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 02 Mar 2026 15:13:47 GMT","end":"Sun, 31 May 2026 15:13:46 GMT"},"fingerprint":{"sha1":"A0:A5:AF:18:B9:DB:E3:36:2D:21:91:21:C5:E3:4A:4D:58:F0:86:0B","sha256":"CB:B4:51:BC:01:72:74:02:52:25:71:E4:C6:24:51:D5:CF:A0:3F:30:58:4E:16:26:1A:74:94:AF:8E:56:4C:65"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: pairs.li\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 04 Mar 2026 07:00:59 GMT\r\ncontent-type: text/html\r\ncontent-length: 696\r\nlast-modified: Mon, 02 Mar 2026 23:48:06 GMT\r\netag: \"69a621b6-2b8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":696,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, CR, LF line terminators","md5":"ec3b92bdaf8f2bf5a6573af3b33454bc","sha1":"593346400055149f2564c370a116766dff0c972d","sha256":"4bb516253290656ddb25c0ccdafead2048c7823e9c6e10a5cf8d86dd572fd1d4","sha512":"c31b2fbee3d04ac7542558bd353066985f71c7723a06a8b9a72a7704a377b5af9b331de54c6f2cea9e09f6c2367307600a22141130ead9dbf833e49a448f5663","ssdeep":"","tlshash":"a701feb624c04809033053952cd0f56dec97565b0b095b65b4f220bf9fb5285cecb518","first_seen":"2026-03-04T07:01:31.175063Z","last_seen":"2026-03-04T07:01:31.175063Z","times_seen":1,"resource_available":false,"data":null}},"time_used":928,"timings":{"blocked":389,"dns":92,"connect":146,"send":0,"wait":146,"receive":0,"ssl":153},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-04","alert":"Sinkholed","trigger":"pairs.li","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-04","alert":"Phishing Block","trigger":"pairs.li","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Dancing+Script:wght@400;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pairs.li/","date":"2026-03-04T07:00:59.789Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 02 Feb 2026 08:38:07 GMT","end":"Mon, 27 Apr 2026 08:38:06 GMT"},"fingerprint":{"sha1":"6B:DB:3B:B8:9F:A1:8E:49:35:74:D9:D8:24:91:F2:5E:42:56:2F:58","sha256":"37:ED:DF:C4:FB:A3:96:16:9E:47:69:CE:86:A5:35:8E:B5:3A:0B:0B:6A:A1:08:A2:DF:DE:6C:7C:31:BE:94:B1"}}},"request":{"raw":"GET /css2?family=Dancing+Script:wght@400;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pairs.li/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 04 Mar 2026 07:00:59 GMT\r\ndate: Wed, 04 Mar 2026 07:00:59 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2598,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"6addeca9b35d9f5c8c0cc10cd546a657","sha1":"b4568c66386f2fed31033f5e369bc07662e12fd5","sha256":"42340aa4a1ad9dbcb8a165150bfcb9b1ae433326af4a066c96a99572ef6cd6df","sha512":"08564c4cca6ea8b3515c01f743f40fcd972ca37e3e600abbf4056be3660b10abfd239454e28107a98209fbc00e56b408219495eee72c1f042d70adf197a1ce76","ssdeep":"","tlshash":"5251bb50086ad900eb830cc127debe369e4e71427050d53aaffe1cc8edabd226365b5d","first_seen":"2025-09-11T14:59:33.389162Z","last_seen":"2026-08-04T19:46:51.36408Z","times_seen":114,"resource_available":false,"data":null}},"time_used":246,"timings":{"blocked":104,"dns":1,"connect":15,"send":0,"wait":32,"receive":0,"ssl":91},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}