{"report_id":"245c5975-70e2-48df-85ae-29e03075dcde","version":0,"status":"done","tags":[],"date":"2026-09-19T08:17:51Z","url":{"schema":"http","addr":"stealfhex.to/","fqdn":"stealfhex.to","domain":"stealfhex.to","tld":"to"},"ip":{"addr":"5.188.86.237","port":0,"asn":49453,"as":"Global Layer B.V.","country":"Brazil","country_code":"BR"},"final":{"url":{"schema":"https","addr":"stealfhex.to/","fqdn":"stealfhex.to","domain":"stealfhex.to","tld":"to"},"title":"StealthEX | Fast, Private Crypto Exchange Without Registration","dom":{"size":26957,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2660)","md5":"027289e5db85b7f4d060440a62bbf964","sha1":"cbeb6b9ddc0a98ad7dfff54ba037cda1aae072c5","sha256":"dfc4a604cafa220aa9e1f258d0e3daffbe705e05c4738670e7e9a97980261fb2","sha512":"9bf7544145c225d28e6618f753d21355c539dee24718d9e96f316b7cc41260c47a336912fdc5354c47d5b9ca88709051b31d3170474584cec642287de97a91cc","ssdeep":"768:2v+eqPcbUTLhIIWxF9lk2PlVDh93pIxTsvY:2v+eqPcbUTFIIWZlk2PlBhvI1svY","tlshash":"47c29662e29b3533066301d279b3b74bb2eac025de12131433fda79d87d5d5da93328a","dom_hash":"domhashe7f95cc87b2ee53fbf949f12adc7a5de","first_seen":"2026-09-19T07:12:53.829723Z","last_seen":"2026-09-19T08:17:52.158709Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"stealfhex.to/","fqdn":"stealfhex.to","domain":"stealfhex.to","tld":"to"},"ip":{"addr":"5.188.86.237","port":0,"asn":49453,"as":"Global Layer B.V.","country":"Brazil","country_code":"BR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-24T08:17:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"stealfhex.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"stealfhex.to","ip":{"addr":"5.188.86.237","port":443,"asn":49453,"as":"Global Layer B.V.","country":"Brazil","country_code":"BR"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-19T07:12:50.036969Z","last_seen":"2026-09-19T07:12:50.036969Z","alert_count":4,"request_count":4,"received_data":70816,"sent_data":2465,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"api.coincap.io","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2014-06-17","domain_rank":3542766,"first_seen":"2018-11-06T11:44:49Z","last_seen":"2026-09-12T08:46:42.483119Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":481,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"stealfhex.to/","fqdn":"stealfhex.to","domain":"stealfhex.to","tld":"to"},"ip":{"addr":"5.188.86.237","port":443,"asn":49453,"as":"Global Layer B.V.","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"f3d268305756dd20557eb3acfccee909","sha1":"295faf86117c846269df7632f2a0a146d59d6c1a","sha256":"098866a7ac97f41fea03883fb5fb0b3f8cffeca10a9c36f868ad8db0a7ee6d7e","sha512":"3279432b794e84a2e03cfcfc89bd27e29c6f1ddd2cfb9fac8be180360843ae2585a8d4d686b8e66ec8632cbd25c09184c1236d688533605d9528a5a44fc66833","ssdeep":"","tlshash":"76f050a57227336b2f1b5334c11e6346a5977d4d1cd12112580c0cc06de0e08bcb1d8c","size":533,"data":"","first_seen":"2026-09-19T07:12:53.835904Z","last_seen":"2026-09-19T08:17:52.163834Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stealfhex.to/","fqdn":"stealfhex.to","domain":"stealfhex.to","tld":"to"},"ip":{"addr":"5.188.86.237","port":443,"asn":49453,"as":"Global Layer B.V.","country":"Brazil","country_code":"BR"},"introduction_type":"scriptElement","is_inline":true,"md5":"46547f5eee323029597f338c4f37601e","sha1":"9dd24b67eaad4f2269432d09a5f844239ae5a919","sha256":"6a045632d60e4b55384744f7507ce7d3a295a9d1eafd25a005d05914b4487bc0","sha512":"3dc947c68c161284f15b5f0cb4ffbc6b14e47ecb19676c1d958e4f1bb17631f8cd49c625e6760c735761b8675204b814229e230601a5e265d39c3c4ef7445c60","ssdeep":"","tlshash":"31c02b06b13c2d3608e7430f53951bd67022008b2000003c25b1848d0904c8209d38f0","size":132,"data":"","first_seen":"2026-09-19T07:12:53.839534Z","last_seen":"2026-09-19T08:17:52.164719Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"stealfhex.to/","fqdn":"stealfhex.to","domain":"stealfhex.to","tld":"to"},"ip":{"addr":"5.188.86.237","port":443,"asn":49453,"as":"Global Layer B.V.","country":"Brazil","country_code":"BR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T08:17:22.388Z","timestamp":1789805842388,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stealfhex.to","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 09:22:29 GMT","end":"Tue, 15 Dec 2026 09:22:28 GMT"},"fingerprint":{"sha1":"72:0A:76:B6:87:E3:AE:94:E9:60:C6:78:6A:65:E0:31:8E:7C:A2:AF","sha256":"4F:AC:90:8B:46:11:CA:B6:F1:F4:07:2A:CF:6C:3C:53:53:C3:CE:79:4F:B3:00:E1:AB:29:62:E3:CB:14:EC:E1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: stealfhex.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sat, 19 Sep 2026 08:17:22 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nSet-Cookie: PHPSESSID=pn3g0mc3ced54hmgigf08olfoi; path=/\ne3b0c4_44=bloell2hutepb; expires=Sun, 20-Sep-2026 07:12:20 GMT; Max-Age=82498; path=/; domain=.stealfhex.to; HttpOnly\n_token=bloell2hutepb.1789888340.4.2525c3c0e7756562b668d5587d5f4adc; expires=Sun, 20-Sep-2026 07:12:20 GMT; Max-Age=82498; path=/; domain=.stealfhex.to; HttpOnly\n_subid=18uumd0.2c.pt8i; expires=Sun, 20-Sep-2026 07:12:20 GMT; Max-Age=82498; path=/; domain=.stealfhex.to; HttpOnly\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"pn3g0mc3ced54hmgigf08olfoi","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=pn3g0mc3ced54hmgigf08olfoi; path=/"},{"name":"e3b0c4_44","value":"bloell2hutepb","quoted":false,"path":"/","domain":".stealfhex.to","expires":"2026-09-20T07:12:20Z","raw_expires":"Sun, 20-Sep-2026 07:12:20 GMT","max_age":82498,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"e3b0c4_44=bloell2hutepb; expires=Sun, 20-Sep-2026 07:12:20 GMT; Max-Age=82498; path=/; domain=.stealfhex.to; HttpOnly"},{"name":"_token","value":"bloell2hutepb.1789888340.4.2525c3c0e7756562b668d5587d5f4adc","quoted":false,"path":"/","domain":".stealfhex.to","expires":"2026-09-20T07:12:20Z","raw_expires":"Sun, 20-Sep-2026 07:12:20 GMT","max_age":82498,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"_token=bloell2hutepb.1789888340.4.2525c3c0e7756562b668d5587d5f4adc; expires=Sun, 20-Sep-2026 07:12:20 GMT; Max-Age=82498; path=/; domain=.stealfhex.to; HttpOnly"},{"name":"_subid","value":"18uumd0.2c.pt8i","quoted":false,"path":"/","domain":".stealfhex.to","expires":"2026-09-20T07:12:20Z","raw_expires":"Sun, 20-Sep-2026 07:12:20 GMT","max_age":82498,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"_subid=18uumd0.2c.pt8i; expires=Sun, 20-Sep-2026 07:12:20 GMT; Max-Age=82498; path=/; domain=.stealfhex.to; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26981,"size_decoded":9038,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2660)","md5":"a2d34eeaf25aacb0ca11461532130662","sha1":"c66ecfe5d343ad93b1fda53d22f1b2b08579ecb0","sha256":"e3d22ab3594f5265b9e3a473599d1d38c0df5a33bd5d71bd71d1d02a0ef686b2","sha512":"96c5c75ee1635e67a9677bd289c346418ea9a1d44ba2fc984f561a68b91da865e4e65892f129bbc3e1f32ec7308cb94bf07bee462b839f3dd31f0c0dcc3ce098","ssdeep":"768:Av+eq39bUTLhIIWxA9lk2PlVDh93pIx8sv5:Av+eq39bUTFIIWAlk2PlBhvICsv5","tlshash":"4bc28662e29b3533066301d278b3b74bb2eac025de12131433bda79d87d5d5da93728a","first_seen":"2026-09-19T07:12:53.833337Z","last_seen":"2026-09-19T08:17:52.160132Z","times_seen":2,"resource_available":true,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":13,"connect":24,"send":0,"wait":76,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"stealfhex.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stealfhex.to/home-7zdqz0.css?v=1784548212","fqdn":"stealfhex.to","domain":"stealfhex.to","tld":"to"},"ip":{"addr":"5.188.86.237","port":443,"asn":49453,"as":"Global Layer B.V.","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://stealfhex.to/","date":"2026-09-19T08:17:22.743Z","timestamp":1789805842743,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stealfhex.to","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 09:22:29 GMT","end":"Tue, 15 Dec 2026 09:22:28 GMT"},"fingerprint":{"sha1":"72:0A:76:B6:87:E3:AE:94:E9:60:C6:78:6A:65:E0:31:8E:7C:A2:AF","sha256":"4F:AC:90:8B:46:11:CA:B6:F1:F4:07:2A:CF:6C:3C:53:53:C3:CE:79:4F:B3:00:E1:AB:29:62:E3:CB:14:EC:E1"}}},"request":{"raw":"GET /home-7zdqz0.css?v=1784548212 HTTP/1.1\r\nHost: stealfhex.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://stealfhex.to/\r\nCookie: PHPSESSID=pn3g0mc3ced54hmgigf08olfoi; e3b0c4_44=bloell2hutepb; _token=bloell2hutepb.1789888340.4.2525c3c0e7756562b668d5587d5f4adc; _subid=18uumd0.2c.pt8i\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sat, 19 Sep 2026 08:17:22 GMT\r\nContent-Type: text/css\r\nContent-Length: 11501\r\nLast-Modified: Sun, 02 Aug 2026 18:05:53 GMT\r\nConnection: keep-alive\r\nETag: \"6a6f8701-2ced\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":11501,"size_decoded":11750,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (641), with CRLF line terminators","md5":"73b5a112f8e186e34c20d190c46b079f","sha1":"99a369420b872e5b2a84947109f17097a60f5363","sha256":"2c18570612c2200b5df09f5f614fa56f405a18f23865d638250fde9fea87738b","sha512":"198e87c28bbd63073fa562a7dc7a57ec52fcdae4d0ebde47ce1b8cb610ffb4f8cebdda3a6687d15b0fc6478c04b5674712d25cbe5ee987a3e3bae338211356c4","ssdeep":"192:IJKD4UqvcS4/i+9IQBHAO8pFgI4PZf86LC2SGNOOXWEHn:/RY2LqU","tlshash":"d23273e6be40b028763bc457a690aadeb95c8412e4238bfef496711588c39f3172374d","first_seen":"2026-09-19T07:12:53.834566Z","last_seen":"2026-09-19T08:17:52.161078Z","times_seen":2,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"stealfhex.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"stealfhex.to/favicon.ico?v=1784548212","fqdn":"stealfhex.to","domain":"stealfhex.to","tld":"to"},"ip":{"addr":"5.188.86.237","port":443,"asn":49453,"as":"Global Layer B.V.","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://stealfhex.to/","date":"2026-09-19T08:17:22.751Z","timestamp":1789805842751,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stealfhex.to","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 09:22:29 GMT","end":"Tue, 15 Dec 2026 09:22:28 GMT"},"fingerprint":{"sha1":"72:0A:76:B6:87:E3:AE:94:E9:60:C6:78:6A:65:E0:31:8E:7C:A2:AF","sha256":"4F:AC:90:8B:46:11:CA:B6:F1:F4:07:2A:CF:6C:3C:53:53:C3:CE:79:4F:B3:00:E1:AB:29:62:E3:CB:14:EC:E1"}}},"request":{"raw":"GET /favicon.ico?v=1784548212 HTTP/1.1\r\nHost: stealfhex.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://stealfhex.to/\r\nCookie: PHPSESSID=pn3g0mc3ced54hmgigf08olfoi; e3b0c4_44=bloell2hutepb; _token=bloell2hutepb.1789888340.4.2525c3c0e7756562b668d5587d5f4adc; _subid=18uumd0.2c.pt8i\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sat, 19 Sep 2026 08:17:22 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 15406\r\nLast-Modified: Sun, 02 Aug 2026 18:05:52 GMT\r\nConnection: keep-alive\r\nETag: \"6a6f8700-3c2e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15406,"size_decoded":15659,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"4dae3df31c6fea44394c1ca2c2da1eed","sha1":"93b1bd981600df21cba19db43f82d4a5bbdc7217","sha256":"c740073c7c57fa88a4f10acf9996c95b54e1ab07c6af0ebba0f46f492aceccab","sha512":"972850a7715f0eb9aa5de373dc41f3dd71c32f47eef0e2d26affdb75e9d8d1bda3980c98420702bd3de6e809f2c5928c7ed096a3fff6803ef73c69fdaa5d5680","ssdeep":"48:quigaMlBatJHgc/8yRa2c9f31VW9L2cc2YeAMxnj:q6A3AcdRaL/WBBB","tlshash":"ff624f66b02a5e00e61a3a73b47af6752a675eb87d1403d9f5e57c2f3c320535c130ea","first_seen":"2026-09-19T07:12:53.832141Z","last_seen":"2026-09-19T08:17:52.162325Z","times_seen":3,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":16,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"stealfhex.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.coincap.io/v2/assets?ids=bitcoin,ethereum","fqdn":"api.coincap.io","domain":"coincap.io","tld":"io"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://stealfhex.to/","date":"2026-09-19T08:17:23.051Z","timestamp":1789805843051,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /v2/assets?ids=bitcoin,ethereum HTTP/1.1\r\nHost: api.coincap.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://stealfhex.to/\r\nOrigin: https://stealfhex.to\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-19T12:41:55.112535Z","times_seen":18548581,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stealfhex.to/favicon.ico?v=1784548212","fqdn":"stealfhex.to","domain":"stealfhex.to","tld":"to"},"ip":{"addr":"5.188.86.237","port":443,"asn":49453,"as":"Global Layer B.V.","country":"Brazil","country_code":"BR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://stealfhex.to/","date":"2026-09-19T08:17:23.074Z","timestamp":1789805843074,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"stealfhex.to","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 16 Sep 2026 09:22:29 GMT","end":"Tue, 15 Dec 2026 09:22:28 GMT"},"fingerprint":{"sha1":"72:0A:76:B6:87:E3:AE:94:E9:60:C6:78:6A:65:E0:31:8E:7C:A2:AF","sha256":"4F:AC:90:8B:46:11:CA:B6:F1:F4:07:2A:CF:6C:3C:53:53:C3:CE:79:4F:B3:00:E1:AB:29:62:E3:CB:14:EC:E1"}}},"request":{"raw":"GET /favicon.ico?v=1784548212 HTTP/1.1\r\nHost: stealfhex.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://stealfhex.to/\r\nCookie: PHPSESSID=pn3g0mc3ced54hmgigf08olfoi; e3b0c4_44=bloell2hutepb; _token=bloell2hutepb.1789888340.4.2525c3c0e7756562b668d5587d5f4adc; _subid=18uumd0.2c.pt8i\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sat, 19 Sep 2026 08:17:23 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 15406\r\nLast-Modified: Sun, 02 Aug 2026 18:05:52 GMT\r\nConnection: keep-alive\r\nETag: \"6a6f8700-3c2e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15406,"size_decoded":15659,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"4dae3df31c6fea44394c1ca2c2da1eed","sha1":"93b1bd981600df21cba19db43f82d4a5bbdc7217","sha256":"c740073c7c57fa88a4f10acf9996c95b54e1ab07c6af0ebba0f46f492aceccab","sha512":"972850a7715f0eb9aa5de373dc41f3dd71c32f47eef0e2d26affdb75e9d8d1bda3980c98420702bd3de6e809f2c5928c7ed096a3fff6803ef73c69fdaa5d5680","ssdeep":"48:quigaMlBatJHgc/8yRa2c9f31VW9L2cc2YeAMxnj:q6A3AcdRaL/WBBB","tlshash":"ff624f66b02a5e00e61a3a73b47af6752a675eb87d1403d9f5e57c2f3c320535c130ea","first_seen":"2026-09-19T07:12:53.832141Z","last_seen":"2026-09-19T08:17:52.162325Z","times_seen":3,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"stealfhex.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}