{"report_id":"236d10a3-3455-42e5-bf1e-37878c140121","version":6,"status":"done","tags":["malicious","clickfix"],"date":"2026-01-12T14:16:20Z","url":{"schema":"http","addr":"wlfic.com","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":0,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"wlfic.com/","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"title":"World Liberty Financial - Airdrop","dom":{"size":47642,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2412)","md5":"f80e4255d6880402a6cdff238fcd7bf5","sha1":"6f6c7b9e59087c71b664b778538a7efad3172516","sha256":"8c9e511aabd9944dae3d40c7f7915bd6fbd282bc0a71902509b11a47144bb771","sha512":"37af5b5947097af06641cdc2130049399dce242c57d3d6dfae51188345f9c038fb743d4ac8f0ab19ebbf723acd3bb2e32b2c294b233e6a6eb878f12e0663e6da","ssdeep":"768:3fSBaRf+Mu1FXNZfiN0oGpKyaNvUVa8bO5oIn:3qBa5QDqQp1aNMVa8coIn","tlshash":"e123ecd490f3a1b221b3e6d70bab17623ee04417c299c11936bd632e5f99c67b80792c","dom_hash":"domhashdb2c9722acd4b131c9400aaa348955e6","first_seen":"2026-01-12T14:16:42.760663Z","last_seen":"2026-01-12T14:16:42.760663Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"wlfic.com","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":0,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-16T14:16:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null},{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]},"summary":[{"fqdn":"wlfic.com","ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":21,"request_count":10,"received_data":613869,"sent_data":4527,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"wlfic.com/ajax/lib/layui/layui.js","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"70ed0e8151d23de969de514bfd802a56","sha1":"569e6c1b0ac0b8efaa7dc0015b691334947a9665","sha256":"92c7997b3dce6ab2368b1bdb34ff4b67ac77957898a126c7eba452a8080bec95","sha512":"947eeb19fb055b07a191ec89625941abbdc8b2247b447dbec2e3958ebd3aabc34ac07a79c559e4752bd49bc44db77d500913aab4fae300077556e347d084b1a9","ssdeep":"3072:tVo+F//NOM0SF0Mz0pZN6TPKWjZIpYCrYtJ+8CZrcNBf4XcIiOb9:Xo+FdO3SF0Mz0Z6TfIpPS+8grcNBQcIZ","tlshash":"02543a9d758574b3237360a6406f990eb17b093daa0a8060f166d4fa2dbdc885237f7f","size":291286,"data":"","first_seen":"2023-03-07T12:09:26Z","last_seen":"2026-08-03T07:57:35.497867Z","times_seen":38231,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/js/wallet.js","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"08d80a79e2c493ebb6ab21f99800748f","sha1":"d17201d6b9045680ce5321ccf1544f4de9f3f0a1","sha256":"f42f0537d9e12f542899c737ac81f5aedc2a8429d57a13cb82a430903cc18255","sha512":"d59e0027823b87212b5d33277b039cb62f37f1a6985bcdb2dcf7de96ee8ac45f1aed29540be1ccd44f9d4c913eff19de76c5015593c359c869ce8a702cfcf215","ssdeep":"384:J30IEZQmIPL1biD2A9k0K5VQehTxRqOiczj82ByNmk:+lZQmIPjhWfR/","tlshash":"1092d95a5b02091184b3a32d5fa3535df72153179a414527ffbe93840f33825a2aaffd","size":21244,"data":"","first_seen":"2026-01-12T14:16:42.766161Z","last_seen":"2026-01-12T14:16:42.766161Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"fffb5db643f93ea7f5dce16b05dc952e","sha1":"3b71553027fd158a9f01702de6ea275780126dc5","sha256":"bfbd51e6752bdc7a5d955871fbfef80a42a9c71476a7d4558d4905fa2d303f1e","sha512":"71822f6fef67f0f3aba766296a01c08914bcee776eec9d20896da2e9b399d1605e859dd18b3fb6ed1e16f4113e892fdceef72ef3d38a59f768356c69c9caf392","ssdeep":"96:MqMQ9b7k3ay5qQWnPF9Mt4zy1Wx1Pv5g51fnf2j:tMQ9b7kt5qQWnfHWoNOAj","tlshash":"d8916248b0b3212515b371ea4beb81047210b41ba90dd8287f4cc7c51fee55ee1a3bed","size":4317,"data":"","first_seen":"2026-01-12T14:16:42.780332Z","last_seen":"2026-01-12T14:16:42.780332Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/js/jquery.min.js","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b4dfa71bbab87f2dcb6c28514f3e3337","sha1":"180eee80b53a371cc86646a0a1e31b74ced9f9a7","sha256":"eb1ea280f445396121700c3ce9d823788a892761a249884b8eb4271cc68544f1","sha512":"7568b87eba86eed07255ade661e83d5a5fa46952f11539db17e1deccd899ae746e4d5f0b949fd39c299c844a9f653a3b76895092586db33a3e057c7fb92d99e8","ssdeep":"1536:PEPtyzB6+GczpYSxqbHlqurr62SqDVEXwd5J/BL4bG8VXkenCuQKiOpl:QFA6r62S017HufQKiOl","tlshash":"68833add76c6b02217ab61b6407f110ff376699d680d8410f124d8e5bc78a8a827bf7d","size":88388,"data":"","first_seen":"2024-05-27T13:56:10Z","last_seen":"2026-06-10T03:26:12.817676Z","times_seen":49,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"wlfic.com/","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-12T14:15:58.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:15:58 GMT\r\ncontent-type: text/html;charset=UTF-8\r\ncontent-language: zh-CN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":29650,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2414), with CRLF line terminators","md5":"d0ac40673472f3adecf54ce02dbc03f5","sha1":"b931ce871b21a970fd5e243ec0fcaec31e0dd174","sha256":"c5d900cb98f56f6cb260d0484ee5bc15e658901f613e62df512d52d5d5cd9fe8","sha512":"4fb3ce4981091ca47d378e4c997c163254f952f9e737c4e608568e4f7a57477d187eb6477dce8fdabe9462e5ff3fb2cfcd385ba95f3ee7ec4bcc6647820fe418","ssdeep":"384:J3VUF9XO0s/H/MPoGyKnQfA6qYlKCwFFAmVwMT:dV+9eX/fgoGOtKz8mVRT","tlshash":"22d2936dd58116296433d7e9afb34b0ef7929013c306826d3bec63860fb6969c553e8c","first_seen":"2026-01-12T14:16:42.76359Z","last_seen":"2026-01-12T14:16:42.76359Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1296,"timings":{"blocked":541,"dns":117,"connect":208,"send":0,"wait":214,"receive":0,"ssl":212},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/js/wallet.js","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wlfic.com/","date":"2026-01-12T14:15:59.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET /js/wallet.js HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfic.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:15:59 GMT\r\ncontent-type: application/javascript\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nlast-modified: Sun, 04 Jan 2026 15:36:24 GMT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21354,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"08d80a79e2c493ebb6ab21f99800748f","sha1":"d17201d6b9045680ce5321ccf1544f4de9f3f0a1","sha256":"f42f0537d9e12f542899c737ac81f5aedc2a8429d57a13cb82a430903cc18255","sha512":"d59e0027823b87212b5d33277b039cb62f37f1a6985bcdb2dcf7de96ee8ac45f1aed29540be1ccd44f9d4c913eff19de76c5015593c359c869ce8a702cfcf215","ssdeep":"384:J30IEZQmIPL1biD2A9k0K5VQehTxRqOiczj82ByNmk:+lZQmIPjhWfR/","tlshash":"1092d95a5b02091184b3a32d5fa3535df72153179a414527ffbe93840f33825a2aaffd","first_seen":"2026-01-12T14:16:42.766161Z","last_seen":"2026-01-12T14:16:42.766161Z","times_seen":1,"resource_available":true,"data":null}},"time_used":628,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":628,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malicious - Copy/Paste Social Engineering (ClickFix)","verdict":"malicious","severity":"medium","comment":"","tags":["malicious","clickfix"],"meta":null}]}},{"url":{"schema":"https","addr":"wlfic.com/ajax/lib/layui/layui.js","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wlfic.com/","date":"2026-01-12T14:15:59.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET /ajax/lib/layui/layui.js HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfic.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:15:59 GMT\r\ncontent-type: application/javascript\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nlast-modified: Sun, 04 Jan 2026 15:36:24 GMT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":291286,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"70ed0e8151d23de969de514bfd802a56","sha1":"569e6c1b0ac0b8efaa7dc0015b691334947a9665","sha256":"92c7997b3dce6ab2368b1bdb34ff4b67ac77957898a126c7eba452a8080bec95","sha512":"947eeb19fb055b07a191ec89625941abbdc8b2247b447dbec2e3958ebd3aabc34ac07a79c559e4752bd49bc44db77d500913aab4fae300077556e347d084b1a9","ssdeep":"3072:tVo+F//NOM0SF0Mz0pZN6TPKWjZIpYCrYtJ+8CZrcNBf4XcIiOb9:Xo+FdO3SF0Mz0Z6TfIpPS+8grcNBQcIZ","tlshash":"02543a9d758574b3237360a6406f990eb17b093daa0a8060f166d4fa2dbdc885237f7f","first_seen":"2023-03-07T12:09:26Z","last_seen":"2026-08-03T07:57:35.497867Z","times_seen":38231,"resource_available":true,"data":null}},"time_used":420,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":420,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/images/wlfi/wlfi-token.webm","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://wlfic.com/","date":"2026-01-12T14:15:59.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET /images/wlfi/wlfi-token.webm HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfic.com/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:15:59 GMT\r\ncontent-type: video/webm\r\ncontent-length: 137200\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nlast-modified: Sun, 04 Jan 2026 15:36:24 GMT\r\naccept-ranges: bytes\r\ncontent-range: bytes 0-137199/137200\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":137200,"size_decoded":0,"mime_type":"video/webm","magic":"WebM","md5":"53f4b6dcbf097b344e03d5c43cfc9e7e","sha1":"1f151a743f354f0dd663db3f69a452e2e6b8e99d","sha256":"db23ec29f25f554301827ff0cc50af42f5bfdca2d01c36ae30e15a82a9ce8574","sha512":"3c774be3186b8fa8f275200eec3bbfda25deb74449d1128d50df9c158b47d48aafd645d7084881388f3d8ba9d9eef32c05325b8e3e4b1ac36a23ff040b4e1191","ssdeep":"3072:Pjo9Vg/zu8+5WMkyG/e2KurcysJMEVVPAtYta64jYZYAOA05fH6fmE/L6:P09G/68LMkyqe7urccCVOYgljYGeknE+","tlshash":"72d302cd6736c3e0fad061f1e44993ab198f40164aa5603dbe664cafd2b4306d4817af","first_seen":"2025-11-13T15:57:19.559301Z","last_seen":"2026-02-22T14:48:02.958742Z","times_seen":22,"resource_available":false,"data":null}},"time_used":790,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":578,"receive":212,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/js/jquery.min.js","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wlfic.com/","date":"2026-01-12T14:15:59.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET /js/jquery.min.js HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfic.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:15:59 GMT\r\ncontent-type: application/javascript\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nlast-modified: Sun, 04 Jan 2026 15:36:24 GMT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88390,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65444), with CRLF line terminators","md5":"b4dfa71bbab87f2dcb6c28514f3e3337","sha1":"180eee80b53a371cc86646a0a1e31b74ced9f9a7","sha256":"eb1ea280f445396121700c3ce9d823788a892761a249884b8eb4271cc68544f1","sha512":"7568b87eba86eed07255ade661e83d5a5fa46952f11539db17e1deccd899ae746e4d5f0b949fd39c299c844a9f653a3b76895092586db33a3e057c7fb92d99e8","ssdeep":"1536:PEPtyzB6+GczpYSxqbHlqurr62SqDVEXwd5J/BL4bG8VXkenCuQKiOpl:QFA6r62S017HufQKiOl","tlshash":"68833add76c6b02217ab61b6407f110ff376699d680d8410f124d8e5bc78a8a827bf7d","first_seen":"2024-05-27T13:56:10Z","last_seen":"2026-06-10T03:26:12.817676Z","times_seen":49,"resource_available":true,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/ajax/lib/layui/css/modules/laydate/default/laydate.css?v=5.3.1","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wlfic.com/","date":"2026-01-12T14:15:59.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET /ajax/lib/layui/css/modules/laydate/default/laydate.css?v=5.3.1 HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfic.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:15:59 GMT\r\ncontent-type: text/css\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nlast-modified: Sun, 04 Jan 2026 15:36:24 GMT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7365,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (7365), with no line terminators","md5":"e9078eef34fe9a44e44bdd55b48fdc55","sha1":"73ef00229810ee179915661786d9b66b7fc2d568","sha256":"ab9dbdf922a26509951347fcfa83704d86afd2df855c827740c23df72fd8ab3f","sha512":"dbf200ca6effc6bee2f7e8f516dafe6b25fa66093f19fff117a8bd87732a3ca0206480319d5f733eb07d18f564cba1dfc6143587cbc5ea1d5d370948d8ab3921","ssdeep":"96:7OyDQi4ijYyC43i7hlVVZ4LyLk5bYsBE2rBOB:7OQQfyPCoiFVqHbrBE2rBA","tlshash":"45e1cc71b1542cd4702bc222b4a87cbfaef8dc02dae3265ce5b8621b85c15b7957d34b","first_seen":"2023-04-11T12:12:51Z","last_seen":"2026-08-03T07:57:35.50542Z","times_seen":37616,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/ajax/lib/layui/css/modules/layer/default/layer.css?v=3.5.1","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wlfic.com/","date":"2026-01-12T14:15:59.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET /ajax/lib/layui/css/modules/layer/default/layer.css?v=3.5.1 HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfic.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:15:59 GMT\r\ncontent-type: text/css\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nlast-modified: Sun, 04 Jan 2026 15:36:24 GMT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14271,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (14271), with no line terminators","md5":"c234eb06d5f32055092294e78957f17d","sha1":"f15ee0bcb9694f32f5e1d524f2653aa0dd043402","sha256":"5cdf3edb27b0c9f8e48918c486e9ae65a9e5beab806b64c4a7bc5bac53c0f540","sha512":"3f06b51116d7f8026d81c7eb6a3c4d871462d09fe0a5b8cc8b7feaf20cbc88b0b6a545f0ec7cbc17566a9ff609405f58fad6eddfb3a8b3f6d530ede8fa3fad5c","ssdeep":"96:mp+Ntha8qNEp+wRY1vUPXi0nMLPD2OtLzAyPHL/LztJDzyv2OQ7KGx1j9d2/nWUU:1ELr2Otzrzzt42OQ7KGx1j8WUq4S3cU","tlshash":"f75242e144911299b0278721d6dc7eba32f88d43e5630caef2573c1f874c6dba2b6647","first_seen":"2023-03-10T11:40:20Z","last_seen":"2026-08-03T07:57:35.467001Z","times_seen":57189,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/ajax/lib/layui/css/modules/code.css?v=2","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wlfic.com/","date":"2026-01-12T14:15:59.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET /ajax/lib/layui/css/modules/code.css?v=2 HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfic.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:15:59 GMT\r\ncontent-type: text/css\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nlast-modified: Sun, 04 Jan 2026 15:36:24 GMT\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1319,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1319), with no line terminators","md5":"986d0d70b033a195fc1bd1527b06993b","sha1":"69ea79bb09bddd3b988db70ef8b10be9ed0f0065","sha256":"3f27194c2e479212781a76f993b778d724ac9838e780b19472c0357cd3081431","sha512":"a3d1ffa0ba90c8ed8f1330c456760ad7098b683756f1f5d2aae6ec89502c0fe1ff6287e7b1180b9df8f50d517118b610566e9315de055d4780a230488eda10e0","ssdeep":"","tlshash":"d721493aa3852118354bf21574fcbcbca03cb1d6a5ea0eaaff416797c944c51083674f","first_seen":"2023-04-11T12:12:51Z","last_seen":"2026-08-03T07:57:35.47554Z","times_seen":37591,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/api/airdroplog?item=wlfi\u0026chain=3","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wlfic.com/","date":"2026-01-12T14:15:59.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET /api/airdroplog?item=wlfi\u0026chain=3 HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfic.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:15:59 GMT\r\ncontent-type: application/json\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5428,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"d500d389275681dfe6d05d64a5826fad","sha1":"bce4e9fc6158240b1341518a41344b587fe5edb9","sha256":"884d04780c62efd8e8eb963b6bef42a81c8afe4879239e9424e7f7f8d2f8eb36","sha512":"ad9d6be22391674537624712f5874039da8d837c4f69f3482a2af767f1e902990e66711493e837fc0bb350b53aaf764c201c933ac30ea4931c73c2e47508c63b","ssdeep":"96:Rvjtpr9/Rt1EcNmUR0BItQC7iVSAOYhbL6tyud/:JxZ9/zNmUKIt2VmG6tt/","tlshash":"e8b14d4210d2bf9f76b0aa85523b5d941ff03acb1588c914048dfc6226f9df6aa8f54b","first_seen":"2026-01-12T14:16:42.777243Z","last_seen":"2026-01-12T14:16:42.777243Z","times_seen":1,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wlfic.com/images/wlfi/favicon.ico","fqdn":"wlfic.com","domain":"wlfic.com","tld":"com"},"ip":{"addr":"107.149.113.81","port":443,"asn":54600,"as":"PEG-SV","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wlfic.com/","date":"2026-01-12T14:16:00.061Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfic.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 04 Jan 2026 05:41:27 GMT","end":"Sat, 04 Apr 2026 05:41:26 GMT"},"fingerprint":{"sha1":"C2:9B:2F:8F:6E:3A:B8:4D:FF:85:76:1B:0A:48:44:EB:15:13:11:44","sha256":"19:D6:43:C3:90:89:C7:23:95:F2:D8:DA:E7:FB:EC:2F:62:12:FA:15:68:92:A5:F7:6A:F2:5F:F0:4B:B9:30:CE"}}},"request":{"raw":"GET /images/wlfi/favicon.ico HTTP/1.1\r\nHost: wlfic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfic.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 12 Jan 2026 14:16:00 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 15086\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nlast-modified: Sun, 04 Jan 2026 15:36:24 GMT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15086,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"282c089bba9d3ffec09cd70ea267172e","sha1":"5bc26f9a6fb9d889ca68908d073401f314ffd900","sha256":"243c55524adb5705414aba8d0f98e33c8a888509c95fa8ff2b594b7d89b52ca4","sha512":"b82b855bcb5adb48044cb1d288ca51aa0e4556d78b5fd53e3b8c6b9283a7205355022f4ef93daa64823f21e54068c5f0a538237a643e9e5f27f5cc1e0dae865d","ssdeep":"48:jv+JF8uWZfMMMMM22A5MMM99Mb2SVXQy6wOMYOWJaAXE2r:j03WZfMMMMMZsMMMPMySlFOMwJl3","tlshash":"c462395f8d72e430d4199f3c81549245c78a74da2f6abac241026fedb3310ddcc69bb2","first_seen":"2025-07-12T22:44:49.179671Z","last_seen":"2026-06-30T17:41:07.240908Z","times_seen":204,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-12","alert":"Sinkholed","trigger":"wlfic.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}